Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
New purchase order.exe

Overview

General Information

Sample name:New purchase order.exe
Analysis ID:1590626
MD5:1b507df9a13477b647da450a1b79b2e7
SHA1:b0de85855b3462fe0b37c79831b391eeb044e437
SHA256:a3af3dcfd89b655982b6e044b681b140dcefbe0606d69b0b7839b8cda28ccc91
Tags:exeuser-cocaman
Infos:

Detection

FormBook, PureLog Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • New purchase order.exe (PID: 3064 cmdline: "C:\Users\user\Desktop\New purchase order.exe" MD5: 1B507DF9A13477B647DA450A1B79B2E7)
    • powershell.exe (PID: 3224 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 3472 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 2244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 5228 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • schtasks.exe (PID: 6672 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • MSBuild.exe (PID: 7152 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
      • explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • cscript.exe (PID: 4784 cmdline: "C:\Windows\SysWOW64\cscript.exe" MD5: CB601B41D4C8074BE8A84AED564A94DC)
          • cmd.exe (PID: 6932 cmdline: /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 5944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chkdsk.exe (PID: 1224 cmdline: "C:\Windows\SysWOW64\chkdsk.exe" MD5: B4016BEE9D8F3AD3D02DD21C3CAFB922)
  • DjsaCPLWOz.exe (PID: 4896 cmdline: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe MD5: 1B507DF9A13477B647DA450A1B79B2E7)
    • schtasks.exe (PID: 2084 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • MSBuild.exe (PID: 5964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.ustonehuman.info/a01d/"], "decoy": ["eniorshousing05.shop", "rywisevas.biz", "4726.pizza", "itchen-design-42093.bond", "3456.tech", "4825.plus", "nlinecraps.xyz", "itamins-52836.bond", "nfluencer-marketing-40442.bond", "nline-advertising-58573.bond", "rautogroups.net", "limbtrip.net", "oftware-download-14501.bond", "nline-advertising-66733.bond", "erity.xyz", "xknrksi.icu", "x-ist.club", "yber-security-26409.bond", "oincatch.xyz", "onitoring-devices-34077.bond", "hbvc.xyz", "xecadminadvo.vip", "ookers.homes", "irlypods.shop", "nalyzator.fun", "rinciple.press", "ejigghq.company", "nity-officiels.shop", "chtm.info", "ggrupdanismanlik.online", "alterjaviersemolic.online", "6zc.lat", "ukce.fun", "ikretgunay.online", "d8ns7gu.skin", "06ks7.club", "icovideo.voyage", "nlinetutoringcanada776681.icu", "etzero.icu", "228080a0.buzz", "agoslotoke.art", "ruaim.online", "nline-mba-87219.bond", "oldsaver.biz", "agonel.online", "ommbank.video", "indlab.shop", "hesweettray.store", "bilebe.info", "uxemasculine.store", "arkbarron.xyz", "ektor.fun", "8255.pizza", "ike-loans-53803.bond", "ong-ya.info", "costcomembers-wholesale.online", "75396.vip", "leaning-services-53131.bond", "uickcabinet.net", "alifstorch.online", "ahtel.net", "usinessoverpleasure.shop", "duway.pro", "usiness-software-47704.bond"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6c81:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1d5c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xb3ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x162e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0xa338:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0xa5b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x160e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15bd1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x161e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1635f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xafca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x14e4c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xbcc3:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1c327:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1d32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x19249:$sqlite3step: 68 34 1C 7B E1
      • 0x1935c:$sqlite3step: 68 34 1C 7B E1
      • 0x19278:$sqlite3text: 68 38 2A 90 C5
      • 0x1939d:$sqlite3text: 68 38 2A 90 C5
      • 0x1928b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x193b3:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 47 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      15.2.MSBuild.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        15.2.MSBuild.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          15.2.MSBuild.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bd90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          15.2.MSBuild.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1bafa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          15.2.MSBuild.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a19:$sqlite3step: 68 34 1C 7B E1
          • 0x17b2c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a48:$sqlite3text: 68 38 2A 90 C5
          • 0x17b6d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 11 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\New purchase order.exe", ParentImage: C:\Users\user\Desktop\New purchase order.exe, ParentProcessId: 3064, ParentProcessName: New purchase order.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", ProcessId: 3224, ProcessName: powershell.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\New purchase order.exe", ParentImage: C:\Users\user\Desktop\New purchase order.exe, ParentProcessId: 3064, ParentProcessName: New purchase order.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", ProcessId: 3224, ProcessName: powershell.exe
          Sigma detected: Suspicious Add Scheduled Task Parent
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe, ParentImage: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe, ParentProcessId: 4896, ParentProcessName: DjsaCPLWOz.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp", ProcessId: 2084, ProcessName: schtasks.exe
          Sigma detected: Suspicious Schtasks From Env Var Folder
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\New purchase order.exe", ParentImage: C:\Users\user\Desktop\New purchase order.exe, ParentProcessId: 3064, ParentProcessName: New purchase order.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp", ProcessId: 6672, ProcessName: schtasks.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\New purchase order.exe", ParentImage: C:\Users\user\Desktop\New purchase order.exe, ParentProcessId: 3064, ParentProcessName: New purchase order.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe", ProcessId: 3224, ProcessName: powershell.exe

          Persistence and Installation Behavior

          barindex
          Sigma detected: Scheduled temp file as task from temp location
          Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\New purchase order.exe", ParentImage: C:\Users\user\Desktop\New purchase order.exe, ParentProcessId: 3064, ParentProcessName: New purchase order.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp", ProcessId: 6672, ProcessName: schtasks.exe

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for URL or domain
          Source: http://www.hbvc.xyz/a01d/Avira URL Cloud: Label: phishing
          Source: http://www.hbvc.xyz/a01d/www.usinessoverpleasure.shopAvira URL Cloud: Label: phishing
          Source: http://www.hbvc.xyzAvira URL Cloud: Label: phishing
          Found malware configuration
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.ustonehuman.info/a01d/"], "decoy": ["eniorshousing05.shop", "rywisevas.biz", "4726.pizza", "itchen-design-42093.bond", "3456.tech", "4825.plus", "nlinecraps.xyz", "itamins-52836.bond", "nfluencer-marketing-40442.bond", "nline-advertising-58573.bond", "rautogroups.net", "limbtrip.net", "oftware-download-14501.bond", "nline-advertising-66733.bond", "erity.xyz", "xknrksi.icu", "x-ist.club", "yber-security-26409.bond", "oincatch.xyz", "onitoring-devices-34077.bond", "hbvc.xyz", "xecadminadvo.vip", "ookers.homes", "irlypods.shop", "nalyzator.fun", "rinciple.press", "ejigghq.company", "nity-officiels.shop", "chtm.info", "ggrupdanismanlik.online", "alterjaviersemolic.online", "6zc.lat", "ukce.fun", "ikretgunay.online", "d8ns7gu.skin", "06ks7.club", "icovideo.voyage", "nlinetutoringcanada776681.icu", "etzero.icu", "228080a0.buzz", "agoslotoke.art", "ruaim.online", "nline-mba-87219.bond", "oldsaver.biz", "agonel.online", "ommbank.video", "indlab.shop", "hesweettray.store", "bilebe.info", "uxemasculine.store", "arkbarron.xyz", "ektor.fun", "8255.pizza", "ike-loans-53803.bond", "ong-ya.info", "costcomembers-wholesale.online", "75396.vip", "leaning-services-53131.bond", "uickcabinet.net", "alifstorch.online", "ahtel.net", "usinessoverpleasure.shop", "duway.pro", "usiness-software-47704.bond"]}
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeReversingLabs: Detection: 31%
          Multi AV Scanner detection for submitted file
          Source: New purchase order.exeVirustotal: Detection: 36%Perma Link
          Source: New purchase order.exeReversingLabs: Detection: 31%
          Yara detected FormBook
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for dropped file
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeJoe Sandbox ML: detected
          Machine Learning detection for sample
          Source: New purchase order.exeJoe Sandbox ML: detected
          Source: New purchase order.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: New purchase order.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: cscript.pdbUGP source: MSBuild.exe, 0000000F.00000002.2182083079.0000000003350000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 0000000F.00000002.2178927625.0000000001158000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4558737099.0000000000490000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: faZh.pdbSHA256 source: New purchase order.exe, DjsaCPLWOz.exe.0.dr
          Source: Binary string: chkdsk.pdbGCTL source: MSBuild.exe, 00000009.00000002.2184612576.0000000001450000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2184305774.0000000001228000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192669096.0000000000C50000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: chkdsk.pdb source: MSBuild.exe, 00000009.00000002.2184612576.0000000001450000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2184305774.0000000001228000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192669096.0000000000C50000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: MSBuild.exe, 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000003.2180451919.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000003.2178527747.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2183744457.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2187189233.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004DFE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: faZh.pdb source: New purchase order.exe, DjsaCPLWOz.exe.0.dr
          Source: Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, cscript.exe, 00000010.00000003.2180451919.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000003.2178527747.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2183744457.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2187189233.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004DFE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: cscript.pdb source: MSBuild.exe, 0000000F.00000002.2182083079.0000000003350000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 0000000F.00000002.2178927625.0000000001158000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, cscript.exe, 00000010.00000002.4558737099.0000000000490000.00000040.80000000.00040000.00000000.sdmp
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_004A2674 GetFileAttributesW,GetLastError,FindFirstFileW,WideCharToMultiByte,GetLastError,__alloca_probe_16,WideCharToMultiByte,GetFileAttributesA,GetLastError,FindFirstFileA,FindClose,16_2_004A2674
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 4x nop then jmp 07CF43BAh0_2_07CF3D44
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then pop edi15_2_00416CBB
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 4x nop then pop edi16_2_02E56CBB

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.ustonehuman.info/a01d/
          Performs DNS queries to domains with low reputation
          Source: DNS query: www.nlinecraps.xyz
          Tries to resolve many domain names, but no domain seems valid
          Source: unknownDNS traffic detected: query: www.ustonehuman.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ruaim.online replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ommbank.video replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.irlypods.shop replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.chtm.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ejigghq.company replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.uxemasculine.store replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.nlinecraps.xyz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.limbtrip.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.hesweettray.store replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.228080a0.buzz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.onitoring-devices-34077.bond replaycode: Name error (3)
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficDNS traffic detected: DNS query: www.ommbank.video
          Source: global trafficDNS traffic detected: DNS query: www.ruaim.online
          Source: global trafficDNS traffic detected: DNS query: www.onitoring-devices-34077.bond
          Source: global trafficDNS traffic detected: DNS query: www.irlypods.shop
          Source: global trafficDNS traffic detected: DNS query: www.chtm.info
          Source: global trafficDNS traffic detected: DNS query: www.hesweettray.store
          Source: global trafficDNS traffic detected: DNS query: www.228080a0.buzz
          Source: global trafficDNS traffic detected: DNS query: www.uxemasculine.store
          Source: global trafficDNS traffic detected: DNS query: www.nlinecraps.xyz
          Source: global trafficDNS traffic detected: DNS query: www.ustonehuman.info
          Source: global trafficDNS traffic detected: DNS query: www.limbtrip.net
          Source: global trafficDNS traffic detected: DNS query: www.ejigghq.company
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4564685923.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4564685923.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4564685923.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4564685923.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 0000000A.00000002.4563775247.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.2115248877.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.2122412017.0000000007B50000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: New purchase order.exe, 00000000.00000002.2133550897.0000000003186000.00000004.00000800.00020000.00000000.sdmp, DjsaCPLWOz.exe, 0000000C.00000002.2164910003.00000000028E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: New purchase order.exe, DjsaCPLWOz.exe.0.drString found in binary or memory: http://tempuri.org/DataSet1.xsd
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.228080a0.buzz
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.228080a0.buzz/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.228080a0.buzz/a01d/www.uxemasculine.store
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.228080a0.buzzReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chtm.info
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chtm.info/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chtm.info/a01d/www.hesweettray.store
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chtm.infoReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.d8ns7gu.skin
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.d8ns7gu.skin/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.d8ns7gu.skin/a01d/www.nline-advertising-58573.bond
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.d8ns7gu.skinReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ejigghq.company
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ejigghq.company/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ejigghq.company/a01d/www.d8ns7gu.skin
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ejigghq.companyReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hbvc.xyz
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hbvc.xyz/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hbvc.xyz/a01d/www.usinessoverpleasure.shop
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hbvc.xyzReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hesweettray.store
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hesweettray.store/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hesweettray.store/a01d/www.228080a0.buzz
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hesweettray.storeReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irlypods.shop
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irlypods.shop/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irlypods.shop/a01d/www.chtm.info
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irlypods.shopReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.limbtrip.net
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.limbtrip.net/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.limbtrip.net/a01d/www.ejigghq.company
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.limbtrip.netReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-advertising-58573.bond
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-advertising-58573.bond/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-advertising-58573.bond/a01d/www.hbvc.xyz
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-advertising-58573.bondReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nlinecraps.xyz
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nlinecraps.xyz/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nlinecraps.xyz/a01d/www.ustonehuman.info
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nlinecraps.xyzReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ommbank.video
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ommbank.video/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ommbank.video/a01d/www.ruaim.online
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ommbank.videoReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onitoring-devices-34077.bond
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onitoring-devices-34077.bond/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onitoring-devices-34077.bond/a01d/www.irlypods.shop
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onitoring-devices-34077.bondReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ruaim.online
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ruaim.online/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ruaim.online/a01d/www.onitoring-devices-34077.bond
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ruaim.onlineReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.usinessoverpleasure.shop
          Source: explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.usinessoverpleasure.shop/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.usinessoverpleasure.shopReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ustonehuman.info
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ustonehuman.info/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ustonehuman.info/a01d/www.limbtrip.net
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ustonehuman.infoReferer:
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uxemasculine.store
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uxemasculine.store/a01d/
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uxemasculine.store/a01d/www.nlinecraps.xyz
          Source: explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uxemasculine.storeReferer:
          Source: explorer.exe, 0000000A.00000003.2979316978.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2132453518.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076449895.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 0000000A.00000000.2136477465.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/I
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
          Source: explorer.exe, 0000000A.00000000.2136477465.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4567724151.000000000C087000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2980918529.000000000C086000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com-
          Source: explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
          Source: explorer.exe, 0000000A.00000000.2136477465.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4567724151.000000000C087000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2980918529.000000000C086000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.come
          Source: explorer.exe, 0000000A.00000002.4567536413.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2136477465.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comEMd
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 0000000A.00000003.2979316978.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4565119704.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2132453518.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076449895.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/e
          Source: explorer.exe, 0000000A.00000000.2136477465.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4567724151.000000000C087000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2980918529.000000000C086000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comM
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
          Source: explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
          Source: explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
          Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.4569837606.0000000010DCB000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: New purchase order.exe PID: 3064, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
          Source: Process Memory Space: DjsaCPLWOz.exe PID: 4896, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: MSBuild.exe PID: 5964, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: cscript.exe PID: 4784, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: chkdsk.exe PID: 1224, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Initial sample is a PE file and has a suspicious name
          Source: initial sampleStatic PE information: Filename: New purchase order.exe
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB4E12 NtProtectVirtualMemory,10_2_10DB4E12
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB3232 NtCreateFile,10_2_10DB3232
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB4E0A NtProtectVirtualMemory,10_2_10DB4E0A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A330 NtCreateFile,15_2_0041A330
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A3E0 NtReadFile,15_2_0041A3E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A460 NtClose,15_2_0041A460
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A510 NtAllocateVirtualMemory,15_2_0041A510
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A3DD NtReadFile,15_2_0041A3DD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A45A NtClose,15_2_0041A45A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041A50A NtAllocateVirtualMemory,15_2_0041A50A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702B60 NtClose,LdrInitializeThunk,15_2_01702B60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702BF0 NtAllocateVirtualMemory,LdrInitializeThunk,15_2_01702BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702AD0 NtReadFile,LdrInitializeThunk,15_2_01702AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702D30 NtUnmapViewOfSection,LdrInitializeThunk,15_2_01702D30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702D10 NtMapViewOfSection,LdrInitializeThunk,15_2_01702D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702DF0 NtQuerySystemInformation,LdrInitializeThunk,15_2_01702DF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702DD0 NtDelayExecution,LdrInitializeThunk,15_2_01702DD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702C70 NtFreeVirtualMemory,LdrInitializeThunk,15_2_01702C70
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702CA0 NtQueryInformationToken,LdrInitializeThunk,15_2_01702CA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702F30 NtCreateSection,LdrInitializeThunk,15_2_01702F30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702FE0 NtCreateFile,LdrInitializeThunk,15_2_01702FE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702FB0 NtResumeThread,LdrInitializeThunk,15_2_01702FB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702F90 NtProtectVirtualMemory,LdrInitializeThunk,15_2_01702F90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,15_2_01702EA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702E80 NtReadVirtualMemory,LdrInitializeThunk,15_2_01702E80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01704340 NtSetContextThread,15_2_01704340
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01704650 NtSuspendThread,15_2_01704650
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702BE0 NtQueryValueKey,15_2_01702BE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702BA0 NtEnumerateValueKey,15_2_01702BA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702B80 NtQueryInformationFile,15_2_01702B80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702AF0 NtWriteFile,15_2_01702AF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702AB0 NtWaitForSingleObject,15_2_01702AB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702D00 NtSetInformationFile,15_2_01702D00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702DB0 NtEnumerateKey,15_2_01702DB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702C60 NtCreateKey,15_2_01702C60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702C00 NtQueryInformationProcess,15_2_01702C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702CF0 NtOpenProcess,15_2_01702CF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702CC0 NtQueryVirtualMemory,15_2_01702CC0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702F60 NtCreateProcessEx,15_2_01702F60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702FA0 NtQuerySection,15_2_01702FA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702E30 NtWriteVirtualMemory,15_2_01702E30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01702EE0 NtQueueApcThread,15_2_01702EE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01703010 NtOpenDirectoryObject,15_2_01703010
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01703090 NtSetValueKey,15_2_01703090
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017035C0 NtCreateMutant,15_2_017035C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017039B0 NtGetContextThread,15_2_017039B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01703D70 NtOpenThread,15_2_01703D70
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01703D10 NtOpenProcessToken,15_2_01703D10
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22CA0 NtQueryInformationToken,LdrInitializeThunk,16_2_04F22CA0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22C70 NtFreeVirtualMemory,LdrInitializeThunk,16_2_04F22C70
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22C60 NtCreateKey,LdrInitializeThunk,16_2_04F22C60
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22DF0 NtQuerySystemInformation,LdrInitializeThunk,16_2_04F22DF0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22DD0 NtDelayExecution,LdrInitializeThunk,16_2_04F22DD0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22D10 NtMapViewOfSection,LdrInitializeThunk,16_2_04F22D10
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,16_2_04F22EA0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22FE0 NtCreateFile,LdrInitializeThunk,16_2_04F22FE0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22F30 NtCreateSection,LdrInitializeThunk,16_2_04F22F30
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22AD0 NtReadFile,LdrInitializeThunk,16_2_04F22AD0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22BF0 NtAllocateVirtualMemory,LdrInitializeThunk,16_2_04F22BF0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22BE0 NtQueryValueKey,LdrInitializeThunk,16_2_04F22BE0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22B60 NtClose,LdrInitializeThunk,16_2_04F22B60
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F235C0 NtCreateMutant,LdrInitializeThunk,16_2_04F235C0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F24650 NtSuspendThread,16_2_04F24650
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F24340 NtSetContextThread,16_2_04F24340
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22CF0 NtOpenProcess,16_2_04F22CF0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22CC0 NtQueryVirtualMemory,16_2_04F22CC0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22C00 NtQueryInformationProcess,16_2_04F22C00
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22DB0 NtEnumerateKey,16_2_04F22DB0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22D30 NtUnmapViewOfSection,16_2_04F22D30
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22D00 NtSetInformationFile,16_2_04F22D00
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22EE0 NtQueueApcThread,16_2_04F22EE0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22E80 NtReadVirtualMemory,16_2_04F22E80
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22E30 NtWriteVirtualMemory,16_2_04F22E30
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22FB0 NtResumeThread,16_2_04F22FB0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22FA0 NtQuerySection,16_2_04F22FA0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22F90 NtProtectVirtualMemory,16_2_04F22F90
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22F60 NtCreateProcessEx,16_2_04F22F60
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22AF0 NtWriteFile,16_2_04F22AF0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22AB0 NtWaitForSingleObject,16_2_04F22AB0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22BA0 NtEnumerateValueKey,16_2_04F22BA0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F22B80 NtQueryInformationFile,16_2_04F22B80
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F23090 NtSetValueKey,16_2_04F23090
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F23010 NtOpenDirectoryObject,16_2_04F23010
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F23D70 NtOpenThread,16_2_04F23D70
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F23D10 NtOpenProcessToken,16_2_04F23D10
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F239B0 NtGetContextThread,16_2_04F239B0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A3E0 NtReadFile,16_2_02E5A3E0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A330 NtCreateFile,16_2_02E5A330
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A460 NtClose,16_2_02E5A460
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A510 NtAllocateVirtualMemory,16_2_02E5A510
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A3DD NtReadFile,16_2_02E5A3DD
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A45A NtClose,16_2_02E5A45A
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5A50A NtAllocateVirtualMemory,16_2_02E5A50A
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CFA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,16_2_04CFA036
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF9BAF NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,16_2_04CF9BAF
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CFA042 NtQueryInformationProcess,16_2_04CFA042
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF9BB2 NtCreateSection,NtMapViewOfSection,16_2_04CF9BB2
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_017042040_2_01704204
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_017070180_2_01707018
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_0170D8EC0_2_0170D8EC
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7F5B00_2_05D7F5B0
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7E7C80_2_05D7E7C8
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D751800_2_05D75180
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7C0080_2_05D7C008
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7E3900_2_05D7E390
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7EC000_2_05D7EC00
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7BFC80_2_05D7BFC8
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7BFF80_2_05D7BFF8
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7CF880_2_05D7CF88
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D73F480_2_05D73F48
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D73F700_2_05D73F70
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_05D7EBF00_2_05D7EBF0
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_07CF10700_2_07CF1070
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_07CF46680_2_07CF4668
          Source: C:\Users\user\Desktop\New purchase order.exeCode function: 0_2_07CF69E80_2_07CF69E8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B01009_2_016B0100
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017060009_2_01706000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE3F09_2_016CE3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017402C09_2_017402C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C05359_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017165D09_2_017165D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017165B29_2_017165B2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C07709_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E47509_2_016E4750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DC6E09_2_016DC6E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D69629_2_016D6962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CA8409_2_016CA840
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F09_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A68F19_2_016A68F1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE8F09_2_016EE8F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F88909_2_016F8890
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2A459_2_016C2A45
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA809_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CED7A9_2_016CED7A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CAD009_2_016CAD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C8DC09_2_016C8DC0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D8DBF9_2_016D8DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0C009_2_016C0C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0CF29_2_016B0CF2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734F409_2_01734F40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01702F289_2_01702F28
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E0F309_2_016E0F30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2FC89_2_016B2FC8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173EFA09_2_0173EFA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0E599_2_016C0E59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2ED99_2_016D2ED9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F516C9_2_016F516C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AF1729_2_016AF172
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CB1B09_2_016CB1B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C33F39_2_016C33F3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DD2F09_2_016DD2F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C52A09_2_016C52A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017074E09_2_017074E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C34979_2_016C3497
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CB7309_2_016CB730
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B19799_2_016B1979
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C99509_2_016C9950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DB9509_2_016DB950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C59DA9_2_016C59DA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172D8009_2_0172D800
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C38E09_2_016C38E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01735BF09_2_01735BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016FDBF99_2_016FDBF9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DFB809_2_016DFB80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01733A6C9_2_01733A6C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C3D409_2_016C3D40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DFDC09_2_016DFDC0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01739C329_2_01739C32
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D9C209_2_016D9C20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C1F929_2_016C1F92
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C9EB09_2_016C9EB0
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21C23210_2_0E21C232
          Source: C:\Windows\explorer.exeCode function: 10_2_0E216B3010_2_0E216B30
          Source: C:\Windows\explorer.exeCode function: 10_2_0E216B3210_2_0E216B32
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21B03610_2_0E21B036
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21208210_2_0E212082
          Source: C:\Windows\explorer.exeCode function: 10_2_0E213D0210_2_0E213D02
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21991210_2_0E219912
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21F5CD10_2_0E21F5CD
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35B23210_2_0E35B232
          Source: C:\Windows\explorer.exeCode function: 10_2_0E355B3010_2_0E355B30
          Source: C:\Windows\explorer.exeCode function: 10_2_0E355B3210_2_0E355B32
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35A03610_2_0E35A036
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35108210_2_0E351082
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35891210_2_0E358912
          Source: C:\Windows\explorer.exeCode function: 10_2_0E352D0210_2_0E352D02
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35E5CD10_2_0E35E5CD
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB323210_2_10DB3232
          Source: C:\Windows\explorer.exeCode function: 10_2_10DA908210_2_10DA9082
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB203610_2_10DB2036
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB65CD10_2_10DB65CD
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB091210_2_10DB0912
          Source: C:\Windows\explorer.exeCode function: 10_2_10DAAD0210_2_10DAAD02
          Source: C:\Windows\explorer.exeCode function: 10_2_10DADB3210_2_10DADB32
          Source: C:\Windows\explorer.exeCode function: 10_2_10DADB3010_2_10DADB30
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeCode function: 12_2_00E3420412_2_00E34204
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeCode function: 12_2_00E3701812_2_00E37018
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeCode function: 12_2_00E3D8EC12_2_00E3D8EC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0040103015_2_00401030
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D8ED15_2_0041D8ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D99C15_2_0041D99C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041E2C215_2_0041E2C2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041DAE115_2_0041DAE1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041DB2015_2_0041DB20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041EBF315_2_0041EBF3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041E49315_2_0041E493
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D57615_2_0041D576
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041DD0215_2_0041DD02
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_00402D9015_2_00402D90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_00409E6015_2_00409E60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_00402FB015_2_00402FB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0175815815_2_01758158
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016C010015_2_016C0100
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0176A11815_2_0176A118
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017881CC15_2_017881CC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017901AA15_2_017901AA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017841A215_2_017841A2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0176200015_2_01762000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178A35215_2_0178A352
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016DE3F015_2_016DE3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017903E615_2_017903E6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0177027415_2_01770274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017502C015_2_017502C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D053515_2_016D0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0179059115_2_01790591
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178244615_2_01782446
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0177442015_2_01774420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0177E4F615_2_0177E4F6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D077015_2_016D0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016F475015_2_016F4750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016CC7C015_2_016CC7C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016EC6E015_2_016EC6E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016E696215_2_016E6962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D29A015_2_016D29A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0179A9A615_2_0179A9A6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D284015_2_016D2840
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016DA84015_2_016DA840
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016FE8F015_2_016FE8F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016B68B815_2_016B68B8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178AB4015_2_0178AB40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01786BD715_2_01786BD7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016CEA8015_2_016CEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0176CD1F15_2_0176CD1F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016DAD0015_2_016DAD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016CADE015_2_016CADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016E8DBF15_2_016E8DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D0C0015_2_016D0C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016C0CF215_2_016C0CF2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01770CB515_2_01770CB5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01744F4015_2_01744F40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01772F3015_2_01772F30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01712F2815_2_01712F28
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016F0F3015_2_016F0F30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016DCFE015_2_016DCFE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016C2FC815_2_016C2FC8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0174EFA015_2_0174EFA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D0E5915_2_016D0E59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178EE2615_2_0178EE26
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178EEDB15_2_0178EEDB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178CE9315_2_0178CE93
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016E2E9015_2_016E2E90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0179B16B15_2_0179B16B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016BF17215_2_016BF172
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0170516C15_2_0170516C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016DB1B015_2_016DB1B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017870E915_2_017870E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178F0E015_2_0178F0E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D70C015_2_016D70C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0177F0CC15_2_0177F0CC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016BD34C15_2_016BD34C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178132D15_2_0178132D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0171739A15_2_0171739A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017712ED15_2_017712ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016EB2C015_2_016EB2C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D52A015_2_016D52A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178757115_2_01787571
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017995C315_2_017995C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0176D5B015_2_0176D5B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016C146015_2_016C1460
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178F43F15_2_0178F43F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178F7B015_2_0178F7B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0171563015_2_01715630
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_017816CC15_2_017816CC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D995015_2_016D9950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016EB95015_2_016EB950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0176591015_2_01765910
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0173D80015_2_0173D800
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D38E015_2_016D38E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178FB7615_2_0178FB76
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01745BF015_2_01745BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0170DBF915_2_0170DBF9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016EFB8015_2_016EFB80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01743A6C15_2_01743A6C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178FA4915_2_0178FA49
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01787A4615_2_01787A46
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0177DAC615_2_0177DAC6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01715AA015_2_01715AA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01771AA315_2_01771AA3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0176DAAC15_2_0176DAAC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01787D7315_2_01787D73
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01781D5A15_2_01781D5A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D3D4015_2_016D3D40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016EFDC015_2_016EFDC0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01749C3215_2_01749C32
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178FCF215_2_0178FCF2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178FF0915_2_0178FF09
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01693FD215_2_01693FD2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_01693FD515_2_01693FD5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0178FFB115_2_0178FFB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D1F9215_2_016D1F92
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016D9EB015_2_016D9EB0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049711016_2_00497110
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F9E4F616_2_04F9E4F6
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA244616_2_04FA2446
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F9442016_2_04F94420
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FB059116_2_04FB0591
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF053516_2_04EF0535
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F0C6E016_2_04F0C6E0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EEC7C016_2_04EEC7C0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF077016_2_04EF0770
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F1475016_2_04F14750
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F8200016_2_04F82000
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA81CC16_2_04FA81CC
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FB01AA16_2_04FB01AA
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA41A216_2_04FA41A2
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F7815816_2_04F78158
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F8A11816_2_04F8A118
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EE010016_2_04EE0100
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F702C016_2_04F702C0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F9027416_2_04F90274
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FB03E616_2_04FB03E6
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EFE3F016_2_04EFE3F0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAA35216_2_04FAA352
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EE0CF216_2_04EE0CF2
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F90CB516_2_04F90CB5
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF0C0016_2_04EF0C00
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EEADE016_2_04EEADE0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F08DBF16_2_04F08DBF
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F8CD1F16_2_04F8CD1F
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EFAD0016_2_04EFAD00
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAEEDB16_2_04FAEEDB
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F02E9016_2_04F02E90
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FACE9316_2_04FACE93
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF0E5916_2_04EF0E59
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAEE2616_2_04FAEE26
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EFCFE016_2_04EFCFE0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EE2FC816_2_04EE2FC8
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F6EFA016_2_04F6EFA0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F64F4016_2_04F64F40
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F10F3016_2_04F10F30
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F92F3016_2_04F92F30
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F32F2816_2_04F32F28
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F1E8F016_2_04F1E8F0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04ED68B816_2_04ED68B8
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF284016_2_04EF2840
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EFA84016_2_04EFA840
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF29A016_2_04EF29A0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FBA9A616_2_04FBA9A6
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F0696216_2_04F06962
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EEEA8016_2_04EEEA80
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA6BD716_2_04FA6BD7
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAAB4016_2_04FAAB40
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EE146016_2_04EE1460
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAF43F16_2_04FAF43F
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FB95C316_2_04FB95C3
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F8D5B016_2_04F8D5B0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA757116_2_04FA7571
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA16CC16_2_04FA16CC
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F3563016_2_04F35630
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAF7B016_2_04FAF7B0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA70E916_2_04FA70E9
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAF0E016_2_04FAF0E0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF70C016_2_04EF70C0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F9F0CC16_2_04F9F0CC
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EFB1B016_2_04EFB1B0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FBB16B16_2_04FBB16B
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F2516C16_2_04F2516C
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EDF17216_2_04EDF172
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F912ED16_2_04F912ED
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F0B2C016_2_04F0B2C0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF52A016_2_04EF52A0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F3739A16_2_04F3739A
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EDD34C16_2_04EDD34C
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA132D16_2_04FA132D
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAFCF216_2_04FAFCF2
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F69C3216_2_04F69C32
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F0FDC016_2_04F0FDC0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA7D7316_2_04FA7D73
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA1D5A16_2_04FA1D5A
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF3D4016_2_04EF3D40
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF9EB016_2_04EF9EB0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EB3FD216_2_04EB3FD2
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EB3FD516_2_04EB3FD5
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAFFB116_2_04FAFFB1
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF1F9216_2_04EF1F92
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAFF0916_2_04FAFF09
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF38E016_2_04EF38E0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F5D80016_2_04F5D800
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F0B95016_2_04F0B950
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EF995016_2_04EF9950
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F8591016_2_04F85910
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F9DAC616_2_04F9DAC6
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F35AA016_2_04F35AA0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F8DAAC16_2_04F8DAAC
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F91AA316_2_04F91AA3
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F63A6C16_2_04F63A6C
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAFA4916_2_04FAFA49
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FA7A4616_2_04FA7A46
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F65BF016_2_04F65BF0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F2DBF916_2_04F2DBF9
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04F0FB8016_2_04F0FB80
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04FAFB7616_2_04FAFB76
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5D57616_2_02E5D576
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5DAE116_2_02E5DAE1
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5DB2016_2_02E5DB20
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5D8ED16_2_02E5D8ED
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5D99C16_2_02E5D99C
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E49E6016_2_02E49E60
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E42FB016_2_02E42FB0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E42D9016_2_02E42D90
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_02E5DD0216_2_02E5DD02
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CFA03616_2_04CFA036
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CFE5CD16_2_04CFE5CD
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF2D0216_2_04CF2D02
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF108216_2_04CF1082
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF891216_2_04CF8912
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CFB23216_2_04CFB232
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF5B3216_2_04CF5B32
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04CF5B3016_2_04CF5B30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 0173EA12 appears 86 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 0174F290 appears 105 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 01707E54 appears 97 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 0172EA12 appears 37 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 016BB970 appears 280 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 01705130 appears 58 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 01717E54 appears 111 times
          Source: C:\Windows\SysWOW64\cscript.exeCode function: String function: 04F37E54 appears 111 times
          Source: C:\Windows\SysWOW64\cscript.exeCode function: String function: 04F5EA12 appears 86 times
          Source: C:\Windows\SysWOW64\cscript.exeCode function: String function: 04F25130 appears 58 times
          Source: C:\Windows\SysWOW64\cscript.exeCode function: String function: 04EDB970 appears 280 times
          Source: C:\Windows\SysWOW64\cscript.exeCode function: String function: 04F6F290 appears 105 times
          Source: New purchase order.exe, 00000000.00000002.2133550897.0000000003284000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs New purchase order.exe
          Source: New purchase order.exe, 00000000.00000002.2134617071.0000000004179000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs New purchase order.exe
          Source: New purchase order.exe, 00000000.00000002.2136893760.0000000005C10000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs New purchase order.exe
          Source: New purchase order.exe, 00000000.00000002.2131239357.000000000142E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs New purchase order.exe
          Source: New purchase order.exe, 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs New purchase order.exe
          Source: New purchase order.exe, 00000000.00000002.2138134759.0000000007D30000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs New purchase order.exe
          Source: New purchase order.exe, 00000000.00000000.2091966424.0000000000DA2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefaZh.exeB vs New purchase order.exe
          Source: New purchase order.exeBinary or memory string: OriginalFilenamefaZh.exeB vs New purchase order.exe
          Source: New purchase order.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.4569837606.0000000010DCB000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: New purchase order.exe PID: 3064, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
          Source: Process Memory Space: DjsaCPLWOz.exe PID: 4896, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: MSBuild.exe PID: 5964, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: cscript.exe PID: 4784, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: chkdsk.exe PID: 1224, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: New purchase order.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: DjsaCPLWOz.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *.sln
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSBuild MyApp.csproj /t:Clean
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /ignoreprojectextensions:.sln
          Source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.
          Source: classification engineClassification label: mal100.troj.evad.winEXE@418/15@12/0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049BCDF FormatMessageW,SysAllocString,LocalFree,GetLastError,WideCharToMultiByte,__alloca_probe_16,WideCharToMultiByte,FormatMessageA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,LocalFree,16_2_0049BCDF
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_004964E0 CLSIDFromString,CoCreateInstance,16_2_004964E0
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_004A82B5 FindResourceExW,LoadResource,16_2_004A82B5
          Source: C:\Users\user\Desktop\New purchase order.exeFile created: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5944:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2244:120:WilError_03
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMutant created: \Sessions\1\BaseNamedObjects\gYgDmNdWFmoyLWHOnNsAj
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5872:120:WilError_03
          Source: C:\Users\user\Desktop\New purchase order.exeFile created: C:\Users\user\AppData\Local\Temp\tmp96C3.tmpJump to behavior
          Source: New purchase order.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: New purchase order.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
          Source: C:\Users\user\Desktop\New purchase order.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: New purchase order.exe, 00000000.00000000.2091966424.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, DjsaCPLWOz.exe.0.drBinary or memory string: INSERT INTO users (first_name, last_name, email, [password]) VALUES (@firstName, @lastName, @email, @password);
          Source: New purchase order.exeVirustotal: Detection: 36%
          Source: New purchase order.exeReversingLabs: Detection: 31%
          Source: C:\Users\user\Desktop\New purchase order.exeFile read: C:\Users\user\Desktop\New purchase order.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\New purchase order.exe "C:\Users\user\Desktop\New purchase order.exe"
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp"
          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          Source: unknownProcess created: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp"
          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\SysWOW64\cscript.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"
          Source: C:\Windows\SysWOW64\cscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\SysWOW64\cscript.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wininet.dll
          Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: ulib.dll
          Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: ifsutil.dll
          Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: devobj.dll
          Source: C:\Users\user\Desktop\New purchase order.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\New purchase order.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: New purchase order.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: New purchase order.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: New purchase order.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: cscript.pdbUGP source: MSBuild.exe, 0000000F.00000002.2182083079.0000000003350000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 0000000F.00000002.2178927625.0000000001158000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4558737099.0000000000490000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: faZh.pdbSHA256 source: New purchase order.exe, DjsaCPLWOz.exe.0.dr
          Source: Binary string: chkdsk.pdbGCTL source: MSBuild.exe, 00000009.00000002.2184612576.0000000001450000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2184305774.0000000001228000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192669096.0000000000C50000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: chkdsk.pdb source: MSBuild.exe, 00000009.00000002.2184612576.0000000001450000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2184305774.0000000001228000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192669096.0000000000C50000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: explorer.exe, 0000000A.00000002.4569561657.00000000104FF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4561289762.00000000053FF000.00000004.10000000.00040000.00000000.sdmp, cscript.exe, 00000010.00000002.4559527624.00000000031C8000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: MSBuild.exe, 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000003.2180451919.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000003.2178527747.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2183744457.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2187189233.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004DFE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: faZh.pdb source: New purchase order.exe, DjsaCPLWOz.exe.0.dr
          Source: Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, cscript.exe, 00000010.00000003.2180451919.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000010.00000003.2178527747.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2183744457.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000003.2187189233.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000011.00000002.2192857144.0000000004DFE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: cscript.pdb source: MSBuild.exe, 0000000F.00000002.2182083079.0000000003350000.00000040.10000000.00040000.00000000.sdmp, MSBuild.exe, 0000000F.00000002.2178927625.0000000001158000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, cscript.exe, 00000010.00000002.4558737099.0000000000490000.00000040.80000000.00040000.00000000.sdmp
          Source: New purchase order.exeStatic PE information: 0xED1B63D8 [Sat Jan 21 14:40:24 2096 UTC]
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049AA82 LoadLibraryW,GetProcAddress,FreeLibrary,16_2_0049AA82
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B09AD push ecx; mov dword ptr [esp], ecx9_2_016B09B6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01681328 push eax; iretd 9_2_01681369
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01681FEC push eax; iretd 9_2_01681FED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01707E99 push ecx; ret 9_2_01707EAC
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21FB02 push esp; retn 0000h10_2_0E21FB03
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21FB1E push esp; retn 0000h10_2_0E21FB1F
          Source: C:\Windows\explorer.exeCode function: 10_2_0E21F9B5 push esp; retn 0000h10_2_0E21FAE7
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35EB1E push esp; retn 0000h10_2_0E35EB1F
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35EB02 push esp; retn 0000h10_2_0E35EB03
          Source: C:\Windows\explorer.exeCode function: 10_2_0E2C0001 push ebp; retf 10_2_0E2C000B
          Source: C:\Windows\explorer.exeCode function: 10_2_0E35E9B5 push esp; retn 0000h10_2_0E35EAE7
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB69B5 push esp; retn 0000h10_2_10DB6AE7
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB6B1E push esp; retn 0000h10_2_10DB6B1F
          Source: C:\Windows\explorer.exeCode function: 10_2_10DB6B02 push esp; retn 0000h10_2_10DB6B03
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041792C push cs; ret 15_2_0041792D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_00416A45 push 573B2D1Ch; iretd 15_2_00416A80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_00416B05 push es; retf 15_2_00416B06
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D4D2 push eax; ret 15_2_0041D4D8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D4DB push eax; ret 15_2_0041D542
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D485 push eax; ret 15_2_0041D4D8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041E509 push dword ptr [6EBCD4A2h]; ret 15_2_0041E521
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0041D53C push eax; ret 15_2_0041D542
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0169225F pushad ; ret 15_2_016927F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016927FA pushad ; ret 15_2_016927F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_016C09AD push ecx; mov dword ptr [esp], ecx15_2_016C09B6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 15_2_0169283D push eax; iretd 15_2_01692858
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049DF11 push ecx; ret 16_2_0049DF24
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EB27FA pushad ; ret 16_2_04EB27F9
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EB225F pushad ; ret 16_2_04EB27F9
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EB283D push eax; iretd 16_2_04EB2858
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_04EE09AD push ecx; mov dword ptr [esp], ecx16_2_04EE09B6
          Source: New purchase order.exeStatic PE information: section name: .text entropy: 7.70487272734604
          Source: DjsaCPLWOz.exe.0.drStatic PE information: section name: .text entropy: 7.70487272734604
          Source: C:\Users\user\Desktop\New purchase order.exeFile created: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeJump to dropped file

          Boot Survival

          barindex
          Uses schtasks.exe or at.exe to add and modify task schedules
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp"

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: New purchase order.exe PID: 3064, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: DjsaCPLWOz.exe PID: 4896, type: MEMORYSTR
          Switches to a custom stack to bypass stack traces
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFDB442D324
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFDB4430774
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFDB4430154
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFDB442D8A4
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFDB442DA44
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI/Special instruction interceptor: Address: 7FFDB442D1E4
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D324
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB4430774
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D944
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D504
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D544
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D1E4
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB4430154
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D8A4
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442DA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cscript.exeRDTSC instruction interceptor: First address: 2E49904 second address: 2E4990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cscript.exeRDTSC instruction interceptor: First address: 2E49B7E second address: 2E49B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\chkdsk.exeRDTSC instruction interceptor: First address: 149904 second address: 14990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\chkdsk.exeRDTSC instruction interceptor: First address: 149B7E second address: 149B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: 16B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: 3150000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: 5150000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: 91F0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: A1F0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: A3F0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: B3F0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: DF0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: 28B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: 2610000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: 85B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: 6D10000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: 95B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeMemory allocated: A5B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE0D0 rdtsc 9_2_016AE0D0
          Source: C:\Users\user\Desktop\New purchase order.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7463Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2250Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6850Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2820Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 9675Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 861Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeWindow / User API: threadDelayed 3605
          Source: C:\Windows\SysWOW64\cscript.exeWindow / User API: threadDelayed 6369
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI coverage: 1.1 %
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI coverage: 1.6 %
          Source: C:\Windows\SysWOW64\cscript.exeAPI coverage: 1.6 %
          Source: C:\Users\user\Desktop\New purchase order.exe TID: 6500Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5808Thread sleep count: 7463 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7160Thread sleep time: -5534023222112862s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5848Thread sleep count: 2250 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5776Thread sleep time: -6456360425798339s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 1136Thread sleep count: 9675 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 1136Thread sleep time: -19350000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 1136Thread sleep count: 274 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 1136Thread sleep time: -548000s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe TID: 1512Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exe TID: 5676Thread sleep count: 3605 > 30
          Source: C:\Windows\SysWOW64\cscript.exe TID: 5676Thread sleep time: -7210000s >= -30000s
          Source: C:\Windows\SysWOW64\cscript.exe TID: 5676Thread sleep count: 6369 > 30
          Source: C:\Windows\SysWOW64\cscript.exe TID: 5676Thread sleep time: -12738000s >= -30000s
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cscript.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cscript.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_004A2674 GetFileAttributesW,GetLastError,FindFirstFileW,WideCharToMultiByte,GetLastError,__alloca_probe_16,WideCharToMultiByte,GetFileAttributesA,GetLastError,FindFirstFileA,FindClose,16_2_004A2674
          Source: C:\Users\user\Desktop\New purchase order.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
          Source: explorer.exe, 0000000A.00000002.4565119704.00000000097F3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWws
          Source: explorer.exe, 0000000A.00000003.3076449895.00000000098E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
          Source: explorer.exe, 0000000A.00000000.2128744833.0000000009605000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
          Source: explorer.exe, 0000000A.00000000.2112893628.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000A.00000000.2128744833.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4564685923.000000000978C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 0000000A.00000000.2112893628.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
          Source: explorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 0000000A.00000003.3076449895.00000000098E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
          Source: explorer.exe, 0000000A.00000000.2112893628.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 0000000A.00000003.3076449895.00000000098E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
          Source: explorer.exe, 0000000A.00000000.2112893628.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\New purchase order.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\cscript.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\chkdsk.exeProcess queried: DebugPort
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE0D0 rdtsc 9_2_016AE0D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F2B60 LdrInitializeThunk,9_2_016F2B60
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049AA82 LoadLibraryW,GetProcAddress,FreeLibrary,16_2_0049AA82
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F2160 mov eax, dword ptr fs:[00000030h]9_2_016F2160
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2140 mov ecx, dword ptr fs:[00000030h]9_2_016B2140
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2140 mov eax, dword ptr fs:[00000030h]9_2_016B2140
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AC156 mov eax, dword ptr fs:[00000030h]9_2_016AC156
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6154 mov eax, dword ptr fs:[00000030h]9_2_016B6154
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6154 mov eax, dword ptr fs:[00000030h]9_2_016B6154
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E0124 mov eax, dword ptr fs:[00000030h]9_2_016E0124
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E01F8 mov eax, dword ptr fs:[00000030h]9_2_016E01F8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E1D0 mov eax, dword ptr fs:[00000030h]9_2_0172E1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E1D0 mov eax, dword ptr fs:[00000030h]9_2_0172E1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E1D0 mov ecx, dword ptr fs:[00000030h]9_2_0172E1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E1D0 mov eax, dword ptr fs:[00000030h]9_2_0172E1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E1D0 mov eax, dword ptr fs:[00000030h]9_2_0172E1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0170E1D8 mov eax, dword ptr fs:[00000030h]9_2_0170E1D8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017201DA mov eax, dword ptr fs:[00000030h]9_2_017201DA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017201DA mov eax, dword ptr fs:[00000030h]9_2_017201DA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C61D1 mov eax, dword ptr fs:[00000030h]9_2_016C61D1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C61D1 mov eax, dword ptr fs:[00000030h]9_2_016C61D1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F0185 mov eax, dword ptr fs:[00000030h]9_2_016F0185
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173019F mov eax, dword ptr fs:[00000030h]9_2_0173019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173019F mov eax, dword ptr fs:[00000030h]9_2_0173019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173019F mov eax, dword ptr fs:[00000030h]9_2_0173019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173019F mov eax, dword ptr fs:[00000030h]9_2_0173019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA197 mov eax, dword ptr fs:[00000030h]9_2_016AA197
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA197 mov eax, dword ptr fs:[00000030h]9_2_016AA197
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA197 mov eax, dword ptr fs:[00000030h]9_2_016AA197
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA060 mov eax, dword ptr fs:[00000030h]9_2_016EA060
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DC073 mov eax, dword ptr fs:[00000030h]9_2_016DC073
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736050 mov eax, dword ptr fs:[00000030h]9_2_01736050
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01712045 mov eax, dword ptr fs:[00000030h]9_2_01712045
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2050 mov eax, dword ptr fs:[00000030h]9_2_016B2050
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AC020 mov eax, dword ptr fs:[00000030h]9_2_016AC020
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA020 mov eax, dword ptr fs:[00000030h]9_2_016AA020
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734000 mov ecx, dword ptr fs:[00000030h]9_2_01734000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE016 mov eax, dword ptr fs:[00000030h]9_2_016CE016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE016 mov eax, dword ptr fs:[00000030h]9_2_016CE016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE016 mov eax, dword ptr fs:[00000030h]9_2_016CE016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE016 mov eax, dword ptr fs:[00000030h]9_2_016CE016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B80E9 mov eax, dword ptr fs:[00000030h]9_2_016B80E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA0E3 mov ecx, dword ptr fs:[00000030h]9_2_016AA0E3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017360E0 mov eax, dword ptr fs:[00000030h]9_2_017360E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AC0F0 mov eax, dword ptr fs:[00000030h]9_2_016AC0F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F20F0 mov ecx, dword ptr fs:[00000030h]9_2_016F20F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017320DE mov eax, dword ptr fs:[00000030h]9_2_017320DE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A80A0 mov eax, dword ptr fs:[00000030h]9_2_016A80A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B208A mov eax, dword ptr fs:[00000030h]9_2_016B208A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172035C mov eax, dword ptr fs:[00000030h]9_2_0172035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172035C mov eax, dword ptr fs:[00000030h]9_2_0172035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172035C mov eax, dword ptr fs:[00000030h]9_2_0172035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172035C mov eax, dword ptr fs:[00000030h]9_2_0172035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173035C mov eax, dword ptr fs:[00000030h]9_2_0173035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173035C mov eax, dword ptr fs:[00000030h]9_2_0173035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173035C mov eax, dword ptr fs:[00000030h]9_2_0173035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173035C mov ecx, dword ptr fs:[00000030h]9_2_0173035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173035C mov eax, dword ptr fs:[00000030h]9_2_0173035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173035C mov eax, dword ptr fs:[00000030h]9_2_0173035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01732349 mov eax, dword ptr fs:[00000030h]9_2_01732349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0171634C mov eax, dword ptr fs:[00000030h]9_2_0171634C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2324 mov eax, dword ptr fs:[00000030h]9_2_016B2324
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA30B mov eax, dword ptr fs:[00000030h]9_2_016EA30B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA30B mov eax, dword ptr fs:[00000030h]9_2_016EA30B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA30B mov eax, dword ptr fs:[00000030h]9_2_016EA30B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AC301 mov ecx, dword ptr fs:[00000030h]9_2_016AC301
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D0310 mov ecx, dword ptr fs:[00000030h]9_2_016D0310
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C03E9 mov eax, dword ptr fs:[00000030h]9_2_016C03E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E63FF mov eax, dword ptr fs:[00000030h]9_2_016E63FF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE3F0 mov eax, dword ptr fs:[00000030h]9_2_016CE3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE3F0 mov eax, dword ptr fs:[00000030h]9_2_016CE3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE3F0 mov eax, dword ptr fs:[00000030h]9_2_016CE3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B83C0 mov eax, dword ptr fs:[00000030h]9_2_016B83C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B83C0 mov eax, dword ptr fs:[00000030h]9_2_016B83C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B83C0 mov eax, dword ptr fs:[00000030h]9_2_016B83C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B83C0 mov eax, dword ptr fs:[00000030h]9_2_016B83C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017363C0 mov eax, dword ptr fs:[00000030h]9_2_017363C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE388 mov eax, dword ptr fs:[00000030h]9_2_016AE388
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE388 mov eax, dword ptr fs:[00000030h]9_2_016AE388
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE388 mov eax, dword ptr fs:[00000030h]9_2_016AE388
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D438F mov eax, dword ptr fs:[00000030h]9_2_016D438F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D438F mov eax, dword ptr fs:[00000030h]9_2_016D438F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8397 mov eax, dword ptr fs:[00000030h]9_2_016A8397
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8397 mov eax, dword ptr fs:[00000030h]9_2_016A8397
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8397 mov eax, dword ptr fs:[00000030h]9_2_016A8397
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A826B mov eax, dword ptr fs:[00000030h]9_2_016A826B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4260 mov eax, dword ptr fs:[00000030h]9_2_016B4260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4260 mov eax, dword ptr fs:[00000030h]9_2_016B4260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4260 mov eax, dword ptr fs:[00000030h]9_2_016B4260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01738243 mov eax, dword ptr fs:[00000030h]9_2_01738243
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01738243 mov ecx, dword ptr fs:[00000030h]9_2_01738243
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6259 mov eax, dword ptr fs:[00000030h]9_2_016B6259
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA250 mov eax, dword ptr fs:[00000030h]9_2_016AA250
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A823B mov eax, dword ptr fs:[00000030h]9_2_016A823B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0218 mov eax, dword ptr fs:[00000030h]9_2_016C0218
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C02E1 mov eax, dword ptr fs:[00000030h]9_2_016C02E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C02E1 mov eax, dword ptr fs:[00000030h]9_2_016C02E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C02E1 mov eax, dword ptr fs:[00000030h]9_2_016C02E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA2C3 mov eax, dword ptr fs:[00000030h]9_2_016BA2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA2C3 mov eax, dword ptr fs:[00000030h]9_2_016BA2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA2C3 mov eax, dword ptr fs:[00000030h]9_2_016BA2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA2C3 mov eax, dword ptr fs:[00000030h]9_2_016BA2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA2C3 mov eax, dword ptr fs:[00000030h]9_2_016BA2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C02A0 mov eax, dword ptr fs:[00000030h]9_2_016C02A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C02A0 mov eax, dword ptr fs:[00000030h]9_2_016C02A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE284 mov eax, dword ptr fs:[00000030h]9_2_016EE284
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE284 mov eax, dword ptr fs:[00000030h]9_2_016EE284
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01730283 mov eax, dword ptr fs:[00000030h]9_2_01730283
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01730283 mov eax, dword ptr fs:[00000030h]9_2_01730283
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01730283 mov eax, dword ptr fs:[00000030h]9_2_01730283
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E656A mov eax, dword ptr fs:[00000030h]9_2_016E656A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E656A mov eax, dword ptr fs:[00000030h]9_2_016E656A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E656A mov eax, dword ptr fs:[00000030h]9_2_016E656A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE53E mov eax, dword ptr fs:[00000030h]9_2_016DE53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE53E mov eax, dword ptr fs:[00000030h]9_2_016DE53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE53E mov eax, dword ptr fs:[00000030h]9_2_016DE53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE53E mov eax, dword ptr fs:[00000030h]9_2_016DE53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE53E mov eax, dword ptr fs:[00000030h]9_2_016DE53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0535 mov eax, dword ptr fs:[00000030h]9_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0535 mov eax, dword ptr fs:[00000030h]9_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0535 mov eax, dword ptr fs:[00000030h]9_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0535 mov eax, dword ptr fs:[00000030h]9_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0535 mov eax, dword ptr fs:[00000030h]9_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0535 mov eax, dword ptr fs:[00000030h]9_2_016C0535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC5ED mov eax, dword ptr fs:[00000030h]9_2_016EC5ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC5ED mov eax, dword ptr fs:[00000030h]9_2_016EC5ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE5E7 mov eax, dword ptr fs:[00000030h]9_2_016DE5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B25E0 mov eax, dword ptr fs:[00000030h]9_2_016B25E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE5CF mov eax, dword ptr fs:[00000030h]9_2_016EE5CF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE5CF mov eax, dword ptr fs:[00000030h]9_2_016EE5CF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B65D0 mov eax, dword ptr fs:[00000030h]9_2_016B65D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA5D0 mov eax, dword ptr fs:[00000030h]9_2_016EA5D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA5D0 mov eax, dword ptr fs:[00000030h]9_2_016EA5D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D45B1 mov eax, dword ptr fs:[00000030h]9_2_016D45B1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D45B1 mov eax, dword ptr fs:[00000030h]9_2_016D45B1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E4588 mov eax, dword ptr fs:[00000030h]9_2_016E4588
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2582 mov eax, dword ptr fs:[00000030h]9_2_016B2582
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B2582 mov ecx, dword ptr fs:[00000030h]9_2_016B2582
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA580 mov ecx, dword ptr fs:[00000030h]9_2_016AA580
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA580 mov eax, dword ptr fs:[00000030h]9_2_016AA580
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE59C mov eax, dword ptr fs:[00000030h]9_2_016EE59C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173C460 mov ecx, dword ptr fs:[00000030h]9_2_0173C460
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA471 mov eax, dword ptr fs:[00000030h]9_2_016BA471
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DA470 mov eax, dword ptr fs:[00000030h]9_2_016DA470
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DA470 mov eax, dword ptr fs:[00000030h]9_2_016DA470
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DA470 mov eax, dword ptr fs:[00000030h]9_2_016DA470
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EE443 mov eax, dword ptr fs:[00000030h]9_2_016EE443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D245A mov eax, dword ptr fs:[00000030h]9_2_016D245A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE420 mov eax, dword ptr fs:[00000030h]9_2_016AE420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE420 mov eax, dword ptr fs:[00000030h]9_2_016AE420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AE420 mov eax, dword ptr fs:[00000030h]9_2_016AE420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AC427 mov eax, dword ptr fs:[00000030h]9_2_016AC427
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01736420 mov eax, dword ptr fs:[00000030h]9_2_01736420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA430 mov eax, dword ptr fs:[00000030h]9_2_016EA430
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8402 mov eax, dword ptr fs:[00000030h]9_2_016E8402
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8402 mov eax, dword ptr fs:[00000030h]9_2_016E8402
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8402 mov eax, dword ptr fs:[00000030h]9_2_016E8402
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B04E5 mov ecx, dword ptr fs:[00000030h]9_2_016B04E5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B64AB mov eax, dword ptr fs:[00000030h]9_2_016B64AB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173A4B0 mov eax, dword ptr fs:[00000030h]9_2_0173A4B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A64BA mov eax, dword ptr fs:[00000030h]9_2_016A64BA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E44B0 mov ecx, dword ptr fs:[00000030h]9_2_016E44B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6484 mov eax, dword ptr fs:[00000030h]9_2_016B6484
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8770 mov eax, dword ptr fs:[00000030h]9_2_016B8770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0770 mov eax, dword ptr fs:[00000030h]9_2_016C0770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E674D mov esi, dword ptr fs:[00000030h]9_2_016E674D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E674D mov eax, dword ptr fs:[00000030h]9_2_016E674D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E674D mov eax, dword ptr fs:[00000030h]9_2_016E674D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734755 mov eax, dword ptr fs:[00000030h]9_2_01734755
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AA740 mov eax, dword ptr fs:[00000030h]9_2_016AA740
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173E75D mov eax, dword ptr fs:[00000030h]9_2_0173E75D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0750 mov eax, dword ptr fs:[00000030h]9_2_016B0750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F2750 mov eax, dword ptr fs:[00000030h]9_2_016F2750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F2750 mov eax, dword ptr fs:[00000030h]9_2_016F2750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172C730 mov eax, dword ptr fs:[00000030h]9_2_0172C730
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC720 mov eax, dword ptr fs:[00000030h]9_2_016EC720
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC720 mov eax, dword ptr fs:[00000030h]9_2_016EC720
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E273C mov eax, dword ptr fs:[00000030h]9_2_016E273C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E273C mov ecx, dword ptr fs:[00000030h]9_2_016E273C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E273C mov eax, dword ptr fs:[00000030h]9_2_016E273C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC700 mov eax, dword ptr fs:[00000030h]9_2_016EC700
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0710 mov eax, dword ptr fs:[00000030h]9_2_016B0710
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E0710 mov eax, dword ptr fs:[00000030h]9_2_016E0710
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D27ED mov eax, dword ptr fs:[00000030h]9_2_016D27ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D27ED mov eax, dword ptr fs:[00000030h]9_2_016D27ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D27ED mov eax, dword ptr fs:[00000030h]9_2_016D27ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B47FB mov eax, dword ptr fs:[00000030h]9_2_016B47FB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B47FB mov eax, dword ptr fs:[00000030h]9_2_016B47FB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173E7E1 mov eax, dword ptr fs:[00000030h]9_2_0173E7E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC7F0 mov eax, dword ptr fs:[00000030h]9_2_016EC7F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017307C3 mov eax, dword ptr fs:[00000030h]9_2_017307C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B07AF mov eax, dword ptr fs:[00000030h]9_2_016B07AF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C266C mov eax, dword ptr fs:[00000030h]9_2_016C266C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA660 mov eax, dword ptr fs:[00000030h]9_2_016EA660
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA660 mov eax, dword ptr fs:[00000030h]9_2_016EA660
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E2674 mov eax, dword ptr fs:[00000030h]9_2_016E2674
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CC640 mov eax, dword ptr fs:[00000030h]9_2_016CC640
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B262C mov eax, dword ptr fs:[00000030h]9_2_016B262C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CE627 mov eax, dword ptr fs:[00000030h]9_2_016CE627
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E6620 mov eax, dword ptr fs:[00000030h]9_2_016E6620
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8620 mov eax, dword ptr fs:[00000030h]9_2_016E8620
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F2619 mov eax, dword ptr fs:[00000030h]9_2_016F2619
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E609 mov eax, dword ptr fs:[00000030h]9_2_0172E609
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E6F2 mov eax, dword ptr fs:[00000030h]9_2_0172E6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E6F2 mov eax, dword ptr fs:[00000030h]9_2_0172E6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E6F2 mov eax, dword ptr fs:[00000030h]9_2_0172E6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E6F2 mov eax, dword ptr fs:[00000030h]9_2_0172E6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017306F1 mov eax, dword ptr fs:[00000030h]9_2_017306F1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017306F1 mov eax, dword ptr fs:[00000030h]9_2_017306F1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C26EB mov eax, dword ptr fs:[00000030h]9_2_016C26EB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C26EB mov eax, dword ptr fs:[00000030h]9_2_016C26EB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C26EB mov eax, dword ptr fs:[00000030h]9_2_016C26EB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C26EB mov eax, dword ptr fs:[00000030h]9_2_016C26EB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA6C7 mov ebx, dword ptr fs:[00000030h]9_2_016EA6C7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA6C7 mov eax, dword ptr fs:[00000030h]9_2_016EA6C7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC6A6 mov eax, dword ptr fs:[00000030h]9_2_016EC6A6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E66B0 mov eax, dword ptr fs:[00000030h]9_2_016E66B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC68B mov eax, dword ptr fs:[00000030h]9_2_016EC68B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4690 mov eax, dword ptr fs:[00000030h]9_2_016B4690
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4690 mov eax, dword ptr fs:[00000030h]9_2_016B4690
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F096E mov eax, dword ptr fs:[00000030h]9_2_016F096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F096E mov edx, dword ptr fs:[00000030h]9_2_016F096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016F096E mov eax, dword ptr fs:[00000030h]9_2_016F096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173C97C mov eax, dword ptr fs:[00000030h]9_2_0173C97C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D6962 mov eax, dword ptr fs:[00000030h]9_2_016D6962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D6962 mov eax, dword ptr fs:[00000030h]9_2_016D6962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D6962 mov eax, dword ptr fs:[00000030h]9_2_016D6962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01730946 mov eax, dword ptr fs:[00000030h]9_2_01730946
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA950 mov eax, dword ptr fs:[00000030h]9_2_016EA950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173892A mov eax, dword ptr fs:[00000030h]9_2_0173892A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173C912 mov eax, dword ptr fs:[00000030h]9_2_0173C912
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8918 mov eax, dword ptr fs:[00000030h]9_2_016A8918
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8918 mov eax, dword ptr fs:[00000030h]9_2_016A8918
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E908 mov eax, dword ptr fs:[00000030h]9_2_0172E908
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172E908 mov eax, dword ptr fs:[00000030h]9_2_0172E908
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173E9E0 mov eax, dword ptr fs:[00000030h]9_2_0173E9E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E29F9 mov eax, dword ptr fs:[00000030h]9_2_016E29F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E29F9 mov eax, dword ptr fs:[00000030h]9_2_016E29F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA9D0 mov eax, dword ptr fs:[00000030h]9_2_016BA9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA9D0 mov eax, dword ptr fs:[00000030h]9_2_016BA9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA9D0 mov eax, dword ptr fs:[00000030h]9_2_016BA9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA9D0 mov eax, dword ptr fs:[00000030h]9_2_016BA9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA9D0 mov eax, dword ptr fs:[00000030h]9_2_016BA9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BA9D0 mov eax, dword ptr fs:[00000030h]9_2_016BA9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E49D0 mov eax, dword ptr fs:[00000030h]9_2_016E49D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017389B3 mov esi, dword ptr fs:[00000030h]9_2_017389B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017389B3 mov eax, dword ptr fs:[00000030h]9_2_017389B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_017389B3 mov eax, dword ptr fs:[00000030h]9_2_017389B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B09AD mov eax, dword ptr fs:[00000030h]9_2_016B09AD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B09AD mov eax, dword ptr fs:[00000030h]9_2_016B09AD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173E872 mov eax, dword ptr fs:[00000030h]9_2_0173E872
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173E872 mov eax, dword ptr fs:[00000030h]9_2_0173E872
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4859 mov eax, dword ptr fs:[00000030h]9_2_016B4859
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B4859 mov eax, dword ptr fs:[00000030h]9_2_016B4859
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E0854 mov eax, dword ptr fs:[00000030h]9_2_016E0854
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2835 mov eax, dword ptr fs:[00000030h]9_2_016D2835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2835 mov eax, dword ptr fs:[00000030h]9_2_016D2835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2835 mov eax, dword ptr fs:[00000030h]9_2_016D2835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2835 mov ecx, dword ptr fs:[00000030h]9_2_016D2835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2835 mov eax, dword ptr fs:[00000030h]9_2_016D2835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D2835 mov eax, dword ptr fs:[00000030h]9_2_016D2835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EA830 mov eax, dword ptr fs:[00000030h]9_2_016EA830
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173C810 mov eax, dword ptr fs:[00000030h]9_2_0173C810
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC8F9 mov eax, dword ptr fs:[00000030h]9_2_016EC8F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EC8F9 mov eax, dword ptr fs:[00000030h]9_2_016EC8F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F0 mov eax, dword ptr fs:[00000030h]9_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F0 mov eax, dword ptr fs:[00000030h]9_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F0 mov eax, dword ptr fs:[00000030h]9_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F0 mov eax, dword ptr fs:[00000030h]9_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F0 mov eax, dword ptr fs:[00000030h]9_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B28F0 mov eax, dword ptr fs:[00000030h]9_2_016B28F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DE8C0 mov eax, dword ptr fs:[00000030h]9_2_016DE8C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C28D0 mov ecx, dword ptr fs:[00000030h]9_2_016C28D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0887 mov eax, dword ptr fs:[00000030h]9_2_016B0887
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173C89D mov eax, dword ptr fs:[00000030h]9_2_0173C89D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ACB7E mov eax, dword ptr fs:[00000030h]9_2_016ACB7E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2B79 mov eax, dword ptr fs:[00000030h]9_2_016C2B79
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2B79 mov eax, dword ptr fs:[00000030h]9_2_016C2B79
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2B79 mov eax, dword ptr fs:[00000030h]9_2_016C2B79
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8B50 mov eax, dword ptr fs:[00000030h]9_2_016A8B50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DEB20 mov eax, dword ptr fs:[00000030h]9_2_016DEB20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DEB20 mov eax, dword ptr fs:[00000030h]9_2_016DEB20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172EB1D mov eax, dword ptr fs:[00000030h]9_2_0172EB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173CBF0 mov eax, dword ptr fs:[00000030h]9_2_0173CBF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01712BF6 mov eax, dword ptr fs:[00000030h]9_2_01712BF6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DEBFC mov eax, dword ptr fs:[00000030h]9_2_016DEBFC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8BF0 mov eax, dword ptr fs:[00000030h]9_2_016B8BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8BF0 mov eax, dword ptr fs:[00000030h]9_2_016B8BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8BF0 mov eax, dword ptr fs:[00000030h]9_2_016B8BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8BF0 mov ecx, dword ptr fs:[00000030h]9_2_016E8BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8BF0 mov eax, dword ptr fs:[00000030h]9_2_016E8BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8BF0 mov eax, dword ptr fs:[00000030h]9_2_016E8BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0BCD mov eax, dword ptr fs:[00000030h]9_2_016B0BCD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0BCD mov eax, dword ptr fs:[00000030h]9_2_016B0BCD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0BCD mov eax, dword ptr fs:[00000030h]9_2_016B0BCD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0BBE mov eax, dword ptr fs:[00000030h]9_2_016C0BBE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0BBE mov eax, dword ptr fs:[00000030h]9_2_016C0BBE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172CA72 mov eax, dword ptr fs:[00000030h]9_2_0172CA72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172CA72 mov eax, dword ptr fs:[00000030h]9_2_0172CA72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECA6F mov eax, dword ptr fs:[00000030h]9_2_016ECA6F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECA6F mov eax, dword ptr fs:[00000030h]9_2_016ECA6F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECA6F mov eax, dword ptr fs:[00000030h]9_2_016ECA6F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2A45 mov eax, dword ptr fs:[00000030h]9_2_016C2A45
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2A45 mov eax, dword ptr fs:[00000030h]9_2_016C2A45
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2A45 mov eax, dword ptr fs:[00000030h]9_2_016C2A45
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0A5B mov eax, dword ptr fs:[00000030h]9_2_016C0A5B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0A5B mov eax, dword ptr fs:[00000030h]9_2_016C0A5B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6A50 mov eax, dword ptr fs:[00000030h]9_2_016B6A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E0A50 mov eax, dword ptr fs:[00000030h]9_2_016E0A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECA24 mov eax, dword ptr fs:[00000030h]9_2_016ECA24
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECA38 mov eax, dword ptr fs:[00000030h]9_2_016ECA38
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D4A35 mov eax, dword ptr fs:[00000030h]9_2_016D4A35
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D4A35 mov eax, dword ptr fs:[00000030h]9_2_016D4A35
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0173CA11 mov eax, dword ptr fs:[00000030h]9_2_0173CA11
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8A00 mov eax, dword ptr fs:[00000030h]9_2_016A8A00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8A00 mov eax, dword ptr fs:[00000030h]9_2_016A8A00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EAAEE mov eax, dword ptr fs:[00000030h]9_2_016EAAEE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016EAAEE mov eax, dword ptr fs:[00000030h]9_2_016EAAEE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0AD0 mov eax, dword ptr fs:[00000030h]9_2_016B0AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01706ACC mov eax, dword ptr fs:[00000030h]9_2_01706ACC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01706ACC mov eax, dword ptr fs:[00000030h]9_2_01706ACC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01706ACC mov eax, dword ptr fs:[00000030h]9_2_01706ACC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E4AD0 mov eax, dword ptr fs:[00000030h]9_2_016E4AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E4AD0 mov eax, dword ptr fs:[00000030h]9_2_016E4AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8AA0 mov eax, dword ptr fs:[00000030h]9_2_016B8AA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8AA0 mov eax, dword ptr fs:[00000030h]9_2_016B8AA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01706AA4 mov eax, dword ptr fs:[00000030h]9_2_01706AA4
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AEA80 mov eax, dword ptr fs:[00000030h]9_2_016AEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AEA80 mov eax, dword ptr fs:[00000030h]9_2_016AEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BEA80 mov eax, dword ptr fs:[00000030h]9_2_016BEA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E8A90 mov edx, dword ptr fs:[00000030h]9_2_016E8A90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0D59 mov eax, dword ptr fs:[00000030h]9_2_016B0D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0D59 mov eax, dword ptr fs:[00000030h]9_2_016B0D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B0D59 mov eax, dword ptr fs:[00000030h]9_2_016B0D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8D59 mov eax, dword ptr fs:[00000030h]9_2_016B8D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8D59 mov eax, dword ptr fs:[00000030h]9_2_016B8D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8D59 mov eax, dword ptr fs:[00000030h]9_2_016B8D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8D59 mov eax, dword ptr fs:[00000030h]9_2_016B8D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B8D59 mov eax, dword ptr fs:[00000030h]9_2_016B8D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01738D20 mov eax, dword ptr fs:[00000030h]9_2_01738D20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CAD00 mov eax, dword ptr fs:[00000030h]9_2_016CAD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CAD00 mov eax, dword ptr fs:[00000030h]9_2_016CAD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016CAD00 mov eax, dword ptr fs:[00000030h]9_2_016CAD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E4D1D mov eax, dword ptr fs:[00000030h]9_2_016E4D1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A6D10 mov eax, dword ptr fs:[00000030h]9_2_016A6D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A6D10 mov eax, dword ptr fs:[00000030h]9_2_016A6D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A6D10 mov eax, dword ptr fs:[00000030h]9_2_016A6D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ACDEA mov eax, dword ptr fs:[00000030h]9_2_016ACDEA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ACDEA mov eax, dword ptr fs:[00000030h]9_2_016ACDEA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D0DE1 mov eax, dword ptr fs:[00000030h]9_2_016D0DE1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DCDF0 mov eax, dword ptr fs:[00000030h]9_2_016DCDF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DCDF0 mov ecx, dword ptr fs:[00000030h]9_2_016DCDF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734DD7 mov eax, dword ptr fs:[00000030h]9_2_01734DD7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734DD7 mov eax, dword ptr fs:[00000030h]9_2_01734DD7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DEDD3 mov eax, dword ptr fs:[00000030h]9_2_016DEDD3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DEDD3 mov eax, dword ptr fs:[00000030h]9_2_016DEDD3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E6DA0 mov eax, dword ptr fs:[00000030h]9_2_016E6DA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D8DBF mov eax, dword ptr fs:[00000030h]9_2_016D8DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D8DBF mov eax, dword ptr fs:[00000030h]9_2_016D8DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECDB1 mov ecx, dword ptr fs:[00000030h]9_2_016ECDB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECDB1 mov eax, dword ptr fs:[00000030h]9_2_016ECDB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECDB1 mov eax, dword ptr fs:[00000030h]9_2_016ECDB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BCC74 mov eax, dword ptr fs:[00000030h]9_2_016BCC74
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D0C44 mov eax, dword ptr fs:[00000030h]9_2_016D0C44
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D0C44 mov eax, dword ptr fs:[00000030h]9_2_016D0C44
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E4C59 mov eax, dword ptr fs:[00000030h]9_2_016E4C59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAC50 mov eax, dword ptr fs:[00000030h]9_2_016BAC50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAC50 mov eax, dword ptr fs:[00000030h]9_2_016BAC50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAC50 mov eax, dword ptr fs:[00000030h]9_2_016BAC50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAC50 mov eax, dword ptr fs:[00000030h]9_2_016BAC50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAC50 mov eax, dword ptr fs:[00000030h]9_2_016BAC50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAC50 mov eax, dword ptr fs:[00000030h]9_2_016BAC50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6C50 mov eax, dword ptr fs:[00000030h]9_2_016B6C50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6C50 mov eax, dword ptr fs:[00000030h]9_2_016B6C50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016B6C50 mov eax, dword ptr fs:[00000030h]9_2_016B6C50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016AEC20 mov eax, dword ptr fs:[00000030h]9_2_016AEC20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0C00 mov eax, dword ptr fs:[00000030h]9_2_016C0C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0C00 mov eax, dword ptr fs:[00000030h]9_2_016C0C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0C00 mov eax, dword ptr fs:[00000030h]9_2_016C0C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C0C00 mov eax, dword ptr fs:[00000030h]9_2_016C0C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ECC00 mov eax, dword ptr fs:[00000030h]9_2_016ECC00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734C0F mov eax, dword ptr fs:[00000030h]9_2_01734C0F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E2CF0 mov eax, dword ptr fs:[00000030h]9_2_016E2CF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E2CF0 mov eax, dword ptr fs:[00000030h]9_2_016E2CF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E2CF0 mov eax, dword ptr fs:[00000030h]9_2_016E2CF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E2CF0 mov eax, dword ptr fs:[00000030h]9_2_016E2CF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016ACCC8 mov eax, dword ptr fs:[00000030h]9_2_016ACCC8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2CDC mov eax, dword ptr fs:[00000030h]9_2_016C2CDC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2CDC mov eax, dword ptr fs:[00000030h]9_2_016C2CDC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2CDC mov eax, dword ptr fs:[00000030h]9_2_016C2CDC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8CD0 mov eax, dword ptr fs:[00000030h]9_2_016A8CD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172CCA0 mov ecx, dword ptr fs:[00000030h]9_2_0172CCA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172CCA0 mov eax, dword ptr fs:[00000030h]9_2_0172CCA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172CCA0 mov eax, dword ptr fs:[00000030h]9_2_0172CCA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_0172CCA0 mov eax, dword ptr fs:[00000030h]9_2_0172CCA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734CA8 mov eax, dword ptr fs:[00000030h]9_2_01734CA8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D8CB1 mov eax, dword ptr fs:[00000030h]9_2_016D8CB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016D8CB1 mov eax, dword ptr fs:[00000030h]9_2_016D8CB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016A8C8D mov eax, dword ptr fs:[00000030h]9_2_016A8C8D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DAF69 mov eax, dword ptr fs:[00000030h]9_2_016DAF69
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016DAF69 mov eax, dword ptr fs:[00000030h]9_2_016DAF69
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E6F60 mov eax, dword ptr fs:[00000030h]9_2_016E6F60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016E6F60 mov eax, dword ptr fs:[00000030h]9_2_016E6F60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F7B mov eax, dword ptr fs:[00000030h]9_2_016C2F7B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F72 mov eax, dword ptr fs:[00000030h]9_2_016C2F72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAF42 mov eax, dword ptr fs:[00000030h]9_2_016BAF42
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAF42 mov eax, dword ptr fs:[00000030h]9_2_016BAF42
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016BAF42 mov eax, dword ptr fs:[00000030h]9_2_016BAF42
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_016C2F47 mov eax, dword ptr fs:[00000030h]9_2_016C2F47
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734F40 mov eax, dword ptr fs:[00000030h]9_2_01734F40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 9_2_01734F40 mov eax, dword ptr fs:[00000030h]9_2_01734F40
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049647E GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,16_2_0049647E
          Source: C:\Users\user\Desktop\New purchase order.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049DCAA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_0049DCAA
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe"
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe"
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe"Jump to behavior
          Allocates memory in foreign processes
          Source: C:\Users\user\Desktop\New purchase order.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and writeJump to behavior
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtQueueApcThread: Indirect: 0x14CA4F2Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtQueueApcThread: Indirect: 0x1B9A4F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtClose: Indirect: 0x14CA56C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeNtClose: Indirect: 0x1B9A56C
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\New purchase order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5AJump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: NULL target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread register set: target process: 4004Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread register set: target process: 4004
          Source: C:\Windows\SysWOW64\cscript.exeThread register set: target process: 4004
          Queues an APC in another process (thread injection)
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: C50000Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection unmapped: C:\Windows\SysWOW64\cscript.exe base address: 490000
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\New purchase order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C09008Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp"Jump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          Source: explorer.exe, 0000000A.00000000.2115007420.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000002.4559956397.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
          Source: explorer.exe, 0000000A.00000000.2119045152.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2115007420.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000002.4559956397.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 0000000A.00000000.2115007420.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000002.4559956397.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 0000000A.00000000.2112893628.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4559036140.0000000000D69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +Progman
          Source: explorer.exe, 0000000A.00000000.2115007420.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000002.4559956397.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 0000000A.00000002.4565119704.00000000098E3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076180952.00000000098C4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2979316978.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd31A
          Source: C:\Windows\SysWOW64\cscript.exeCode function: GetUserDefaultLCID,FreeLibrary,GetLocaleInfoA,LoadStringA,GetModuleFileNameA,CharNextA,memcpy,strcpy_s,LoadLibraryExA,LoadLibraryExA,sprintf_s,CharNextA,memcpy,strcpy_s,LoadLibraryExA,LoadLibraryExA,GetUserDefaultLCID,GetLocaleInfoA,sprintf_s,CharNextA,memcpy,strcpy_s,LoadLibraryExA,LoadLibraryExA,16_2_0049AADC
          Source: C:\Windows\SysWOW64\cscript.exeCode function: GetLocaleInfoW,wcsncmp,16_2_004A7E85
          Source: C:\Windows\SysWOW64\cscript.exeCode function: GetLocaleInfoW,16_2_0049AB35
          Source: C:\Users\user\Desktop\New purchase order.exeQueries volume information: C:\Users\user\Desktop\New purchase order.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New purchase order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeQueries volume information: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049DC00 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,16_2_0049DC00
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_00497490 RegOpenKeyExW,RegOpenKeyExW,SysFreeString,RegCloseKey,RegCloseKey,WideCharToMultiByte,__alloca_probe_16,WideCharToMultiByte,RegOpenKeyExA,GetLastError,RegisterEventSourceW,GetUserNameW,LookupAccountNameW,LookupAccountNameW,ReportEventW,DeregisterEventSource,16_2_00497490
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049A9C0 InitializeCriticalSection,GetVersionExA,16_2_0049A9C0
          Source: C:\Users\user\Desktop\New purchase order.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected PureLog Stealer
          Source: Yara matchFile source: 0.2.New purchase order.exe.3564624.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.5c10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.5c10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.3564624.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.33427f4.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.3289e88.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.2134617071.0000000004179000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2136893760.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2133550897.0000000003284000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected PureLog Stealer
          Source: Yara matchFile source: 0.2.New purchase order.exe.3564624.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.5c10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.5c10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.3564624.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.33427f4.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.New purchase order.exe.3289e88.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.2134617071.0000000004179000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2136893760.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2133550897.0000000003284000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_004A5880 CreateBindCtx,MkParseDisplayName,16_2_004A5880
          Source: C:\Windows\SysWOW64\cscript.exeCode function: 16_2_0049CD6C CoCreateInstance,CoCreateInstance,GetUserDefaultLCID,CoGetClassObject,CreateBindCtx,16_2_0049CD6C

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
          Native API          		1
          DLL Side-Loading          		1
          Abuse Elevation Control Mechanism          		11
          Disable or Modify Tools          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		12
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Shared Modules          		1
          Scheduled Task/Job          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          Account Discovery          		Remote Desktop ProtocolData from Removable Media1
          Non-Application Layer Protocol          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts1
          Scheduled Task/Job          		Logon Script (Windows)712
          Process Injection          		1
          Abuse Elevation Control Mechanism          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin SharesData from Network Shared Drive12
          Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
          Scheduled Task/Job          		4
          Obfuscated Files or Information          		NTDS224
          System Information Discovery          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
          Software Packing          		LSA Secrets331
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Timestomp          		Cached Domain Credentials2
          Process Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSync41
          Virtualization/Sandbox Evasion          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
          Masquerading          		Proc Filesystem1
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt41
          Virtualization/Sandbox Evasion          		/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron712
          Process Injection          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1590626 Sample: New purchase order.exe Startdate: 14/01/2025 Architecture: WINDOWS Score: 100 59 www.nlinecraps.xyz 2->59 61 www.uxemasculine.store 2->61 63 10 other IPs or domains 2->63 77 Found malware configuration 2->77 79 Malicious sample detected (through community Yara rule) 2->79 81 Antivirus detection for URL or domain 2->81 85 13 other signatures 2->85 11 New purchase order.exe 7 2->11         started        15 DjsaCPLWOz.exe 5 2->15         started        signatures3 83 Performs DNS queries to domains with low reputation 59->83 process4 file5 51 C:\Users\user\AppData\...\DjsaCPLWOz.exe, PE32 11->51 dropped 53 C:\Users\...\DjsaCPLWOz.exe:Zone.Identifier, ASCII 11->53 dropped 55 C:\Users\user\AppData\Local\...\tmp96C3.tmp, XML 11->55 dropped 57 C:\Users\user\...57ew purchase order.exe.log, ASCII 11->57 dropped 95 Writes to foreign memory regions 11->95 97 Allocates memory in foreign processes 11->97 99 Adds a directory exclusion to Windows Defender 11->99 101 Injects a PE file into a foreign processes 11->101 17 MSBuild.exe 11->17         started        20 powershell.exe 23 11->20         started        22 powershell.exe 23 11->22         started        24 schtasks.exe 1 11->24         started        103 Multi AV Scanner detection for dropped file 15->103 105 Machine Learning detection for dropped file 15->105 26 MSBuild.exe 15->26         started        28 schtasks.exe 15->28         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 17->65 67 Maps a DLL or memory area into another process 17->67 69 Sample uses process hollowing technique 17->69 75 3 other signatures 17->75 30 explorer.exe 57 1 17->30 injected 71 Loading BitLocker PowerShell Module 20->71 32 WmiPrvSE.exe 20->32         started        34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        73 Found direct / indirect Syscall (likely to bypass EDR) 26->73 40 conhost.exe 28->40         started        process9 process10 42 cscript.exe 30->42         started        45 chkdsk.exe 30->45         started        signatures11 87 Modifies the context of a thread in another process (thread injection) 42->87 89 Maps a DLL or memory area into another process 42->89 91 Tries to detect virtualization through RDTSC time measurements 42->91 93 Switches to a custom stack to bypass stack traces 42->93 47 cmd.exe 42->47         started        process12 process13 49 conhost.exe 47->49         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          New purchase order.exe36%VirustotalBrowse
          New purchase order.exe32%ReversingLabsByteCode-MSIL.Trojan.Generic
          New purchase order.exe100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe100%Joe Sandbox ML
          C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe32%ReversingLabsByteCode-MSIL.Trojan.Generic

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.onitoring-devices-34077.bond/a01d/www.irlypods.shop0%Avira URL Cloudsafe
          http://www.ruaim.online/a01d/0%Avira URL Cloudsafe
          http://www.limbtrip.net0%Avira URL Cloudsafe
          http://www.nline-advertising-58573.bond/a01d/0%Avira URL Cloudsafe
          http://www.hbvc.xyz/a01d/100%Avira URL Cloudphishing
          http://www.ommbank.video/a01d/www.ruaim.online0%Avira URL Cloudsafe
          http://www.ustonehuman.info0%Avira URL Cloudsafe
          http://www.nlinecraps.xyz0%Avira URL Cloudsafe
          http://www.228080a0.buzz/a01d/www.uxemasculine.store0%Avira URL Cloudsafe
          http://www.d8ns7gu.skin/a01d/www.nline-advertising-58573.bond0%Avira URL Cloudsafe
          http://www.228080a0.buzz0%Avira URL Cloudsafe
          http://www.onitoring-devices-34077.bond0%Avira URL Cloudsafe
          http://www.hesweettray.store/a01d/www.228080a0.buzz0%Avira URL Cloudsafe
          http://www.ommbank.videoReferer:0%Avira URL Cloudsafe
          http://www.228080a0.buzzReferer:0%Avira URL Cloudsafe
          http://www.irlypods.shopReferer:0%Avira URL Cloudsafe
          http://www.ustonehuman.infoReferer:0%Avira URL Cloudsafe
          http://www.hbvc.xyzReferer:0%Avira URL Cloudsafe
          http://www.ejigghq.company/a01d/0%Avira URL Cloudsafe
          http://www.chtm.infoReferer:0%Avira URL Cloudsafe
          http://www.hesweettray.storeReferer:0%Avira URL Cloudsafe
          http://www.d8ns7gu.skin/a01d/0%Avira URL Cloudsafe
          http://www.uxemasculine.store0%Avira URL Cloudsafe
          http://www.hesweettray.store/a01d/0%Avira URL Cloudsafe
          http://www.ustonehuman.info/a01d/www.limbtrip.net0%Avira URL Cloudsafe
          http://www.uxemasculine.store/a01d/0%Avira URL Cloudsafe
          http://www.chtm.info/a01d/0%Avira URL Cloudsafe
          http://www.d8ns7gu.skin0%Avira URL Cloudsafe
          www.ustonehuman.info/a01d/0%Avira URL Cloudsafe
          http://www.hesweettray.store0%Avira URL Cloudsafe
          http://www.limbtrip.net/a01d/www.ejigghq.company0%Avira URL Cloudsafe
          http://www.ejigghq.company/a01d/www.d8ns7gu.skin0%Avira URL Cloudsafe
          http://www.uxemasculine.storeReferer:0%Avira URL Cloudsafe
          http://www.ruaim.onlineReferer:0%Avira URL Cloudsafe
          http://www.nlinecraps.xyz/a01d/0%Avira URL Cloudsafe
          http://www.irlypods.shop/a01d/0%Avira URL Cloudsafe
          http://www.ejigghq.company0%Avira URL Cloudsafe
          http://www.nline-advertising-58573.bond0%Avira URL Cloudsafe
          http://www.ejigghq.companyReferer:0%Avira URL Cloudsafe
          http://www.limbtrip.netReferer:0%Avira URL Cloudsafe
          http://www.hbvc.xyz/a01d/www.usinessoverpleasure.shop100%Avira URL Cloudphishing
          http://www.uxemasculine.store/a01d/www.nlinecraps.xyz0%Avira URL Cloudsafe
          http://www.onitoring-devices-34077.bondReferer:0%Avira URL Cloudsafe
          http://www.nline-advertising-58573.bond/a01d/www.hbvc.xyz0%Avira URL Cloudsafe
          http://www.hbvc.xyz100%Avira URL Cloudphishing
          http://www.nline-advertising-58573.bondReferer:0%Avira URL Cloudsafe
          http://www.nlinecraps.xyz/a01d/www.ustonehuman.info0%Avira URL Cloudsafe
          http://www.irlypods.shop/a01d/www.chtm.info0%Avira URL Cloudsafe
          http://www.ommbank.video/a01d/0%Avira URL Cloudsafe
          http://www.ruaim.online/a01d/www.onitoring-devices-34077.bond0%Avira URL Cloudsafe
          http://www.usinessoverpleasure.shopReferer:0%Avira URL Cloudsafe
          http://www.ruaim.online0%Avira URL Cloudsafe
          http://www.limbtrip.net/a01d/0%Avira URL Cloudsafe
          http://www.usinessoverpleasure.shop/a01d/0%Avira URL Cloudsafe
          http://www.usinessoverpleasure.shop0%Avira URL Cloudsafe
          http://www.onitoring-devices-34077.bond/a01d/0%Avira URL Cloudsafe
          http://www.chtm.info0%Avira URL Cloudsafe
          http://www.d8ns7gu.skinReferer:0%Avira URL Cloudsafe
          http://www.chtm.info/a01d/www.hesweettray.store0%Avira URL Cloudsafe
          http://www.ustonehuman.info/a01d/0%Avira URL Cloudsafe
          http://www.irlypods.shop0%Avira URL Cloudsafe
          http://www.ommbank.video0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          bg.microsoft.map.fastly.net
          		199.232.210.172
          		truefalse
            		high
            s-part-0017.t-0009.t-msedge.net
            		13.107.246.45
            		truefalse
              		high
              www.uxemasculine.store
              		unknown
              		unknowntrue
                		unknown
                www.onitoring-devices-34077.bond
                		unknown
                		unknowntrue
                  		unknown
                  www.ustonehuman.info
                  		unknown
                  		unknowntrue
                    		unknown
                    www.228080a0.buzz
                    		unknown
                    		unknowntrue
                      		unknown
                      www.ruaim.online
                      		unknown
                      		unknowntrue
                        		unknown
                        www.nlinecraps.xyz
                        		unknown
                        		unknowntrue
                          		unknown
                          www.ommbank.video
                          		unknown
                          		unknowntrue
                            		unknown
                            www.hesweettray.store
                            		unknown
                            		unknowntrue
                              		unknown
                              www.irlypods.shop
                              		unknown
                              		unknowntrue
                                		unknown
                                www.chtm.info
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.ejigghq.company
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.limbtrip.net
                                    		unknown
                                    		unknowntrue
                                      		unknown

                                      Contacted URLs

                                      NameMaliciousAntivirus DetectionReputation
                                      www.ustonehuman.info/a01d/true
                                      • Avira URL Cloud: safe
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngFexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.228080a0.buzz/a01d/www.uxemasculine.storeexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.ommbank.video/a01d/www.ruaim.onlineexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.onitoring-devices-34077.bond/a01d/www.irlypods.shopexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://tempuri.org/DataSet1.xsdNew purchase order.exe, DjsaCPLWOz.exe.0.drfalse
                                            		high
                                            https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 0000000A.00000002.4564685923.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.nlinecraps.xyzexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://word.office.comMexplorer.exe, 0000000A.00000000.2136477465.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4567724151.000000000C087000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2980918529.000000000C086000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.ruaim.online/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.nline-advertising-58573.bond/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameriexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.d8ns7gu.skin/a01d/www.nline-advertising-58573.bondexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.hbvc.xyz/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: phishing
                                                    		unknown
                                                    http://www.ustonehuman.infoexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://wns.windows.com/eexplorer.exe, 0000000A.00000003.2979316978.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4565119704.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2132453518.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076449895.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameNew purchase order.exe, 00000000.00000002.2133550897.0000000003186000.00000004.00000800.00020000.00000000.sdmp, DjsaCPLWOz.exe, 0000000C.00000002.2164910003.00000000028E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.limbtrip.netexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.228080a0.buzzexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.hesweettray.store/a01d/www.228080a0.buzzexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.onitoring-devices-34077.bondexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.irlypods.shopReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.ustonehuman.infoReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.ommbank.videoReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.ejigghq.company/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.chtm.infoReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&ocexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.hbvc.xyzReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.228080a0.buzzReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.d8ns7gu.skin/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.hesweettray.store/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.hesweettray.storeReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.uxemasculine.storeexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.uxemasculine.store/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://android.notify.windows.com/iOSexplorer.exe, 0000000A.00000000.2136477465.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://outlook.comeexplorer.exe, 0000000A.00000000.2136477465.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4567724151.000000000C087000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2980918529.000000000C086000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.chtm.info/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 0000000A.00000003.2979316978.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2132453518.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3076449895.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.ustonehuman.info/a01d/www.limbtrip.netexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        http://www.d8ns7gu.skinexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.ejigghq.company/a01d/www.d8ns7gu.skinexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          http://www.hesweettray.storeexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.limbtrip.net/a01d/www.ejigghq.companyexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://api.msn.com/Iexplorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.uxemasculine.storeReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.ruaim.onlineReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.nlinecraps.xyz/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.nline-advertising-58573.bondexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.ejigghq.companyexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://schemas.microexplorer.exe, 0000000A.00000002.4563775247.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.2115248877.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.2122412017.0000000007B50000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.irlypods.shop/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.ejigghq.companyReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.hbvc.xyz/a01d/www.usinessoverpleasure.shopexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: phishing
                                                                                		unknown
                                                                                http://www.limbtrip.netReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.nline-advertising-58573.bond/a01d/www.hbvc.xyzexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.uxemasculine.store/a01d/www.nlinecraps.xyzexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.onitoring-devices-34077.bondReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.hbvc.xyzexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: phishing
                                                                                  		unknown
                                                                                  https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-hexplorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-quexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.nline-advertising-58573.bondReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://www.usinessoverpleasure.shopReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://www.irlypods.shop/a01d/www.chtm.infoexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhzexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://excel.office.com-explorer.exe, 0000000A.00000000.2136477465.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4567724151.000000000C087000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.2980918529.000000000C086000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.ruaim.online/a01d/www.onitoring-devices-34077.bondexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 0000000A.00000002.4562814874.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-darkexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AAexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.nlinecraps.xyz/a01d/www.ustonehuman.infoexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-cexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reveexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.ommbank.video/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://www.ruaim.onlineexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://powerpoint.office.comEMdexplorer.exe, 0000000A.00000002.4567536413.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2136477465.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.limbtrip.net/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.usinessoverpleasure.shop/a01d/explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.onitoring-devices-34077.bond/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.usinessoverpleasure.shopexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nationexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.d8ns7gu.skinReferer:explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://www.ommbank.videoexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://www.chtm.infoexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://api.msn.com/explorer.exe, 0000000A.00000002.4564685923.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2128744833.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.irlypods.shopexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          http://www.ustonehuman.info/a01d/explorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-darkexplorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.msn.com:443/en-us/feedexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-explorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.chtm.info/a01d/www.hesweettray.storeexplorer.exe, 0000000A.00000003.2979612580.000000000C4DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4568898596.000000000C474000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.3075027160.000000000C4D6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-eiexplorer.exe, 0000000A.00000003.3076602811.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.4563219020.0000000007415000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.2120424345.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		high

                                                                                                                  World Map of Contacted IPs

                                                                                                                  ⊘No contacted IP infos

                                                                                                                  General Information

                                                                                                                  Joe Sandbox version:42.0.0 Malachite
                                                                                                                  Analysis ID:1590626
                                                                                                                  Start date and time:2025-01-14 11:42:04 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:0h 11m 55s
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:default.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:21
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:1
                                                                                                                  Technologies:
                                                                                                                  • HCA enabled
                                                                                                                  • EGA enabled
                                                                                                                  • AMSI enabled
                                                                                                                  Analysis Mode:default
                                                                                                                  Sample name:New purchase order.exe
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal100.troj.evad.winEXE@418/15@12/0
                                                                                                                  EGA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  HCA Information:
                                                                                                                  • Successful, ratio: 99%
                                                                                                                  • Number of executed functions: 149
                                                                                                                  • Number of non-executed functions: 319
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                  Warnings

                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                  • Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.245.163.56, 2.22.50.144, 2.22.50.131, 2.23.77.188, 13.95.31.18, 199.232.210.172, 20.242.39.171, 52.165.164.15, 13.107.246.45
                                                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.afd.azureedge.net, e3913.cd.akamaiedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, cac-ocsp.digicert.com.edgekey.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                  Simulations

                                                                                                                  Behavior and APIs

                                                                                                                  TimeTypeDescription
                                                                                                                  05:42:52API Interceptor1x Sleep call for process: New purchase order.exe modified
                                                                                                                  05:42:53API Interceptor24x Sleep call for process: powershell.exe modified
                                                                                                                  05:42:56API Interceptor1x Sleep call for process: DjsaCPLWOz.exe modified
                                                                                                                  05:43:00API Interceptor10108024x Sleep call for process: explorer.exe modified
                                                                                                                  05:43:38API Interceptor8824501x Sleep call for process: cscript.exe modified
                                                                                                                  11:42:54Task SchedulerRun new task: DjsaCPLWOz path: C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe

                                                                                                                  Joe Sandbox View / Context

                                                                                                                  IPs

                                                                                                                  ⊘No context

                                                                                                                  Domains

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  s-part-0017.t-0009.t-msedge.netProductBOMpq_v4.xlsmGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  ProductBOMpq_v4.xlsmGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  RFQ____PC25-1301.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  Signature Required_ Retail Technology Asia Employee Benefit for eddie.chan@rtasia.com.hk.emlGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  RFQ____PC25-1301.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  https://Rtasia-sharepoint.zonivarnoth.ru/ITb4aThU/#Deddie.chan@rtasia.com.hkGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  RFQ____PC25-1301.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  RFQ____PC25-1301.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  yTRd6nkLWV.exeGet hashmaliciousLummaCBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  009.vbeGet hashmaliciousAgentTeslaBrowse
                                                                                                                  • 13.107.246.45
                                                                                                                  bg.microsoft.map.fastly.net35491083472324549.jsGet hashmaliciousStrela DownloaderBrowse
                                                                                                                  • 199.232.214.172
                                                                                                                  28236151432955330765.jsGet hashmaliciousStrela DownloaderBrowse
                                                                                                                  • 199.232.210.172
                                                                                                                  ProductBOMpq_v4.xlsmGet hashmaliciousUnknownBrowse
                                                                                                                  • 199.232.214.172
                                                                                                                  17201670993971103.jsGet hashmaliciousStrela DownloaderBrowse
                                                                                                                  • 199.232.214.172
                                                                                                                  Scanned-IMGS_from NomanGroup IDT.scr.exeGet hashmaliciousFormBookBrowse
                                                                                                                  • 199.232.210.172
                                                                                                                  12.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 199.232.214.172
                                                                                                                  UoEDaAjHGW.exeGet hashmaliciousPureLog Stealer, QuasarBrowse
                                                                                                                  • 199.232.210.172
                                                                                                                  PRODUKTY.EXE.exeGet hashmaliciousAsyncRAT, PureLog StealerBrowse
                                                                                                                  • 199.232.210.172
                                                                                                                  2330118683179179335.jsGet hashmaliciousStrela DownloaderBrowse
                                                                                                                  • 199.232.210.172
                                                                                                                  G7T8lHJWWM.exeGet hashmaliciousLummaCBrowse
                                                                                                                  • 199.232.210.172

                                                                                                                  ASNs

                                                                                                                  ⊘No context

                                                                                                                  JA3 Fingerprints

                                                                                                                  ⊘No context

                                                                                                                  Dropped Files

                                                                                                                  ⊘No context

                                                                                                                  Created / dropped Files

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DjsaCPLWOz.exe.log

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe
                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1216
                                                                                                                  Entropy (8bit):5.34331486778365
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                  MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                  SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                  SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                  SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                  Malicious:false
                                                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New purchase order.exe.log

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\New purchase order.exe
                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1216
                                                                                                                  Entropy (8bit):5.34331486778365
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                  MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                  SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                  SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                  SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                  Malicious:true
                                                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2232
                                                                                                                  Entropy (8bit):5.379401388151058
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:fLHxvIIwLgZ2KRHWLOug8s
                                                                                                                  MD5:AF15464AFD6EB7D301162A1DC8E01662
                                                                                                                  SHA1:A974B8FEC71BF837B8E72FE43AB43E447FC43A86
                                                                                                                  SHA-256:103A67F6744C098E5121D2D732753DFA4B54FA0EFD918FEC3941A3C052F5E211
                                                                                                                  SHA-512:7B5B7B7F6EAE4544BAF61F9C02BF0138950E5D7D1B0457DE2FAB2C4C484220BDD1AB42D6884838E798AD46CE1B5B5426CEB825A1690B1190857D3B643ABFAB37
                                                                                                                  Malicious:false
                                                                                                                  Preview:@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_104cqqod.bbb.psm1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f25ezsac.a1h.ps1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqjglvcv.s2y.ps1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kgzddzji.e0v.psm1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbvinzpe.yvb.ps1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rinueunc.stt.psm1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_um0iwhe5.ydb.ps1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yyv3cszo.ldy.psm1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp96C3.tmp

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\New purchase order.exe
                                                                                                                  File Type:XML 1.0 document, ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1597
                                                                                                                  Entropy (8bit):5.100903750522086
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL8Gxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTYKv
                                                                                                                  MD5:21C5DEA2FB4CD6A119DC1DA0435ACC08
                                                                                                                  SHA1:AEA5CDB31EC21B0C6A77A94B438ACAAE5B617C38
                                                                                                                  SHA-256:1CE30FEB191262A687C3134EEDFB5354A56CF3108090DEBE6555C1A435A2F27A
                                                                                                                  SHA-512:5E8E48847D37965FD6B70E6DCEC10CE9A98F21EEEEE120F4AA40004CF736566BC7B1EE1C007F388D95B4CD192BE70D06955C39144296FE5E9A56F903EF66F6AF
                                                                                                                  Malicious:true
                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpA46F.tmp

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe
                                                                                                                  File Type:XML 1.0 document, ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1597
                                                                                                                  Entropy (8bit):5.100903750522086
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL8Gxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTYKv
                                                                                                                  MD5:21C5DEA2FB4CD6A119DC1DA0435ACC08
                                                                                                                  SHA1:AEA5CDB31EC21B0C6A77A94B438ACAAE5B617C38
                                                                                                                  SHA-256:1CE30FEB191262A687C3134EEDFB5354A56CF3108090DEBE6555C1A435A2F27A
                                                                                                                  SHA-512:5E8E48847D37965FD6B70E6DCEC10CE9A98F21EEEEE120F4AA40004CF736566BC7B1EE1C007F388D95B4CD192BE70D06955C39144296FE5E9A56F903EF66F6AF
                                                                                                                  Malicious:false
                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

                                                                                                                  C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\New purchase order.exe
                                                                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):665600
                                                                                                                  Entropy (8bit):7.697006384978434
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:kYRxA4Y5lyA/BxSPC3NMl2v/wXb5DDH6dcW6f8HtdJqT6B2zJxWVqHU:bRB2XM5UN60STUAJE
                                                                                                                  MD5:1B507DF9A13477B647DA450A1B79B2E7
                                                                                                                  SHA1:B0DE85855B3462FE0B37C79831B391EEB044E437
                                                                                                                  SHA-256:A3AF3DCFD89B655982B6E044B681B140DCEFBE0606D69B0B7839B8CDA28CCC91
                                                                                                                  SHA-512:37DCC8DD92A84009F81EBF394001DE49BCF75818227BDBE135578F8F1DC57F4119C4CB6EFD91EC70FE12202854CA472EC7435D3C0F713BF770F09967D61FE6A7
                                                                                                                  Malicious:true
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                  • Antivirus: ReversingLabs, Detection: 32%
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c................0..............=... ...@....@.. ....................................@.................................4=..O....@.......................`......d%..p............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................h=......H.......hK..\=......9...................................................0..L.........}.....(.......(......(............s......(.....o......( ....o!.....("....*.0..K.........}........(#........($.....,5...(............s......(.....o......(.....o!....8.....r...p.J...(%...o&...tJ.......('..........9.....s.........s(...s)...o*.......o+...(,.......o-...(........o/...(0.......o1...(2.......o3...(4.......o5...(6.........(7.....(......+....s(...s)...(*........(8...........s......(..

                                                                                                                  C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe:Zone.Identifier

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\New purchase order.exe
                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):26
                                                                                                                  Entropy (8bit):3.95006375643621
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:ggPYV:rPYV
                                                                                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                  Malicious:true
                                                                                                                  Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                  Static File Info

                                                                                                                  General

                                                                                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                  Entropy (8bit):7.697006384978434
                                                                                                                  TrID:
                                                                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                  • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                  • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                  • DOS Executable Generic (2002/1) 0.01%
                                                                                                                  File name:New purchase order.exe
                                                                                                                  File size:665'600 bytes
                                                                                                                  MD5:1b507df9a13477b647da450a1b79b2e7
                                                                                                                  SHA1:b0de85855b3462fe0b37c79831b391eeb044e437
                                                                                                                  SHA256:a3af3dcfd89b655982b6e044b681b140dcefbe0606d69b0b7839b8cda28ccc91
                                                                                                                  SHA512:37dcc8dd92a84009f81ebf394001de49bcf75818227bdbe135578f8f1dc57f4119c4cb6efd91ec70fe12202854ca472ec7435d3c0f713bf770f09967d61fe6a7
                                                                                                                  SSDEEP:12288:kYRxA4Y5lyA/BxSPC3NMl2v/wXb5DDH6dcW6f8HtdJqT6B2zJxWVqHU:bRB2XM5UN60STUAJE
                                                                                                                  TLSH:F5E40255261AD803C4921B700872D3F946799D99AA12C317CFEE3FFFBD367562A403A2
                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c................0..............=... ...@....@.. ....................................@................................

                                                                                                                  File Icon

                                                                                                                  Icon Hash:00928e8e8686b000

                                                                                                                  Static PE Info

                                                                                                                  General

                                                                                                                  Entrypoint:0x4a3d86
                                                                                                                  Entrypoint Section:.text
                                                                                                                  Digitally signed:false
                                                                                                                  Imagebase:0x400000
                                                                                                                  Subsystem:windows gui
                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                  Time Stamp:0xED1B63D8 [Sat Jan 21 14:40:24 2096 UTC]
                                                                                                                  TLS Callbacks:
                                                                                                                  CLR (.Net) Version:
                                                                                                                  OS Version Major:4
                                                                                                                  OS Version Minor:0
                                                                                                                  File Version Major:4
                                                                                                                  File Version Minor:0
                                                                                                                  Subsystem Version Major:4
                                                                                                                  Subsystem Version Minor:0
                                                                                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                  Entrypoint Preview

                                                                                                                  Instruction
                                                                                                                  jmp dword ptr [00402000h]
                                                                                                                  call far 0000h : 003E9999h
                                                                                                                  aas
                                                                                                                  int CCh
                                                                                                                  dec esp
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al
                                                                                                                  add byte ptr [eax], al

                                                                                                                  Data Directories

                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xa3d340x4f.text
                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xa40000x5e0.rsrc
                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xa60000xc.reloc
                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0xa25640x70.text
                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                  Sections

                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                  .text0x20000xa1d9c0xa1e005484a60a53c776b7d4076ac395786451False0.9101064792471042data7.70487272734604IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                  .rsrc0xa40000x5e00x600295d103648ee9093fb72ebaf35e5cf96False0.4309895833333333data4.157689678764174IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                  .reloc0xa60000xc0x20039190973817c2af081a26ee474bdc851False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                  Resources

                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                  RT_VERSION0xa40900x350data0.4257075471698113
                                                                                                                  RT_MANIFEST0xa43f00x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                                  Imports

                                                                                                                  DLLImport
                                                                                                                  mscoree.dll_CorExeMain

                                                                                                                  Network Behavior

                                                                                                                  Network Port Distribution

                                                                                                                  TCP Packets

                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                  Jan 14, 2025 11:42:48.686280012 CET49673443192.168.2.6173.222.162.64
                                                                                                                  Jan 14, 2025 11:42:48.686408043 CET49674443192.168.2.6173.222.162.64
                                                                                                                  Jan 14, 2025 11:42:49.014467001 CET49672443192.168.2.6173.222.162.64
                                                                                                                  Jan 14, 2025 11:42:58.295586109 CET49674443192.168.2.6173.222.162.64
                                                                                                                  Jan 14, 2025 11:42:58.295587063 CET49673443192.168.2.6173.222.162.64
                                                                                                                  Jan 14, 2025 11:42:58.679641962 CET49672443192.168.2.6173.222.162.64
                                                                                                                  Jan 14, 2025 11:43:00.252603054 CET44349698173.222.162.64192.168.2.6
                                                                                                                  Jan 14, 2025 11:43:00.252738953 CET49698443192.168.2.6173.222.162.64

                                                                                                                  UDP Packets

                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                  Jan 14, 2025 11:43:30.687491894 CET5798953192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:43:30.702136993 CET53579891.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:43:52.468172073 CET5518753192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:43:52.479485035 CET53551871.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:44:11.686760902 CET5611153192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:44:11.702593088 CET53561111.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:44:31.733732939 CET6204053192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:44:31.742515087 CET53620401.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:44:52.124460936 CET5480253192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:44:52.133249998 CET53548021.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:45:12.537143946 CET5053953192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:45:12.550299883 CET53505391.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:45:32.976911068 CET5891953192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:45:32.986035109 CET53589191.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:45:53.577265024 CET5396153192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:45:53.586429119 CET53539611.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:46:13.921433926 CET6314153192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:46:14.072789907 CET53631411.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:46:34.296287060 CET5292453192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:46:34.305629969 CET53529241.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:46:54.656585932 CET6440953192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:46:54.666099072 CET53644091.1.1.1192.168.2.6
                                                                                                                  Jan 14, 2025 11:47:15.499228954 CET5794153192.168.2.61.1.1.1
                                                                                                                  Jan 14, 2025 11:47:15.514313936 CET53579411.1.1.1192.168.2.6

                                                                                                                  DNS Queries

                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                  Jan 14, 2025 11:43:30.687491894 CET192.168.2.61.1.1.10x6c0dStandard query (0)www.ommbank.videoA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:43:52.468172073 CET192.168.2.61.1.1.10x7b68Standard query (0)www.ruaim.onlineA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:44:11.686760902 CET192.168.2.61.1.1.10x45a3Standard query (0)www.onitoring-devices-34077.bondA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:44:31.733732939 CET192.168.2.61.1.1.10x105dStandard query (0)www.irlypods.shopA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:44:52.124460936 CET192.168.2.61.1.1.10x781bStandard query (0)www.chtm.infoA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:45:12.537143946 CET192.168.2.61.1.1.10xcc0cStandard query (0)www.hesweettray.storeA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:45:32.976911068 CET192.168.2.61.1.1.10xb8d0Standard query (0)www.228080a0.buzzA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:45:53.577265024 CET192.168.2.61.1.1.10x22aStandard query (0)www.uxemasculine.storeA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:46:13.921433926 CET192.168.2.61.1.1.10xb9deStandard query (0)www.nlinecraps.xyzA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:46:34.296287060 CET192.168.2.61.1.1.10xe0e1Standard query (0)www.ustonehuman.infoA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:46:54.656585932 CET192.168.2.61.1.1.10xc1cfStandard query (0)www.limbtrip.netA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:47:15.499228954 CET192.168.2.61.1.1.10x65a8Standard query (0)www.ejigghq.companyA (IP address)IN (0x0001)false

                                                                                                                  DNS Answers

                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                  Jan 14, 2025 11:43:02.025127888 CET1.1.1.1192.168.2.60xed1No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:43:02.025127888 CET1.1.1.1192.168.2.60xed1No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:43:11.985702991 CET1.1.1.1192.168.2.60x595eNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:43:11.985702991 CET1.1.1.1192.168.2.60x595eNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:43:30.702136993 CET1.1.1.1192.168.2.60x6c0dName error (3)www.ommbank.videononenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:43:52.479485035 CET1.1.1.1192.168.2.60x7b68Name error (3)www.ruaim.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:44:11.702593088 CET1.1.1.1192.168.2.60x45a3Name error (3)www.onitoring-devices-34077.bondnonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:44:31.742515087 CET1.1.1.1192.168.2.60x105dName error (3)www.irlypods.shopnonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:44:52.133249998 CET1.1.1.1192.168.2.60x781bName error (3)www.chtm.infononenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:45:12.550299883 CET1.1.1.1192.168.2.60xcc0cName error (3)www.hesweettray.storenonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:45:32.986035109 CET1.1.1.1192.168.2.60xb8d0Name error (3)www.228080a0.buzznonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:45:53.586429119 CET1.1.1.1192.168.2.60x22aName error (3)www.uxemasculine.storenonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:46:14.072789907 CET1.1.1.1192.168.2.60xb9deName error (3)www.nlinecraps.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:46:34.305629969 CET1.1.1.1192.168.2.60xe0e1Name error (3)www.ustonehuman.infononenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:46:54.666099072 CET1.1.1.1192.168.2.60xc1cfName error (3)www.limbtrip.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                  Jan 14, 2025 11:47:15.514313936 CET1.1.1.1192.168.2.60x65a8Name error (3)www.ejigghq.companynonenoneA (IP address)IN (0x0001)false

                                                                                                                  Statistics

                                                                                                                  CPU Usage

                                                                                                                  Click to jump to process

                                                                                                                  Memory Usage

                                                                                                                  Click to jump to process

                                                                                                                  High Level Behavior Distribution

                                                                                                                  Click to dive into process behavior distribution

                                                                                                                  Behavior

                                                                                                                  Click to jump to process

                                                                                                                  System Behavior

                                                                                                                  General

                                                                                                                  Target ID:0
                                                                                                                  Start time:05:42:51
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Users\user\Desktop\New purchase order.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Users\user\Desktop\New purchase order.exe"
                                                                                                                  Imagebase:0xda0000
                                                                                                                  File size:665'600 bytes
                                                                                                                  MD5 hash:1B507DF9A13477B647DA450A1B79B2E7
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2134617071.0000000004179000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2136893760.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2133550897.0000000003284000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.2134617071.00000000043B3000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.2134617071.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Reputation:low
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:3
                                                                                                                  Start time:05:42:52
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New purchase order.exe"
                                                                                                                  Imagebase:0x790000
                                                                                                                  File size:433'152 bytes
                                                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:4
                                                                                                                  Start time:05:42:52
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:5
                                                                                                                  Start time:05:42:52
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe"
                                                                                                                  Imagebase:0x790000
                                                                                                                  File size:433'152 bytes
                                                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:6
                                                                                                                  Start time:05:42:52
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:7
                                                                                                                  Start time:05:42:53
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmp96C3.tmp"
                                                                                                                  Imagebase:0xa10000
                                                                                                                  File size:187'904 bytes
                                                                                                                  MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:8
                                                                                                                  Start time:05:42:53
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:9
                                                                                                                  Start time:05:42:53
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                  Imagebase:0xb80000
                                                                                                                  File size:262'432 bytes
                                                                                                                  MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:10
                                                                                                                  Start time:05:42:53
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\explorer.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\Explorer.EXE
                                                                                                                  Imagebase:0x7ff609140000
                                                                                                                  File size:5'141'208 bytes
                                                                                                                  MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 0000000A.00000002.4569837606.0000000010DCB000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  Reputation:high
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:11
                                                                                                                  Start time:05:42:54
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  Imagebase:0x7ff717f30000
                                                                                                                  File size:496'640 bytes
                                                                                                                  MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:12
                                                                                                                  Start time:05:42:54
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:C:\Users\user\AppData\Roaming\DjsaCPLWOz.exe
                                                                                                                  Imagebase:0x3c0000
                                                                                                                  File size:665'600 bytes
                                                                                                                  MD5 hash:1B507DF9A13477B647DA450A1B79B2E7
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.2206993982.0000000003B14000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Antivirus matches:
                                                                                                                  • Detection: 100%, Joe Sandbox ML
                                                                                                                  • Detection: 32%, ReversingLabs
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:13
                                                                                                                  Start time:05:42:56
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DjsaCPLWOz" /XML "C:\Users\user\AppData\Local\Temp\tmpA46F.tmp"
                                                                                                                  Imagebase:0xa10000
                                                                                                                  File size:187'904 bytes
                                                                                                                  MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:14
                                                                                                                  Start time:05:42:56
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:15
                                                                                                                  Start time:05:42:57
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                  Imagebase:0xc90000
                                                                                                                  File size:262'432 bytes
                                                                                                                  MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:16
                                                                                                                  Start time:05:42:57
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\cscript.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\SysWOW64\cscript.exe"
                                                                                                                  Imagebase:0x490000
                                                                                                                  File size:144'896 bytes
                                                                                                                  MD5 hash:CB601B41D4C8074BE8A84AED564A94DC
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.4559329863.0000000003150000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.4559442787.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:17
                                                                                                                  Start time:05:42:58
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                  Imagebase:0xc50000
                                                                                                                  File size:23'040 bytes
                                                                                                                  MD5 hash:B4016BEE9D8F3AD3D02DD21C3CAFB922
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.2189898844.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:18
                                                                                                                  Start time:05:43:01
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                  Imagebase:0x1c0000
                                                                                                                  File size:236'544 bytes
                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:19
                                                                                                                  Start time:05:43:01
                                                                                                                  Start date:14/01/2025
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  Disassembly

                                                                                                                  Reset < >

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:10.5%
                                                                                                                    Dynamic/Decrypted Code Coverage:99.1%
                                                                                                                    Signature Coverage:2.2%
                                                                                                                    Total number of Nodes:318
                                                                                                                    Total number of Limit Nodes:19
                                                                                                                    execution_graph 44711 57b20b8 44712 57b20cb 44711->44712 44713 57b20ee 44712->44713 44715 57b0e84 44712->44715 44716 57b0e89 44715->44716 44717 57b232b 44716->44717 44719 57b0e94 44716->44719 44717->44713 44720 57b0e9f 44719->44720 44724 57b96c1 44720->44724 44728 57b96d0 44720->44728 44721 57b96b7 44721->44717 44725 57b96d9 44724->44725 44732 57b9708 44725->44732 44726 57b96fe 44726->44721 44729 57b96d9 44728->44729 44731 57b9708 DrawTextExW 44729->44731 44730 57b96fe 44730->44721 44731->44730 44733 57b9742 44732->44733 44734 57b9753 44732->44734 44733->44726 44735 57b97e1 44734->44735 44738 57b9a31 44734->44738 44743 57b9a40 44734->44743 44735->44726 44739 57b9a68 44738->44739 44740 57b9b6e 44739->44740 44748 57ba2d0 44739->44748 44753 57ba2c0 44739->44753 44740->44733 44744 57b9a68 44743->44744 44745 57b9b6e 44744->44745 44746 57ba2d0 DrawTextExW 44744->44746 44747 57ba2c0 DrawTextExW 44744->44747 44745->44733 44746->44745 44747->44745 44749 57ba2e6 44748->44749 44758 57ba738 44749->44758 44762 57ba729 44749->44762 44750 57ba35c 44750->44740 44754 57ba2e6 44753->44754 44756 57ba729 DrawTextExW 44754->44756 44757 57ba738 DrawTextExW 44754->44757 44755 57ba35c 44755->44740 44756->44755 44757->44755 44766 57ba778 44758->44766 44771 57ba768 44758->44771 44759 57ba756 44759->44750 44763 57ba756 44762->44763 44764 57ba778 DrawTextExW 44762->44764 44765 57ba768 DrawTextExW 44762->44765 44763->44750 44764->44763 44765->44763 44767 57ba77d 44766->44767 44768 57ba7d6 44767->44768 44776 57ba7e9 44767->44776 44781 57ba7f8 44767->44781 44768->44759 44772 57ba778 44771->44772 44773 57ba7d6 44772->44773 44774 57ba7e9 DrawTextExW 44772->44774 44775 57ba7f8 DrawTextExW 44772->44775 44773->44759 44774->44773 44775->44773 44778 57ba819 44776->44778 44777 57ba82e 44777->44768 44778->44777 44786 57b9080 44778->44786 44780 57ba899 44783 57ba819 44781->44783 44782 57ba82e 44782->44768 44783->44782 44784 57b9080 DrawTextExW 44783->44784 44785 57ba899 44784->44785 44787 57b908b 44786->44787 44788 57bc869 44787->44788 44790 57bd3d1 DrawTextExW 44787->44790 44791 57bd3e0 DrawTextExW 44787->44791 44788->44780 44789 57bc97c 44789->44780 44790->44789 44791->44789 45097 57b3088 45099 57b30bf 45097->45099 45098 57b3218 45099->45098 45102 57b5981 45099->45102 45106 57b5990 45099->45106 45103 57b598a 45102->45103 45104 57b0e84 DrawTextExW 45103->45104 45105 57b59dc 45104->45105 45105->45098 45107 57b59a0 45106->45107 45108 57b0e84 DrawTextExW 45107->45108 45109 57b59dc 45108->45109 45109->45098 45001 7cf46d8 45002 7cf4863 45001->45002 45003 7cf46fe 45001->45003 45003->45002 45005 7cf0154 45003->45005 45006 7cf4958 PostMessageW 45005->45006 45007 7cf49c4 45006->45007 45007->45003 45110 7cf4678 45112 7cf467d 45110->45112 45111 7cf46a2 45112->45111 45113 7cf0154 PostMessageW 45112->45113 45113->45112 44792 170d378 44793 170d3be 44792->44793 44797 170d547 44793->44797 44800 170d558 44793->44800 44794 170d4ab 44798 170d586 44797->44798 44803 170b3b0 44797->44803 44798->44794 44801 170b3b0 DuplicateHandle 44800->44801 44802 170d586 44801->44802 44802->44794 44804 170d9c8 DuplicateHandle 44803->44804 44805 170da5e 44804->44805 44805->44798 45008 1704668 45009 170467a 45008->45009 45010 1704686 45009->45010 45014 1704778 45009->45014 45019 1704204 45010->45019 45012 17046a5 45015 170479d 45014->45015 45023 1704878 45015->45023 45027 1704888 45015->45027 45020 170420f 45019->45020 45035 1705cc4 45020->45035 45022 1707083 45022->45012 45025 17048af 45023->45025 45024 170498c 45025->45024 45031 17044f0 45025->45031 45029 17048af 45027->45029 45028 170498c 45028->45028 45029->45028 45030 17044f0 CreateActCtxA 45029->45030 45030->45028 45032 1705918 CreateActCtxA 45031->45032 45034 17059db 45032->45034 45036 1705ccf 45035->45036 45039 1705ce4 45036->45039 45038 1707315 45038->45022 45040 1705cef 45039->45040 45043 1705d14 45040->45043 45042 17073fa 45042->45038 45044 1705d1f 45043->45044 45047 1705d44 45044->45047 45046 17074ed 45046->45042 45048 1705d4f 45047->45048 45050 17087eb 45048->45050 45054 170ae99 45048->45054 45049 1708829 45049->45046 45050->45049 45058 170cf90 45050->45058 45063 170cf80 45050->45063 45069 170aed0 45054->45069 45072 170aec1 45054->45072 45055 170aeae 45055->45050 45059 170cfb1 45058->45059 45060 170cfd5 45059->45060 45081 170d260 45059->45081 45085 170d250 45059->45085 45060->45049 45064 170cf35 45063->45064 45065 170cf86 45063->45065 45064->45049 45066 170cfd5 45065->45066 45067 170d260 GetModuleHandleW 45065->45067 45068 170d250 GetModuleHandleW 45065->45068 45066->45049 45067->45066 45068->45066 45076 170b3c1 45069->45076 45070 170aedf 45070->45055 45073 170aed0 45072->45073 45075 170b3c1 GetModuleHandleW 45073->45075 45074 170aedf 45074->45055 45075->45074 45077 170b404 45076->45077 45078 170b3e1 45076->45078 45077->45070 45078->45077 45079 170b608 GetModuleHandleW 45078->45079 45080 170b635 45079->45080 45080->45070 45082 170d26d 45081->45082 45083 170d2a7 45082->45083 45089 170b2e8 45082->45089 45083->45060 45086 170d26d 45085->45086 45087 170b2e8 GetModuleHandleW 45086->45087 45088 170d2a7 45086->45088 45087->45088 45088->45060 45090 170b2f3 45089->45090 45092 170dfc0 45090->45092 45093 170d60c 45090->45093 45092->45092 45094 170d617 45093->45094 45095 1705d44 GetModuleHandleW 45094->45095 45096 170e02f 45095->45096 45096->45092 44806 7cf0a85 44811 7cf34fe 44806->44811 44829 7cf3498 44806->44829 44846 7cf3488 44806->44846 44807 7cf0a94 44812 7cf348c 44811->44812 44814 7cf3501 44811->44814 44813 7cf34ba 44812->44813 44863 7cf3e2f 44812->44863 44868 7cf3cf0 44812->44868 44877 7cf3a90 44812->44877 44882 7cf39b2 44812->44882 44887 7cf42f4 44812->44887 44891 7cf39d6 44812->44891 44900 7cf3aba 44812->44900 44911 7cf3a7d 44812->44911 44920 7cf3963 44812->44920 44924 7cf3e43 44812->44924 44929 7cf4207 44812->44929 44934 7cf3cc9 44812->44934 44944 7cf3e8c 44812->44944 44948 7cf3d4f 44812->44948 44813->44807 44814->44807 44830 7cf34b2 44829->44830 44831 7cf34ba 44830->44831 44832 7cf3e2f 2 API calls 44830->44832 44833 7cf3d4f 2 API calls 44830->44833 44834 7cf3e8c 2 API calls 44830->44834 44835 7cf3cc9 2 API calls 44830->44835 44836 7cf4207 2 API calls 44830->44836 44837 7cf3e43 2 API calls 44830->44837 44838 7cf3963 2 API calls 44830->44838 44839 7cf3a7d 4 API calls 44830->44839 44840 7cf3aba 6 API calls 44830->44840 44841 7cf39d6 2 API calls 44830->44841 44842 7cf42f4 2 API calls 44830->44842 44843 7cf39b2 2 API calls 44830->44843 44844 7cf3a90 2 API calls 44830->44844 44845 7cf3cf0 4 API calls 44830->44845 44831->44807 44832->44831 44833->44831 44834->44831 44835->44831 44836->44831 44837->44831 44838->44831 44839->44831 44840->44831 44841->44831 44842->44831 44843->44831 44844->44831 44845->44831 44847 7cf34b2 44846->44847 44848 7cf34ba 44847->44848 44849 7cf3e2f 2 API calls 44847->44849 44850 7cf3d4f 2 API calls 44847->44850 44851 7cf3e8c 2 API calls 44847->44851 44852 7cf3cc9 2 API calls 44847->44852 44853 7cf4207 2 API calls 44847->44853 44854 7cf3e43 2 API calls 44847->44854 44855 7cf3963 2 API calls 44847->44855 44856 7cf3a7d 4 API calls 44847->44856 44857 7cf3aba 6 API calls 44847->44857 44858 7cf39d6 2 API calls 44847->44858 44859 7cf42f4 2 API calls 44847->44859 44860 7cf39b2 2 API calls 44847->44860 44861 7cf3a90 2 API calls 44847->44861 44862 7cf3cf0 4 API calls 44847->44862 44848->44807 44849->44848 44850->44848 44851->44848 44852->44848 44853->44848 44854->44848 44855->44848 44856->44848 44857->44848 44858->44848 44859->44848 44860->44848 44861->44848 44862->44848 44864 7cf4101 44863->44864 44953 5d7f9e0 44864->44953 44957 5d7f9e8 44864->44957 44865 7cf411f 44869 7cf3d10 44868->44869 44961 5d7f420 44869->44961 44965 5d7f428 44869->44965 44870 7cf3f00 44870->44813 44871 7cf40e2 44872 7cf39be 44872->44870 44969 5d7faa2 44872->44969 44973 5d7faa8 44872->44973 44878 7cf3ab3 44877->44878 44880 5d7faa2 WriteProcessMemory 44878->44880 44881 5d7faa8 WriteProcessMemory 44878->44881 44879 7cf3c0b 44879->44813 44880->44879 44881->44879 44884 7cf39be 44882->44884 44883 7cf40e2 44885 5d7faa2 WriteProcessMemory 44884->44885 44886 5d7faa8 WriteProcessMemory 44884->44886 44885->44883 44886->44883 44977 5d7fb92 44887->44977 44981 5d7fb98 44887->44981 44888 7cf4316 44892 7cf39dc 44891->44892 44896 5d7faa2 WriteProcessMemory 44892->44896 44897 5d7faa8 WriteProcessMemory 44892->44897 44893 7cf42ee 44894 7cf39be 44894->44893 44898 5d7faa2 WriteProcessMemory 44894->44898 44899 5d7faa8 WriteProcessMemory 44894->44899 44895 7cf40e2 44896->44894 44897->44894 44898->44895 44899->44895 44985 5d7f4d1 44900->44985 44989 5d7f4d8 44900->44989 44901 7cf3ad4 44904 7cf39be 44901->44904 44905 5d7f420 ResumeThread 44901->44905 44906 5d7f428 ResumeThread 44901->44906 44902 7cf3f00 44902->44813 44903 7cf40e2 44904->44902 44907 5d7faa2 WriteProcessMemory 44904->44907 44908 5d7faa8 WriteProcessMemory 44904->44908 44905->44904 44906->44904 44907->44903 44908->44903 44912 7cf3a8a 44911->44912 44918 5d7f420 ResumeThread 44912->44918 44919 5d7f428 ResumeThread 44912->44919 44913 7cf3f00 44913->44813 44914 7cf40e2 44915 7cf39be 44915->44913 44916 5d7faa2 WriteProcessMemory 44915->44916 44917 5d7faa8 WriteProcessMemory 44915->44917 44916->44914 44917->44914 44918->44915 44919->44915 44993 7cf04f4 44920->44993 44997 7cf0500 44920->44997 44925 7cf3e2f 44924->44925 44927 5d7f9e0 VirtualAllocEx 44925->44927 44928 5d7f9e8 VirtualAllocEx 44925->44928 44926 7cf411f 44927->44926 44928->44926 44930 7cf39be 44929->44930 44930->44929 44932 5d7faa2 WriteProcessMemory 44930->44932 44933 5d7faa8 WriteProcessMemory 44930->44933 44931 7cf40e2 44932->44931 44933->44931 44935 7cf39ed 44934->44935 44936 7cf4024 44935->44936 44940 5d7faa2 WriteProcessMemory 44935->44940 44941 5d7faa8 WriteProcessMemory 44935->44941 44936->44813 44937 7cf42ee 44938 7cf39be 44938->44937 44942 5d7faa2 WriteProcessMemory 44938->44942 44943 5d7faa8 WriteProcessMemory 44938->44943 44939 7cf40e2 44940->44938 44941->44938 44942->44939 44943->44939 44946 5d7f4d1 Wow64SetThreadContext 44944->44946 44947 5d7f4d8 Wow64SetThreadContext 44944->44947 44945 7cf3ea6 44946->44945 44947->44945 44949 7cf39be 44948->44949 44951 5d7faa2 WriteProcessMemory 44949->44951 44952 5d7faa8 WriteProcessMemory 44949->44952 44950 7cf40e2 44951->44950 44952->44950 44954 5d7fa28 VirtualAllocEx 44953->44954 44956 5d7fa65 44954->44956 44956->44865 44958 5d7fa28 VirtualAllocEx 44957->44958 44960 5d7fa65 44958->44960 44960->44865 44962 5d7f428 ResumeThread 44961->44962 44964 5d7f499 44962->44964 44964->44872 44966 5d7f468 ResumeThread 44965->44966 44968 5d7f499 44966->44968 44968->44872 44970 5d7faa8 WriteProcessMemory 44969->44970 44972 5d7fb47 44970->44972 44972->44871 44974 5d7faf0 WriteProcessMemory 44973->44974 44976 5d7fb47 44974->44976 44976->44871 44978 5d7fb98 ReadProcessMemory 44977->44978 44980 5d7fc27 44978->44980 44980->44888 44982 5d7fbe3 ReadProcessMemory 44981->44982 44984 5d7fc27 44982->44984 44984->44888 44986 5d7f4d8 Wow64SetThreadContext 44985->44986 44988 5d7f565 44986->44988 44988->44901 44990 5d7f51d Wow64SetThreadContext 44989->44990 44992 5d7f565 44990->44992 44992->44901 44994 7cf0589 CreateProcessA 44993->44994 44996 7cf074b 44994->44996 44996->44996 44998 7cf0589 CreateProcessA 44997->44998 45000 7cf074b 44998->45000 45000->45000

                                                                                                                    Executed Functions

                                                                                                                    Function 07CF4668 Relevance: .2, Instructions: 199COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e7a343743799d4f50a5d5b532059c1d88e67ad516ec2283a12b2897afb233a5b
                                                                                                                    • Instruction ID: f38bb63c62bb245dee26174030fae919e16c29a84101941c22e2930e85297260
                                                                                                                    • Opcode Fuzzy Hash: e7a343743799d4f50a5d5b532059c1d88e67ad516ec2283a12b2897afb233a5b
                                                                                                                    • Instruction Fuzzy Hash: 8A71F8F19016958FDB18DF69D880AAEBBF6EF86300F558069D104E72A1DB70AF45CB50
                                                                                                                    Function 01704204 Relevance: .2, Instructions: 176COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 19a304b439a6c7f042ce872027102535f0a00d132db6045e99aaf59a23b28d5a
                                                                                                                    • Instruction ID: f7029669205564d218eef3238ee9417efc73a66e887d052c27ef022a4282fffe
                                                                                                                    • Opcode Fuzzy Hash: 19a304b439a6c7f042ce872027102535f0a00d132db6045e99aaf59a23b28d5a
                                                                                                                    • Instruction Fuzzy Hash: E7818074E00209DFDB55DFAAD984A9DBBF2FF88300F20912AE519A7365DB346945CF40
                                                                                                                    Function 01707018 Relevance: .2, Instructions: 176COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a773d539bc31cc939efdbd3719c0928e2d8542d67bbf079a1df9482bffaa2951
                                                                                                                    • Instruction ID: fa0b51e55c0ad87b37456a940cbd1be3c01135551a2a89cabbc7019c85602494
                                                                                                                    • Opcode Fuzzy Hash: a773d539bc31cc939efdbd3719c0928e2d8542d67bbf079a1df9482bffaa2951
                                                                                                                    • Instruction Fuzzy Hash: B4819E74E00209DFDB15DFA9D980A9DBBF2FF88300F20912AE819A7365DB346945CF40
                                                                                                                    Function 07CF1070 Relevance: .1, Instructions: 133COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: bb85ee341c23fd38c7f6550235bfde826014e6ec6b7c0ec5b69dab4813dbe159
                                                                                                                    • Instruction ID: e3352125cbe61100547127151e8064727ee3e12738419c3dcee396e68826902b
                                                                                                                    • Opcode Fuzzy Hash: bb85ee341c23fd38c7f6550235bfde826014e6ec6b7c0ec5b69dab4813dbe159
                                                                                                                    • Instruction Fuzzy Hash: 244127B4D2924CCBDB44CFAAD5847EDBBFABB4A300F18E026D10AA7255DB345946CF10
                                                                                                                    Function 07CF3D44 Relevance: .0, Instructions: 16COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 3ed25285801e73a5aba118c7f3acf6dae65ad18a5792d59bf4432efdafd37349
                                                                                                                    • Instruction ID: cda0fa3bd453ceef0a184a61b91d42d81d175c7d18d48b69b02438b56047a2b9
                                                                                                                    • Opcode Fuzzy Hash: 3ed25285801e73a5aba118c7f3acf6dae65ad18a5792d59bf4432efdafd37349
                                                                                                                    • Instruction Fuzzy Hash: 23C092A6EEE088D28AC82C8674401FAE33D928B4A2F453062C71EA31025110C7AE9149
                                                                                                                    Function 07CF04F4 Relevance: 1.7, APIs: 1, Instructions: 246processCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 0 7cf04f4-7cf0595 2 7cf05ce-7cf05ee 0->2 3 7cf0597-7cf05a1 0->3 10 7cf0627-7cf0656 2->10 11 7cf05f0-7cf05fa 2->11 3->2 4 7cf05a3-7cf05a5 3->4 5 7cf05c8-7cf05cb 4->5 6 7cf05a7-7cf05b1 4->6 5->2 8 7cf05b5-7cf05c4 6->8 9 7cf05b3 6->9 8->8 13 7cf05c6 8->13 9->8 19 7cf068f-7cf0749 CreateProcessA 10->19 20 7cf0658-7cf0662 10->20 11->10 12 7cf05fc-7cf05fe 11->12 14 7cf0621-7cf0624 12->14 15 7cf0600-7cf060a 12->15 13->5 14->10 17 7cf060e-7cf061d 15->17 18 7cf060c 15->18 17->17 21 7cf061f 17->21 18->17 31 7cf074b-7cf0751 19->31 32 7cf0752-7cf07d8 19->32 20->19 22 7cf0664-7cf0666 20->22 21->14 24 7cf0689-7cf068c 22->24 25 7cf0668-7cf0672 22->25 24->19 26 7cf0676-7cf0685 25->26 27 7cf0674 25->27 26->26 29 7cf0687 26->29 27->26 29->24 31->32 42 7cf07da-7cf07de 32->42 43 7cf07e8-7cf07ec 32->43 42->43 44 7cf07e0 42->44 45 7cf07ee-7cf07f2 43->45 46 7cf07fc-7cf0800 43->46 44->43 45->46 49 7cf07f4 45->49 47 7cf0802-7cf0806 46->47 48 7cf0810-7cf0814 46->48 47->48 50 7cf0808 47->50 51 7cf0826-7cf082d 48->51 52 7cf0816-7cf081c 48->52 49->46 50->48 53 7cf082f-7cf083e 51->53 54 7cf0844 51->54 52->51 53->54 56 7cf0845 54->56 56->56
                                                                                                                    APIs
                                                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07CF0736
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 963392458-0
                                                                                                                    • Opcode ID: 24e8828035e89e00b0643ef2c5d94cf4f63f3a9c40a073e18935a2cdb784711c
                                                                                                                    • Instruction ID: e04002e880c2aeb6accacb6ed17cf3c62f99a6f89b2c467042d13e9fc98a3809
                                                                                                                    • Opcode Fuzzy Hash: 24e8828035e89e00b0643ef2c5d94cf4f63f3a9c40a073e18935a2cdb784711c
                                                                                                                    • Instruction Fuzzy Hash: EAA14EB1D0061ADFDF54CF68C8817EDBBB2BF48710F1485AAE908A7241DB749A85CF91
                                                                                                                    Function 07CF0500 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 57 7cf0500-7cf0595 59 7cf05ce-7cf05ee 57->59 60 7cf0597-7cf05a1 57->60 67 7cf0627-7cf0656 59->67 68 7cf05f0-7cf05fa 59->68 60->59 61 7cf05a3-7cf05a5 60->61 62 7cf05c8-7cf05cb 61->62 63 7cf05a7-7cf05b1 61->63 62->59 65 7cf05b5-7cf05c4 63->65 66 7cf05b3 63->66 65->65 70 7cf05c6 65->70 66->65 76 7cf068f-7cf0749 CreateProcessA 67->76 77 7cf0658-7cf0662 67->77 68->67 69 7cf05fc-7cf05fe 68->69 71 7cf0621-7cf0624 69->71 72 7cf0600-7cf060a 69->72 70->62 71->67 74 7cf060e-7cf061d 72->74 75 7cf060c 72->75 74->74 78 7cf061f 74->78 75->74 88 7cf074b-7cf0751 76->88 89 7cf0752-7cf07d8 76->89 77->76 79 7cf0664-7cf0666 77->79 78->71 81 7cf0689-7cf068c 79->81 82 7cf0668-7cf0672 79->82 81->76 83 7cf0676-7cf0685 82->83 84 7cf0674 82->84 83->83 86 7cf0687 83->86 84->83 86->81 88->89 99 7cf07da-7cf07de 89->99 100 7cf07e8-7cf07ec 89->100 99->100 101 7cf07e0 99->101 102 7cf07ee-7cf07f2 100->102 103 7cf07fc-7cf0800 100->103 101->100 102->103 106 7cf07f4 102->106 104 7cf0802-7cf0806 103->104 105 7cf0810-7cf0814 103->105 104->105 107 7cf0808 104->107 108 7cf0826-7cf082d 105->108 109 7cf0816-7cf081c 105->109 106->103 107->105 110 7cf082f-7cf083e 108->110 111 7cf0844 108->111 109->108 110->111 113 7cf0845 111->113 113->113
                                                                                                                    APIs
                                                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07CF0736
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 963392458-0
                                                                                                                    • Opcode ID: 6cdb2ca3c06c589937cc8f05e88f71c93ca295b9fc0a15ed3f5917790dd22b14
                                                                                                                    • Instruction ID: 11838969a5bd9446691ca95fca4a5e28a7bac09ba07913c05c7e0372cf08c68a
                                                                                                                    • Opcode Fuzzy Hash: 6cdb2ca3c06c589937cc8f05e88f71c93ca295b9fc0a15ed3f5917790dd22b14
                                                                                                                    • Instruction Fuzzy Hash: 2E914DB1D0061ADFDF54CF68C8817EDBBB2BF48710F1485AAE908A7241DB749A85CF91
                                                                                                                    Function 0170B3C1 Relevance: 1.7, APIs: 1, Instructions: 200COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 114 170b3c1-170b3df 115 170b3e1-170b3ee call 1709f4c 114->115 116 170b40b-170b40f 114->116 123 170b3f0 115->123 124 170b404 115->124 118 170b411-170b41b 116->118 119 170b423-170b464 116->119 118->119 125 170b471-170b47f 119->125 126 170b466-170b46e 119->126 169 170b3f6 call 170b668 123->169 170 170b3f6 call 170b659 123->170 124->116 127 170b481-170b486 125->127 128 170b4a3-170b4a5 125->128 126->125 130 170b491 127->130 131 170b488-170b48f call 1709f58 127->131 133 170b4a8-170b4af 128->133 129 170b3fc-170b3fe 129->124 132 170b540-170b600 129->132 135 170b493-170b4a1 130->135 131->135 164 170b602-170b605 132->164 165 170b608-170b633 GetModuleHandleW 132->165 136 170b4b1-170b4b9 133->136 137 170b4bc-170b4c3 133->137 135->133 136->137 138 170b4d0-170b4d9 call 1709f68 137->138 139 170b4c5-170b4cd 137->139 145 170b4e6-170b4eb 138->145 146 170b4db-170b4e3 138->146 139->138 147 170b509-170b516 145->147 148 170b4ed-170b4f4 145->148 146->145 154 170b518-170b536 147->154 155 170b539-170b53f 147->155 148->147 150 170b4f6-170b506 call 1709f78 call 170afbc 148->150 150->147 154->155 164->165 166 170b635-170b63b 165->166 167 170b63c-170b650 165->167 166->167 169->129 170->129
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 0170B626
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleModule
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4139908857-0
                                                                                                                    • Opcode ID: cf14aac849b4886a9df3c794cc58d4a9dfec4965e294068a099533403db85738
                                                                                                                    • Instruction ID: 6ef30fc37b2f50c526c46c5584e2921f2e07b2f2d6c194ebf2011d15973394a1
                                                                                                                    • Opcode Fuzzy Hash: cf14aac849b4886a9df3c794cc58d4a9dfec4965e294068a099533403db85738
                                                                                                                    • Instruction Fuzzy Hash: 83814474A00B05CFE725DF29D54479ABBF1FF88204F00892EE58AD7A91DB74EA05CB91
                                                                                                                    Function 0170590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 171 170590c-17059d9 CreateActCtxA 173 17059e2-1705a3c 171->173 174 17059db-17059e1 171->174 181 1705a4b-1705a4f 173->181 182 1705a3e-1705a41 173->182 174->173 183 1705a60 181->183 184 1705a51-1705a5d 181->184 182->181 185 1705a61 183->185 184->183 185->185
                                                                                                                    APIs
                                                                                                                    • CreateActCtxA.KERNEL32(?), ref: 017059C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Create
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2289755597-0
                                                                                                                    • Opcode ID: d7f7c41eda50fa40f8baa1ee7d4b96b3aa2d0e465608bbdb43409deac4998747
                                                                                                                    • Instruction ID: 6a60dee2eb7d7d518d5eb11c098bc30a5df8f960a892a40bf5abdc19d487c234
                                                                                                                    • Opcode Fuzzy Hash: d7f7c41eda50fa40f8baa1ee7d4b96b3aa2d0e465608bbdb43409deac4998747
                                                                                                                    • Instruction Fuzzy Hash: 0C41EFB0C00719CBDB25CFA9C985B9DFBF5BF49704F20806AD408AB251DB756945CF50
                                                                                                                    Function 017044F0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 187 17044f0-17059d9 CreateActCtxA 190 17059e2-1705a3c 187->190 191 17059db-17059e1 187->191 198 1705a4b-1705a4f 190->198 199 1705a3e-1705a41 190->199 191->190 200 1705a60 198->200 201 1705a51-1705a5d 198->201 199->198 202 1705a61 200->202 201->200 202->202
                                                                                                                    APIs
                                                                                                                    • CreateActCtxA.KERNEL32(?), ref: 017059C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Create
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2289755597-0
                                                                                                                    • Opcode ID: eff646def067a7d00f48f24d7eeb28ed50efe4999a089b1e5316695508ee0335
                                                                                                                    • Instruction ID: 78086e3e3182d760e2e7494e76205e9b2b84490e444f3296b11960c68889e7c8
                                                                                                                    • Opcode Fuzzy Hash: eff646def067a7d00f48f24d7eeb28ed50efe4999a089b1e5316695508ee0335
                                                                                                                    • Instruction Fuzzy Hash: 2241CDB0C00719CBDB25CFA9C985B9EBBF5BF89704F20816AD408AB251DBB56945CF90
                                                                                                                    Function 057BD410 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 204 57bd410-57bd464 205 57bd46f-57bd47e 204->205 206 57bd466-57bd46c 204->206 207 57bd483-57bd4bc DrawTextExW 205->207 208 57bd480 205->208 206->205 209 57bd4be-57bd4c4 207->209 210 57bd4c5-57bd4e2 207->210 208->207 209->210
                                                                                                                    APIs
                                                                                                                    • DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,057BD3FD,?,?), ref: 057BD4AF
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2136358504.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_57b0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DrawText
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2175133113-0
                                                                                                                    • Opcode ID: bc24affdbe70d080ca9e256c84aa837c36c51b966dac95c2d27f4d4a59e82142
                                                                                                                    • Instruction ID: 334e496208075a533e1ef6e14a328e8d95997243cf542f40c4eeecbcc3ebc7dd
                                                                                                                    • Opcode Fuzzy Hash: bc24affdbe70d080ca9e256c84aa837c36c51b966dac95c2d27f4d4a59e82142
                                                                                                                    • Instruction Fuzzy Hash: B331E0B59002099FDB10CF99D884BEEBBF5BF58320F14842AE919A7210D3B5A544CFA1
                                                                                                                    Function 057BC04C Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 213 57bc04c-57bd464 215 57bd46f-57bd47e 213->215 216 57bd466-57bd46c 213->216 217 57bd483-57bd4bc DrawTextExW 215->217 218 57bd480 215->218 216->215 219 57bd4be-57bd4c4 217->219 220 57bd4c5-57bd4e2 217->220 218->217 219->220
                                                                                                                    APIs
                                                                                                                    • DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,057BD3FD,?,?), ref: 057BD4AF
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2136358504.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_57b0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DrawText
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2175133113-0
                                                                                                                    • Opcode ID: b44d45efb24ba83a25173bf7e4b186f37ca99c60f1dbbcfecfb41e0b54297123
                                                                                                                    • Instruction ID: dd90ec822485795f1d87ae2e85ee5dcdcdc9206f46b490179d234992ae2674c4
                                                                                                                    • Opcode Fuzzy Hash: b44d45efb24ba83a25173bf7e4b186f37ca99c60f1dbbcfecfb41e0b54297123
                                                                                                                    • Instruction Fuzzy Hash: 3F31E4B59002099FDB10CF9AD8847DEBBF5FB48310F14842AE919A7310D7B4A944CFA1
                                                                                                                    Function 05D7FAA2 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 223 5d7faa2-5d7faf6 226 5d7fb06-5d7fb45 WriteProcessMemory 223->226 227 5d7faf8-5d7fb04 223->227 229 5d7fb47-5d7fb4d 226->229 230 5d7fb4e-5d7fb7e 226->230 227->226 229->230
                                                                                                                    APIs
                                                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05D7FB38
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MemoryProcessWrite
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3559483778-0
                                                                                                                    • Opcode ID: 8fcd7c84e8a086ed673b3a78f276367c73cd33807e6d7e2df04d7eac2dee4a5a
                                                                                                                    • Instruction ID: 0b2d5a6d99a4a94c20a957265afffcd59aa567ae98cf2ac9d27e524e3e5c20fa
                                                                                                                    • Opcode Fuzzy Hash: 8fcd7c84e8a086ed673b3a78f276367c73cd33807e6d7e2df04d7eac2dee4a5a
                                                                                                                    • Instruction Fuzzy Hash: F621267590034ADFDB10CFA9C981BEEBBF5FF48310F10842AE919A7240D7789955CBA5
                                                                                                                    Function 05D7FAA8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 234 5d7faa8-5d7faf6 236 5d7fb06-5d7fb45 WriteProcessMemory 234->236 237 5d7faf8-5d7fb04 234->237 239 5d7fb47-5d7fb4d 236->239 240 5d7fb4e-5d7fb7e 236->240 237->236 239->240
                                                                                                                    APIs
                                                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05D7FB38
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MemoryProcessWrite
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3559483778-0
                                                                                                                    • Opcode ID: 54d6679cc5fd282ef5f3a1896f606d370485a99934c6a9db510cea59c5b581df
                                                                                                                    • Instruction ID: 38b607e58bad6797b75b9e1241207962691db2ea7dccf3d32994d87998c08bf2
                                                                                                                    • Opcode Fuzzy Hash: 54d6679cc5fd282ef5f3a1896f606d370485a99934c6a9db510cea59c5b581df
                                                                                                                    • Instruction Fuzzy Hash: D621F47590034ADFDB10CFAAC985BEEBBF5FF48310F10842AE919A7240D7789954CBA5
                                                                                                                    Function 05D7F4D1 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 244 5d7f4d1-5d7f523 247 5d7f525-5d7f531 244->247 248 5d7f533-5d7f563 Wow64SetThreadContext 244->248 247->248 250 5d7f565-5d7f56b 248->250 251 5d7f56c-5d7f59c 248->251 250->251
                                                                                                                    APIs
                                                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05D7F556
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ContextThreadWow64
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 983334009-0
                                                                                                                    • Opcode ID: 52375905ae14b4f16c8d6c170891bc37dcd85d8ffc990dc30e857527990b4444
                                                                                                                    • Instruction ID: fec271af10e7641cbf48bf05d361c9fca524c253be2c9a351306b5aa10b39c54
                                                                                                                    • Opcode Fuzzy Hash: 52375905ae14b4f16c8d6c170891bc37dcd85d8ffc990dc30e857527990b4444
                                                                                                                    • Instruction Fuzzy Hash: E1213A7190030A9FDB10DFAAC8857EEBBF4FF48324F54842AD519A7240DB78A945CFA5
                                                                                                                    Function 0170B3B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 255 170b3b0-170da5c DuplicateHandle 257 170da65-170da82 255->257 258 170da5e-170da64 255->258 258->257
                                                                                                                    APIs
                                                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0170D586,?,?,?,?,?), ref: 0170DA4F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DuplicateHandle
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3793708945-0
                                                                                                                    • Opcode ID: 2565d561ed618feda4ae51781edd210d5a353443fe53c758eefd519e0062cee4
                                                                                                                    • Instruction ID: fc6ee29ec15770bc2f277a322bd9c074ef280bc3ddbe3fd6db7e600d6baf1b33
                                                                                                                    • Opcode Fuzzy Hash: 2565d561ed618feda4ae51781edd210d5a353443fe53c758eefd519e0062cee4
                                                                                                                    • Instruction Fuzzy Hash: CA21D4B5904309EFDB10CF9AD984AEEFBF5EB48310F14841AE918A3350D374A950CFA0
                                                                                                                    Function 05D7FB92 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 261 5d7fb92-5d7fc25 ReadProcessMemory 265 5d7fc27-5d7fc2d 261->265 266 5d7fc2e-5d7fc5e 261->266 265->266
                                                                                                                    APIs
                                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05D7FC18
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MemoryProcessRead
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1726664587-0
                                                                                                                    • Opcode ID: 2f06725fbe62adc4ec8e548bb87e39d7defd4720f0c3e870cd70c94ff8b1e90d
                                                                                                                    • Instruction ID: 83ff5c400e64ced4108354fccc2b093aaeca6f6f53a77aaa204eb040224c8a17
                                                                                                                    • Opcode Fuzzy Hash: 2f06725fbe62adc4ec8e548bb87e39d7defd4720f0c3e870cd70c94ff8b1e90d
                                                                                                                    • Instruction Fuzzy Hash: 42212AB190035A9FDB10CFAAC881BDEFBF5FF48310F14842AE919A7240D7789554CBA5
                                                                                                                    Function 05D7F4D8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 270 5d7f4d8-5d7f523 272 5d7f525-5d7f531 270->272 273 5d7f533-5d7f563 Wow64SetThreadContext 270->273 272->273 275 5d7f565-5d7f56b 273->275 276 5d7f56c-5d7f59c 273->276 275->276
                                                                                                                    APIs
                                                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05D7F556
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ContextThreadWow64
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 983334009-0
                                                                                                                    • Opcode ID: 9210c58c88bbec78e3d0620c9b8c6544d5d56ae9b386a6a2a1895d9521076951
                                                                                                                    • Instruction ID: 1cb05c096f2b23318df10102de148810489666851482d3ff4f2c0fa2ec8173fb
                                                                                                                    • Opcode Fuzzy Hash: 9210c58c88bbec78e3d0620c9b8c6544d5d56ae9b386a6a2a1895d9521076951
                                                                                                                    • Instruction Fuzzy Hash: 7221387190030A8FDB10DFAAC4857AEBBF4FF88324F14842AD519A7240DB789944CFA5
                                                                                                                    Function 05D7FB98 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 280 5d7fb98-5d7fc25 ReadProcessMemory 283 5d7fc27-5d7fc2d 280->283 284 5d7fc2e-5d7fc5e 280->284 283->284
                                                                                                                    APIs
                                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05D7FC18
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MemoryProcessRead
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1726664587-0
                                                                                                                    • Opcode ID: b7d0e1db482491db65f79136fef711d482d9b94f9215790ce46eee01650f7536
                                                                                                                    • Instruction ID: ad51dcfd8c57f3a222735a44d7c8d06edfe90af8a7d65139b62097c134eb326e
                                                                                                                    • Opcode Fuzzy Hash: b7d0e1db482491db65f79136fef711d482d9b94f9215790ce46eee01650f7536
                                                                                                                    • Instruction Fuzzy Hash: E92128B190034A9FDB10CFAAC881BEEFBF5FF48310F14842AE919A7240D7789550CBA5
                                                                                                                    Function 0170D9C1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 288 170d9c1-170da5c DuplicateHandle 289 170da65-170da82 288->289 290 170da5e-170da64 288->290 290->289
                                                                                                                    APIs
                                                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0170D586,?,?,?,?,?), ref: 0170DA4F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DuplicateHandle
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3793708945-0
                                                                                                                    • Opcode ID: 918e88c65595da15d13c4dc58a8049f681c005fa023a89c823baa63ac506db63
                                                                                                                    • Instruction ID: 313ec62d99375a3120a8f519ecaca963c10048286686b659a88dab552c120a88
                                                                                                                    • Opcode Fuzzy Hash: 918e88c65595da15d13c4dc58a8049f681c005fa023a89c823baa63ac506db63
                                                                                                                    • Instruction Fuzzy Hash: DD21B0B5D00309DFDB11CFA9D985AEEBBF5EB48320F14841AE918A3350D378AA54CF61
                                                                                                                    Function 05D7F9E0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05D7FA56
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4275171209-0
                                                                                                                    • Opcode ID: 4387424343a56c00c45e072839f9f139b998904a81973b39af851686c8e38d40
                                                                                                                    • Instruction ID: 3860cefa1be604bcee11b08e9c3d8669e064405708871cdc66e13e5e55a611d9
                                                                                                                    • Opcode Fuzzy Hash: 4387424343a56c00c45e072839f9f139b998904a81973b39af851686c8e38d40
                                                                                                                    • Instruction Fuzzy Hash: 9B11447690024ADFDF20DFA9C845BDEBBF1AF88320F20881AE519A7250C7759550CF90
                                                                                                                    Function 05D7F9E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05D7FA56
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4275171209-0
                                                                                                                    • Opcode ID: a9f554bbfd14edef85a1fc509740b6dffe67e5a6c0277ea70a636eebd289947b
                                                                                                                    • Instruction ID: 37e9ab1fd35826f49ee8ccf548bdf8f8c3d4e2f7b9273539529bb5683aa8268a
                                                                                                                    • Opcode Fuzzy Hash: a9f554bbfd14edef85a1fc509740b6dffe67e5a6c0277ea70a636eebd289947b
                                                                                                                    • Instruction Fuzzy Hash: 8E11267290024ADFDB20DFAAC845BDEBBF5EF88320F14841AE519A7250C775A550CBA1
                                                                                                                    Function 05D7F420 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ResumeThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 947044025-0
                                                                                                                    • Opcode ID: d1c98a8c4e8bc1c44612fed1b7c685ee23da791fef8d63e07e54f450386ceea2
                                                                                                                    • Instruction ID: f6dc88b4367cea690610197e30813971f39a775c3e9c608e855e7e40ebc2fb6d
                                                                                                                    • Opcode Fuzzy Hash: d1c98a8c4e8bc1c44612fed1b7c685ee23da791fef8d63e07e54f450386ceea2
                                                                                                                    • Instruction Fuzzy Hash: 7A115B719003498FDB20DFAAC8457DEFBF4EF88324F148419D519A7240C779A544CB94
                                                                                                                    Function 05D7F428 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ResumeThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 947044025-0
                                                                                                                    • Opcode ID: 0fbf536d7fa2db850ed6fd239010659ff1c60d32041fb448d979909db3706d2f
                                                                                                                    • Instruction ID: 461d41ec77d70d024aa5b249e1a5b4073df45ddeec2b8cdf0bcf761d829736f2
                                                                                                                    • Opcode Fuzzy Hash: 0fbf536d7fa2db850ed6fd239010659ff1c60d32041fb448d979909db3706d2f
                                                                                                                    • Instruction Fuzzy Hash: 44113A719003498FDB20DFAAC44579EFBF5EF88724F24841AD519A7240DB75A540CB95
                                                                                                                    Function 07CF0154 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 07CF49B5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePost
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 410705778-0
                                                                                                                    • Opcode ID: cdfc3f8d3be65520dbb8cbd2f7401660bc5e2a6657e748e00e1b7bcce70f69d6
                                                                                                                    • Instruction ID: 0db27b28c11bc6ea3845aec362eba675d45df9c25de5b04aa6cbb4b225073150
                                                                                                                    • Opcode Fuzzy Hash: cdfc3f8d3be65520dbb8cbd2f7401660bc5e2a6657e748e00e1b7bcce70f69d6
                                                                                                                    • Instruction Fuzzy Hash: 751106B5900349DFDB50CF9AC585BDFBBF8EB48324F108459E618A7210D3B5AA54CFA1
                                                                                                                    Function 07CF4950 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 07CF49B5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePost
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 410705778-0
                                                                                                                    • Opcode ID: af341e2af44877ae47066acfe87d715476436e0b60dd1b0acf57a677adc11436
                                                                                                                    • Instruction ID: d8d51c4dc0479ef85363b275a13e1dd7c2cc8a0e8a1d35cb6ecb7df906a91a12
                                                                                                                    • Opcode Fuzzy Hash: af341e2af44877ae47066acfe87d715476436e0b60dd1b0acf57a677adc11436
                                                                                                                    • Instruction Fuzzy Hash: 981103B5900349DFDB10CF99D985BDEBBF8EB48320F10881AD558A7610D375A654CFA1
                                                                                                                    Function 0170B5C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 0170B626
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleModule
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4139908857-0
                                                                                                                    • Opcode ID: d87f4ba7b287a5b282dd5a09080be62113cfef7e7f846e6bdf39c434b0dbaac0
                                                                                                                    • Instruction ID: 73735977c2312ed99371512f2877a89fbd7ecb9eb18bf3bab019490e928cde72
                                                                                                                    • Opcode Fuzzy Hash: d87f4ba7b287a5b282dd5a09080be62113cfef7e7f846e6bdf39c434b0dbaac0
                                                                                                                    • Instruction Fuzzy Hash: 5811C0B5C00749CFDB10CF9AD844A9EFBF4AF88724F10841AD519A7250D375A545CFA5
                                                                                                                    Function 0141D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2131199265.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_141d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9e06ecada3bf8c4b5f13dabec2ae5917df6d98acde6910cfd7bfdb5da1404a8a
                                                                                                                    • Instruction ID: ea0bc079dc912464b823ed568d52aaee4e943eea3a5a7c35cd33fa654986a6c4
                                                                                                                    • Opcode Fuzzy Hash: 9e06ecada3bf8c4b5f13dabec2ae5917df6d98acde6910cfd7bfdb5da1404a8a
                                                                                                                    • Instruction Fuzzy Hash: 5C2125B2904240EFDB15DF58D9C4B27BF65FB88318F20C56EE9090B26AC336D456CAA1
                                                                                                                    Function 0141D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2131199265.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_141d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5f09ec5ce6e707b03f08c9392008b1d03d7ceaef9a7ebe139777edd5cd1cb9f7
                                                                                                                    • Instruction ID: a7417734384a3ec1aa4f8e8f9b1e549c7053430a0bca5a3825c69521b36f7d6a
                                                                                                                    • Opcode Fuzzy Hash: 5f09ec5ce6e707b03f08c9392008b1d03d7ceaef9a7ebe139777edd5cd1cb9f7
                                                                                                                    • Instruction Fuzzy Hash: D62136B2940204DFDB05DF44D9C4B67BF65FB88324F20C17EE90A0B26AC336E456CAA1
                                                                                                                    Function 0162D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2132410908.000000000162D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_162d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d86b3823a04f0d4c4d9de517bc3c6d9e9ebcdcd7013fdb6753843172af3c72ad
                                                                                                                    • Instruction ID: 2795e2fee754478f520726cf58ef295f3432c76b8fd727eb31394dab8251f5b3
                                                                                                                    • Opcode Fuzzy Hash: d86b3823a04f0d4c4d9de517bc3c6d9e9ebcdcd7013fdb6753843172af3c72ad
                                                                                                                    • Instruction Fuzzy Hash: 61213471504600EFDB05DF94D9C0B26BBA5FB85324F20C56DEA0A4B352C776D406CE61
                                                                                                                    Function 0162D01C Relevance: .1, Instructions: 72COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2132410908.000000000162D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_162d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ee1242d22caaa67994403e2adbf2f0f3cd567b415c320f8191c2747b017f3fbb
                                                                                                                    • Instruction ID: 3b40e0f2f59ca19b5da8532de036871f8ea11933c3ad48f0381f04785b022533
                                                                                                                    • Opcode Fuzzy Hash: ee1242d22caaa67994403e2adbf2f0f3cd567b415c320f8191c2747b017f3fbb
                                                                                                                    • Instruction Fuzzy Hash: BA212275604640EFDB15DF54D9C0B26BB61FB84314F20C56DD90A0B3A2C77AD447CE61
                                                                                                                    Function 0162D006 Relevance: .1, Instructions: 63COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2132410908.000000000162D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_162d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: febb27e000bf5d9e94dee07e6b4ffd37fd8657e1843936f961e01ba7a31c139d
                                                                                                                    • Instruction ID: 5bd2ca6f56363c3f8e9b9aabc59f9f26a9aa7295df30a44bab75a25f07b54b31
                                                                                                                    • Opcode Fuzzy Hash: febb27e000bf5d9e94dee07e6b4ffd37fd8657e1843936f961e01ba7a31c139d
                                                                                                                    • Instruction Fuzzy Hash: 822180755087809FCB02CF64D994B15BF71EB46314F28C5DAD8498F2A7C33AD816CB62
                                                                                                                    Function 0141D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2131199265.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_141d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction ID: 818dfd632f233fad9344a301b7dd0f58dd8eced2990188baeeb1847e41622307
                                                                                                                    • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction Fuzzy Hash: 1511D2B6844240CFCB16CF44D5C4B56BF71FB84314F24C6AAD8090B26BC33AD456CB91
                                                                                                                    Function 0141D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2131199265.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_141d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction ID: 62babc0454a8edae168882f0920daea0202ccc035885ab345f3092313440cf8b
                                                                                                                    • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction Fuzzy Hash: FC11B1B6904280CFCB16CF54D9C4B16BF71FB84318F24C6AAD8490B66BC33AD456CBA1
                                                                                                                    Function 0162D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2132410908.000000000162D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_162d000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
                                                                                                                    • Instruction ID: 87001a9ecaacf8c8d08e75a7adc3f3ae26c81133536f106e9863ff9e046e6c3c
                                                                                                                    • Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
                                                                                                                    • Instruction Fuzzy Hash: 3D11BB75504680DFDB02CF54C9C0B15BBA1FB85224F24C6A9D9494B3A6C33AD40ACF62

                                                                                                                    Non-executed Functions

                                                                                                                    Function 05D7CF88 Relevance: 1.6, Strings: 1, Instructions: 312COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: pv
                                                                                                                    • API String ID: 0-2349736466
                                                                                                                    • Opcode ID: 6e2340e5c97e0a8d9d205a86daef0fd6b7641129a49472dc6d7e2c826fa82f7a
                                                                                                                    • Instruction ID: b0f1b7ac5be3d4d6c624306844b941e723380ded5aee529fded410ab1fb4175e
                                                                                                                    • Opcode Fuzzy Hash: 6e2340e5c97e0a8d9d205a86daef0fd6b7641129a49472dc6d7e2c826fa82f7a
                                                                                                                    • Instruction Fuzzy Hash: 99E1E874E042598FDB14DFA9C580AAEBBB2FF89304F24816AD415AB355D731A942CF60
                                                                                                                    Function 07CF69E8 Relevance: .4, Instructions: 378COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2138018942.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_7cf0000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5404d622de4d3d5403f461e11c6025f2196006c2d9452636e5d3e065996adce3
                                                                                                                    • Instruction ID: c3f117c67ef2520ec82780087ca6521965e20188dbf28012b11711ef4dd67fbf
                                                                                                                    • Opcode Fuzzy Hash: 5404d622de4d3d5403f461e11c6025f2196006c2d9452636e5d3e065996adce3
                                                                                                                    • Instruction Fuzzy Hash: A0D1ADB07017058FDB69DF75C8947AEB7F6AF89300F1484AAD246AB394CB35EA01CB51
                                                                                                                    Function 05D7F5B0 Relevance: .3, Instructions: 312COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e32610f7666df52c67adf63fc76a00f919019de48e1f7ca7f2220588455926c2
                                                                                                                    • Instruction ID: d1f997009d1f6066ff7c226c14afcc364864bf9bbe68d84c6f90ddf08b8c3ec6
                                                                                                                    • Opcode Fuzzy Hash: e32610f7666df52c67adf63fc76a00f919019de48e1f7ca7f2220588455926c2
                                                                                                                    • Instruction Fuzzy Hash: DFE1F874E0425ADFDB14DFA9C580AAEBBF2FF49304F24826AD415A7355D730A982CF60
                                                                                                                    Function 05D7E7C8 Relevance: .3, Instructions: 312COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 79fef3d13056eb3c64bd9d933d56a54ed456e96bfb74fb7ddd1d964ce81989ca
                                                                                                                    • Instruction ID: 9391a3d8c5ca7c2670c82f94d54972a228969cb75f4d57caa02702acc6080ce2
                                                                                                                    • Opcode Fuzzy Hash: 79fef3d13056eb3c64bd9d933d56a54ed456e96bfb74fb7ddd1d964ce81989ca
                                                                                                                    • Instruction Fuzzy Hash: 66E10974E04259CFDB14DFA9C580AAEBBB6FF88304F24826AD415A7355D730A942CF61
                                                                                                                    Function 05D7E390 Relevance: .3, Instructions: 312COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 87318cca6c169e5a6ad8473e1a88d522c37a5de6862a11f4879fe66f6b5c41e7
                                                                                                                    • Instruction ID: 587d1ffd2a5012a86fc22560eaa2583fd9716e58de6e4a44eeb53393e393e8a5
                                                                                                                    • Opcode Fuzzy Hash: 87318cca6c169e5a6ad8473e1a88d522c37a5de6862a11f4879fe66f6b5c41e7
                                                                                                                    • Instruction Fuzzy Hash: A1E1E874E00259CFDB14DFA9C580AAEBBB6FF89304F2482AAD455A7355D730AD42CF60
                                                                                                                    Function 05D7EC00 Relevance: .3, Instructions: 312COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 44268d9746eacb9ed16ddce56b7e933ff8f99dfd832f4c05c380424010cce307
                                                                                                                    • Instruction ID: fbe41bc4ea1936f594722e5684d6cfa9108947bb7fe356fc8903e31051c89212
                                                                                                                    • Opcode Fuzzy Hash: 44268d9746eacb9ed16ddce56b7e933ff8f99dfd832f4c05c380424010cce307
                                                                                                                    • Instruction Fuzzy Hash: 59E1E874E002598FDB14DFA9C580AAEFBF6FF89304F24826AD415A7355D730A982CF61
                                                                                                                    Function 0170D8EC Relevance: .3, Instructions: 264COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2133042656.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_1700000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 89601bcb12db582d1d0bad9ba1880381be1e15cd5569b2cd0b3385e060145129
                                                                                                                    • Instruction ID: 0a397bfe10f537ae81cd2542ee88ecc3a524584a02802e53220378bc89265baf
                                                                                                                    • Opcode Fuzzy Hash: 89601bcb12db582d1d0bad9ba1880381be1e15cd5569b2cd0b3385e060145129
                                                                                                                    • Instruction Fuzzy Hash: 27A14B32A1030ACFCF16DFB4C84459EBBF2FF85300B15856AE905AB2A5DB75E956CB40
                                                                                                                    Function 05D75180 Relevance: .2, Instructions: 210COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 29010a12dcd884844c130151469ccadabee006a895128ee727a43ac879ec757c
                                                                                                                    • Instruction ID: 2c4641301bab0c9be62d0ba8855407c0be7ad9f671a3af0a6f4050e6efee0b93
                                                                                                                    • Opcode Fuzzy Hash: 29010a12dcd884844c130151469ccadabee006a895128ee727a43ac879ec757c
                                                                                                                    • Instruction Fuzzy Hash: AD91E274D0621CCFDB14CFA9E884BEDBBB6FB49305F10806AD819A7291EB704985CF51
                                                                                                                    Function 05D73F48 Relevance: .2, Instructions: 173COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 8388061469d1cb012099ff984b22881990c35beff6158d1f45983342d13809a2
                                                                                                                    • Instruction ID: 65556683dd70334d717d3f4d9e61fd6d0378093a3bc4f780bdc67a88cce04516
                                                                                                                    • Opcode Fuzzy Hash: 8388061469d1cb012099ff984b22881990c35beff6158d1f45983342d13809a2
                                                                                                                    • Instruction Fuzzy Hash: 83714770A1120ACFD749DF6AE84569ABFF6FBC8300F04C56AD014AB2A8EF745946CB51
                                                                                                                    Function 05D73F70 Relevance: .2, Instructions: 159COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ec62b4c6524666a1967b01ed4d1e8e2efea7898ed605d4f708976697813295a5
                                                                                                                    • Instruction ID: 2682f40270d170d30f58397754f6a90aad93dca7411625198db33f6fc13f878a
                                                                                                                    • Opcode Fuzzy Hash: ec62b4c6524666a1967b01ed4d1e8e2efea7898ed605d4f708976697813295a5
                                                                                                                    • Instruction Fuzzy Hash: B5613870A1120ACFD748DF6BE84569ABFF6FBC8300F04C56AD014AB268EF7419469B51
                                                                                                                    Function 05D7C008 Relevance: .1, Instructions: 147COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a1abee447f890f57533a125e4459b55d2e1171483d2af62daf2748e8fa46a3a1
                                                                                                                    • Instruction ID: 0ff3326fbb4fa23cad1361ec695b8ead51aef950a4ec08d2b55907b536723fc0
                                                                                                                    • Opcode Fuzzy Hash: a1abee447f890f57533a125e4459b55d2e1171483d2af62daf2748e8fa46a3a1
                                                                                                                    • Instruction Fuzzy Hash: E551B374E2921DCFCB04CFAAD8449EDBBF6BB89300F149026D459A7221E7749D81CF90
                                                                                                                    Function 05D7EBF0 Relevance: .1, Instructions: 133COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7f024da284f93f67544eba0f6eaaff46f1009613d8143019c46e12ca5528ec5e
                                                                                                                    • Instruction ID: d60118978be3ce4daf14f373deb6aa23868a74e243679dd886283f08dee44091
                                                                                                                    • Opcode Fuzzy Hash: 7f024da284f93f67544eba0f6eaaff46f1009613d8143019c46e12ca5528ec5e
                                                                                                                    • Instruction Fuzzy Hash: D6510C74E002198BDB14CFAAC9806AEFBF6FF89304F24816AD418A7355D7359E42CF61
                                                                                                                    Function 05D7BFC8 Relevance: .1, Instructions: 126COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 21ad1e156c19df8feba15112363fe82d8a0dcbce88b79fd549991091edd655cc
                                                                                                                    • Instruction ID: dfa35527937f0101393da4903e59834894d105944142b76112bfc33d47f9c7a6
                                                                                                                    • Opcode Fuzzy Hash: 21ad1e156c19df8feba15112363fe82d8a0dcbce88b79fd549991091edd655cc
                                                                                                                    • Instruction Fuzzy Hash: A2411675D2921DCFCF04CFAAD9456EDBBB6BB89300F04906BD859A2221E7748981CF90
                                                                                                                    Function 05D7BFF8 Relevance: .1, Instructions: 117COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.2137696981.0000000005D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_5d70000_New purchase order.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6196592d051244972ef5971c6ce79e447dd7273eef48292666635728b8c4fc45
                                                                                                                    • Instruction ID: 894cfaeb876d8f0d5598b79409c2f86bd16b0a449909c543a3bc3676003a17c1
                                                                                                                    • Opcode Fuzzy Hash: 6196592d051244972ef5971c6ce79e447dd7273eef48292666635728b8c4fc45
                                                                                                                    • Instruction Fuzzy Hash: E641E574D2921DCFDB04CFAAC8446EEBBB6BB89300F04D12AD459B3221E7749981CF94

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:0.2%
                                                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                                                    Signature Coverage:54.1%
                                                                                                                    Total number of Nodes:37
                                                                                                                    Total number of Limit Nodes:3
                                                                                                                    execution_graph 63433 16f096e 63434 16f09a8 ___swprintf_l 63433->63434 63436 16f0ed3 __startOneArgErrorHandling 63434->63436 63461 16f2df0 LdrInitializeThunk 63434->63461 63437 16f0a15 __except_handler4 63437->63436 63462 16f2df0 LdrInitializeThunk 63437->63462 63439 16f0a6c 63439->63436 63463 16f0f04 LdrInitializeThunk __startOneArgErrorHandling __except_handler4 63439->63463 63441 16f0a81 63441->63436 63442 16f0a8b GetPEB 63441->63442 63443 16f0ac5 63442->63443 63443->63436 63464 16f171c 63443->63464 63445 16f0ae9 63446 1729837 63445->63446 63452 16f0b03 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 63445->63452 63457 16f0e0f ___swprintf_l 63445->63457 63471 16f2ad0 LdrInitializeThunk 63446->63471 63447 16f0ec2 GetPEB 63447->63436 63450 16f0f02 63450->63447 63451 16f0ddb __vswprintf 63474 16f0fa6 GetPEB GetPEB LdrInitializeThunk 63451->63474 63452->63451 63453 16f0bbb GetPEB 63452->63453 63453->63451 63455 16f0be7 __vswprintf 63453->63455 63455->63451 63472 16f13c5 23 API calls 2 library calls 63455->63472 63457->63447 63457->63450 63458 1729b56 63457->63458 63470 16f2b60 LdrInitializeThunk 63457->63470 63459 16f0ce6 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 63459->63451 63473 16f10ee 7 API calls 2 library calls 63459->63473 63461->63437 63462->63439 63463->63441 63465 16f175b __except_handler4 63464->63465 63469 16f17e5 63465->63469 63475 16f2fe0 LdrInitializeThunk 63465->63475 63468 16f1830 __startOneArgErrorHandling 63468->63445 63476 16c3c70 GetPEB 63469->63476 63470->63450 63471->63457 63472->63459 63473->63451 63474->63457 63475->63469 63476->63468 63480 16f2c1d 63481 16f2c25 63480->63481 63482 16f2c24 LdrInitializeThunk 63480->63482 63482->63481 63483 16f2bf0 LdrInitializeThunk

                                                                                                                    Executed Functions

                                                                                                                    Function 016F2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 9 16f2b60-16f2b6c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(01720DBD,?,?,?,?,01714302), ref: 016F2B6A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: f203dfac195c99f07c12ee5ffa6ef632538847f4f83a02e0f51aeabde100d4a3
                                                                                                                    • Instruction ID: e8dca5e6fab4b8ab50af48ac0dd59699911768a58bf1836421786e4fedc6e60e
                                                                                                                    • Opcode Fuzzy Hash: f203dfac195c99f07c12ee5ffa6ef632538847f4f83a02e0f51aeabde100d4a3
                                                                                                                    • Instruction Fuzzy Hash: 6E9002A160690083420671584414616804A97E0201B55C031E10145E4DC5258AD16226
                                                                                                                    Function 016F2C1D Relevance: 1.5, APIs: 1, Instructions: 11libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 0 16f2c1d-16f2c22 1 16f2c25-16f2c35 0->1 2 16f2c24 LdrInitializeThunk 0->2 3 16f2c3c 1->3 2->1
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0170FD4F,000000FF,00000024,017A6634,00000004,00000000,?,-00000018,7D810F61,?,?,016C8B12,?,?,?,?), ref: 016F2C24
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ce3321e5bad54b70ca8e3e706bb28d51d5e9d9b7798c9065a57f5ea519cde920
                                                                                                                    • Instruction ID: da0e1b0dee31d3088e79f7c9b20c804db924790feab6062f79cb0ba9bef62cd8
                                                                                                                    • Opcode Fuzzy Hash: ce3321e5bad54b70ca8e3e706bb28d51d5e9d9b7798c9065a57f5ea519cde920
                                                                                                                    • Instruction Fuzzy Hash: 17C08C3185098482C219E56408807CF1249A7C8380F10C418E70293219CB328269A572
                                                                                                                    Function 016F2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 4 16f2c0a-16f2c0f 5 16f2c1f-16f2c26 LdrInitializeThunk 4->5 6 16f2c11-16f2c18 4->6
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0170FD4F,000000FF,00000024,017A6634,00000004,00000000,?,-00000018,7D810F61,?,?,016C8B12,?,?,?,?), ref: 016F2C24
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: a7584d6defc969be29050ce8a3b62e9b1c47c718f31a1d5deaa9d897f9b7c574
                                                                                                                    • Instruction ID: aa38b05a7782c29f7607efbf86d3d6f1b75b431111ed83386d45e11f0c2234ef
                                                                                                                    • Opcode Fuzzy Hash: a7584d6defc969be29050ce8a3b62e9b1c47c718f31a1d5deaa9d897f9b7c574
                                                                                                                    • Instruction Fuzzy Hash: 13B09B71D059C5C5DB52E7644A087177940B7D0701F15C075D3030695F8738C1D1E676
                                                                                                                    Function 016F2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 10 16f2bf0-16f2bfc LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(01707BA5,000000FF,?,00000000,?,00001000,00000000,?,-00000018,7D810F61,?,?,?,?), ref: 016F2BFA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: efc1fdb7164d8dd1cc6bc9d7b71a8bbb116b944f8b130ee8d1163192aafcc62f
                                                                                                                    • Instruction ID: 1ab52deab2beecaf87029faa6d603028a77101b576e477620b03d6c40b87cb69
                                                                                                                    • Opcode Fuzzy Hash: efc1fdb7164d8dd1cc6bc9d7b71a8bbb116b944f8b130ee8d1163192aafcc62f
                                                                                                                    • Instruction Fuzzy Hash: 3190027160590882D2817158440464A404597D1301F95C025A00256A8DCA158B9977A2
                                                                                                                    Function 016F2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 8 16f2ad0-16f2adc LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(01729864,?,00000000,00000000,00000000,?,00000000,?,?,00000000,?,016F034A,?,?,?,00000003), ref: 016F2ADA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 4d33d38951b98a0dc93cb7ee7af104c655c24328f21fd4185940d321f81c8229
                                                                                                                    • Instruction ID: c2f9209bc12d980ee07a57542a193140a26222c6c83ff420e2ae59e0c1b4c57b
                                                                                                                    • Opcode Fuzzy Hash: 4d33d38951b98a0dc93cb7ee7af104c655c24328f21fd4185940d321f81c8229
                                                                                                                    • Instruction Fuzzy Hash: 86900265615900830206B5580704507408697D5351355C031F10155A4CD6218AA15222
                                                                                                                    Function 016F2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 14 16f2d30-16f2d3c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(016DA52A,000000FF,?,017A67F8,0178C9A0,00000020,016DA460,017A689C,00000000,0000001D,?,01222D38), ref: 016F2D3A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 370dcc4ab8681aa871c7aa80168c6a771332558598e8097c505a64ebf627873e
                                                                                                                    • Instruction ID: 96a842e8a4b845c12bc488e073cf4cb98f83ef9456c66e50b18fa2af4697724c
                                                                                                                    • Opcode Fuzzy Hash: 370dcc4ab8681aa871c7aa80168c6a771332558598e8097c505a64ebf627873e
                                                                                                                    • Instruction Fuzzy Hash: F690026170590083D241715854186068045E7E1301F55D021E04145A8CD9158A965323
                                                                                                                    Function 016F2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 13 16f2d10-16f2d1c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0173B508,00000004,000000FF,0000001E,00000000,00000000,00000000,C0000409,00000001,00000000,00000004,00000004,000F0007,C0000001,?,00000004), ref: 016F2D1A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 17bfe9ec43dbd19c2c591d53445cbe745d39b159d4b5ffd8df9e9342989ff5aa
                                                                                                                    • Instruction ID: ec3b88e60026a0ee89e37b7efda33f9fad7692c578fd6549bac6111c73c37fe4
                                                                                                                    • Opcode Fuzzy Hash: 17bfe9ec43dbd19c2c591d53445cbe745d39b159d4b5ffd8df9e9342989ff5aa
                                                                                                                    • Instruction Fuzzy Hash: 0290026961790082D2817158540860A404597D1202F95D425A00155ACCC9158AA95322
                                                                                                                    Function 016F2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 16 16f2df0-16f2dfc LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0172E73E,0000005A,0178D040,00000020,00000000,0178D040,00000080,01714A81,00000000,?,?,00000002,00000000,?,?,016FAE00), ref: 016F2DFA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: e3d5460362d7a89b4d7fc2c6ab63bee15c119e670aa951fe22f235ff395d8703
                                                                                                                    • Instruction ID: 531615a4ab58a55fdb606e5f41427efcf994ec39f82a25a4c571eda4161b3cab
                                                                                                                    • Opcode Fuzzy Hash: e3d5460362d7a89b4d7fc2c6ab63bee15c119e670aa951fe22f235ff395d8703
                                                                                                                    • Instruction Fuzzy Hash: 3090027160590493D21271584504707404997D0241F95C422A04245ACDD6568B92A222
                                                                                                                    Function 016F2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 15 16f2dd0-16f2ddc LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(017091A3,00000000,00000000,?,?,?,016B8A1A,0178C2B0,00000018,016A8873), ref: 016F2DDA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 07a08c25a8c8814080c8cd08dc0073c37a196c37b9c63bdebc8609d2abdd3ccd
                                                                                                                    • Instruction ID: 50085cc9d3bf30bf361638b683272a878c5a5979fd5cfbb549ac5498ca07fa17
                                                                                                                    • Opcode Fuzzy Hash: 07a08c25a8c8814080c8cd08dc0073c37a196c37b9c63bdebc8609d2abdd3ccd
                                                                                                                    • Instruction Fuzzy Hash: 73900261646941D25646B15844045078046A7E0241795C022A14149A4CC5269A96D722
                                                                                                                    Function 016F2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 11 16f2c70-16f2c7c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(016AFB34,000000FF,?,-00000018,?,00000000,00004000,00000000,?,?,01707BE5,00001000,00004000,000000FF,?,00000000), ref: 016F2C7A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ed350a60fe868cdc9cfcb9f4cc66f7fe78d09855a76007f3494e4c06e1d7143a
                                                                                                                    • Instruction ID: 1ed1285e819e9cf34cc02a8c74e7440d302d3df904a94a453ac2a0bd3b0b3884
                                                                                                                    • Opcode Fuzzy Hash: ed350a60fe868cdc9cfcb9f4cc66f7fe78d09855a76007f3494e4c06e1d7143a
                                                                                                                    • Instruction Fuzzy Hash: 7790027160598882D2117158840474A404597D0301F59C421A44246ACDC6958AD17222
                                                                                                                    Function 016F2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 12 16f2ca0-16f2cac LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(016D3999,000000FA,00000001,?,00000050,?,?), ref: 016F2CAA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 1c2c0a2002cfba2f5f691b5a6fd7ec3658ebbbfdbd7a4120f844b01434b3ffa1
                                                                                                                    • Instruction ID: 67f31bd6951a539418d7a030af51d121f91ff2f828327df84d4f69ca4cf0aabd
                                                                                                                    • Opcode Fuzzy Hash: 1c2c0a2002cfba2f5f691b5a6fd7ec3658ebbbfdbd7a4120f844b01434b3ffa1
                                                                                                                    • Instruction Fuzzy Hash: 7B90027160590482D20175985408646404597E0301F55D021A50245A9EC6658AD16232
                                                                                                                    Function 016F2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 19 16f2f30-16f2f3c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0173B4E6,00000004,000F0007,C0000001,?,00000004,08000000,00000000,00000000,00000000,00000000,00000058), ref: 016F2F3A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 69c6ab61b401eff7525adbc9460e9116594b991a5a925e4b1304c4694ad9e57a
                                                                                                                    • Instruction ID: 82279ec4145fa7e43d72dca620af9445d0439af735af77b4a7f9a94d3d327b14
                                                                                                                    • Opcode Fuzzy Hash: 69c6ab61b401eff7525adbc9460e9116594b991a5a925e4b1304c4694ad9e57a
                                                                                                                    • Instruction Fuzzy Hash: B29002A1745904C2D20171584414B064045D7E1301F55C025E10645A8DC619CE926227
                                                                                                                    Function 016F2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(016F17E5,00000001,C0100080,00000018,?,00000000,00000080,00000005,000000FE,00000068,00000000,00000000,?,00000000,00000000,?), ref: 016F2FEA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ac38c27a85515f21edd33839486a88e1c0363666e746dffa5e9872c961409dee
                                                                                                                    • Instruction ID: 7e7ecef83b65812855ee01ff89e6e7bbaa8a02b1e667a0bfc52d34eac94ef606
                                                                                                                    • Opcode Fuzzy Hash: ac38c27a85515f21edd33839486a88e1c0363666e746dffa5e9872c961409dee
                                                                                                                    • Instruction Fuzzy Hash: 54900261615D00C2D30175684C14B07404597D0303F55C125A01545A8CC9158AA15622
                                                                                                                    Function 016F2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(016F05E3,00000000,00000000,00000001,00000000,00000000,00000000,?,016F2380,016F03B6,00000000,00000000,?,00000000,?), ref: 016F2FBA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 3ee23fc68916e4635958e57d0dc4f8c6b24196e5f2aed283b3618719d886ec02
                                                                                                                    • Instruction ID: fed207c869ca3838545dd06613b6e846ad3e793452c31a5bfd6c0a2fe30fb2cf
                                                                                                                    • Opcode Fuzzy Hash: 3ee23fc68916e4635958e57d0dc4f8c6b24196e5f2aed283b3618719d886ec02
                                                                                                                    • Instruction Fuzzy Hash: 80900261A05900C24241716888449068045BBE1211755C131A09985A4DC5598AA55766
                                                                                                                    Function 016F2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 20 16f2f90-16f2f9c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0172CF47,000000FF,?,?,00000000,?,00000000,?,?), ref: 016F2F9A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 915baea17b64359a1911a2f3ea63ee645d6b7baf5daeddd905d49ab5fde6de0a
                                                                                                                    • Instruction ID: c4ea6913189d35e75657156598d583949916064ae197a4d8ba9a97e059d6916a
                                                                                                                    • Opcode Fuzzy Hash: 915baea17b64359a1911a2f3ea63ee645d6b7baf5daeddd905d49ab5fde6de0a
                                                                                                                    • Instruction Fuzzy Hash: 35900271605D0482D2017158481470B404597D0302F55C021A11645A9DC6258A916672
                                                                                                                    Function 016F2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 18 16f2ea0-16f2eac LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(01711B8A,?,00000000,00000001,00000010,00000000,00000000,000000FE,00000005,?,00000004,?,00000004,?,00000002,?), ref: 016F2EAA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 147d69b3cd9de16168547194ac8c3664b746cc8199d9a4118958a795361f2ecb
                                                                                                                    • Instruction ID: dbf0ecec2b5c2371fd992b721415faeabb7e384876bca36b73782f5a358d8564
                                                                                                                    • Opcode Fuzzy Hash: 147d69b3cd9de16168547194ac8c3664b746cc8199d9a4118958a795361f2ecb
                                                                                                                    • Instruction Fuzzy Hash: BD9002B160590482D24171584404746404597D0301F55C021A50645A8EC6598FD56766
                                                                                                                    Function 016F2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 17 16f2e80-16f2e8c LdrInitializeThunk
                                                                                                                    APIs
                                                                                                                    • LdrInitializeThunk.NTDLL(0173809B,?,?,?,?,?), ref: 016F2E8A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 49cfe5974ab38c4fc2838453afdd2f5f24011305575a26a3d6349019eca114c2
                                                                                                                    • Instruction ID: 71908aca904e7f22f6e5d567c107199485844b128b0c02f77b9b434b053cb5eb
                                                                                                                    • Opcode Fuzzy Hash: 49cfe5974ab38c4fc2838453afdd2f5f24011305575a26a3d6349019eca114c2
                                                                                                                    • Instruction Fuzzy Hash: 50900261A0590582D20271584404616404A97D0241F95C032A10245A9ECA258BD2A232
                                                                                                                    Function 0041F0C9 Relevance: .0, Instructions: 11COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2183404585.000000000041F000.00000040.00000400.00020000.00000000.sdmp, Offset: 0041F000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_41f000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 860c6c292330ed9701495fd1c740c0e76179173b83d900957f45c574397d5bf4
                                                                                                                    • Instruction ID: 1ab65c22e78c82588381bfe4b6ce12795e7c96d766b948bdcd15bf1f27b74f1c
                                                                                                                    • Opcode Fuzzy Hash: 860c6c292330ed9701495fd1c740c0e76179173b83d900957f45c574397d5bf4
                                                                                                                    • Instruction Fuzzy Hash: FBB0927190520C2B842035BE9A0E4A6771CD69565CB400699ED89069027E43746301E6
                                                                                                                    Function 0041F0D0 Relevance: .0, Instructions: 7COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2183404585.000000000041F000.00000040.00000400.00020000.00000000.sdmp, Offset: 0041F000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_41f000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2407458f35ca21ca506e0c24118f177990cacd1bea0c120035e7637a72cd4c26
                                                                                                                    • Instruction ID: 71cd0b4ea5b82251a8dfacf4b4f4a81eb47669f17a6830740459b1cdfa128c40
                                                                                                                    • Opcode Fuzzy Hash: 2407458f35ca21ca506e0c24118f177990cacd1bea0c120035e7637a72cd4c26
                                                                                                                    • Instruction Fuzzy Hash: C7A022A0C0830C03002030FA2B03023B30CC000028F0003EAAE8C022023C02A83200EB

                                                                                                                    Non-executed Functions

                                                                                                                    Function 01734755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    • LdrpCheckRedirection, xrefs: 0173488F
                                                                                                                    • minkernel\ntdll\ldrredirect.c, xrefs: 01734899
                                                                                                                    • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01734888
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                                                                                    • API String ID: 3446177414-3154609507
                                                                                                                    • Opcode ID: 10081ebfc816d779745c65bd8e56cfd45fe9d916f6e9811433d32e72dd45b265
                                                                                                                    • Instruction ID: 72d6991f9b74d4f998a062f5cdea0a6f3278a2b9a88515384d17ac2d675297e9
                                                                                                                    • Opcode Fuzzy Hash: 10081ebfc816d779745c65bd8e56cfd45fe9d916f6e9811433d32e72dd45b265
                                                                                                                    • Instruction Fuzzy Hash: EB41D132A542619FCB2ACF28D840A66FBE5EFC9750F0506A9ED4A97313D730D800CB91
                                                                                                                    Function 016F096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 016F2DF0: LdrInitializeThunk.NTDLL(0172E73E,0000005A,0178D040,00000020,00000000,0178D040,00000080,01714A81,00000000,?,?,00000002,00000000,?,?,016FAE00), ref: 016F2DFA
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016F0BA3
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016F0BB6
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016F0D60
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016F0D74
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1404860816-0
                                                                                                                    • Opcode ID: e8f5fe306a51438cef1de379fcd7b4c581649a62d135f26cc29a3869ffc276ba
                                                                                                                    • Instruction ID: d6c12b0fd712b6b4a7bb2838e3aa4a1631047470c4832059b6568d23c5e7b013
                                                                                                                    • Opcode Fuzzy Hash: e8f5fe306a51438cef1de379fcd7b4c581649a62d135f26cc29a3869ffc276ba
                                                                                                                    • Instruction Fuzzy Hash: 44423A71900715DFDB21CF68C880BAAB7F5FF44314F1445ADEA89AB242E770AA85CF60
                                                                                                                    Function 016BEA80 Relevance: 6.1, Strings: 4, Instructions: 1073COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $R$T${
                                                                                                                    • API String ID: 0-4276472446
                                                                                                                    • Opcode ID: c7350ab773b3e05fead83eb0b8445580ee3c5597df80f27343d94976a4f42513
                                                                                                                    • Instruction ID: 1832f3da20beb91132160ff57333f8cc02def8bb6532217b2dfbbc1aba60648b
                                                                                                                    • Opcode Fuzzy Hash: c7350ab773b3e05fead83eb0b8445580ee3c5597df80f27343d94976a4f42513
                                                                                                                    • Instruction Fuzzy Hash: 2EA23674A0562A8FDB64CF29CC887E9BBB5AF45304F1442E9D90AA7365DB319EC1CF40
                                                                                                                    Function 016E4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 0$Flst
                                                                                                                    • API String ID: 0-758220159
                                                                                                                    • Opcode ID: 158a9c674a0a5e5d110e20bc2f92cbba658f4eed4388ad897dabd7a3b65c701f
                                                                                                                    • Instruction ID: f08a29ac195c727b5bf8c6765b678f8f61bf21d27e680520d399b3fafe784876
                                                                                                                    • Opcode Fuzzy Hash: 158a9c674a0a5e5d110e20bc2f92cbba658f4eed4388ad897dabd7a3b65c701f
                                                                                                                    • Instruction Fuzzy Hash: 28518CB2E01214CBDF26CFA9C888669FBF5FF84714F14812ED149DB251EB759986CB80
                                                                                                                    Function 01734F40 Relevance: 5.2, Strings: 4, Instructions: 246COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .DLL$.Local$/$\
                                                                                                                    • API String ID: 0-80926707
                                                                                                                    • Opcode ID: 270cbb45609dc402c573fe467f0e46cde9a616bef18c24ebe637e354ca75ddac
                                                                                                                    • Instruction ID: 3bd45c813f6b5a080f9b32816435b10b24aadcb9f8f2acf33b87b3fdf8240084
                                                                                                                    • Opcode Fuzzy Hash: 270cbb45609dc402c573fe467f0e46cde9a616bef18c24ebe637e354ca75ddac
                                                                                                                    • Instruction Fuzzy Hash: 0E91B172D0061A8BCB25CFACC880AAEF7B5FF88310F5941A9E911E7351D735D901CB91
                                                                                                                    Function 016CAD00 Relevance: 4.3, Strings: 3, Instructions: 509COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    • minkernel\ntdll\ldrutil.c, xrefs: 017180B7
                                                                                                                    • LdrpInitializeDllPath, xrefs: 017180AD
                                                                                                                    • DLL search path passed in externally: %ws, xrefs: 017180A6
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: DLL search path passed in externally: %ws$LdrpInitializeDllPath$minkernel\ntdll\ldrutil.c
                                                                                                                    • API String ID: 0-109579469
                                                                                                                    • Opcode ID: 6c3537694a19b0c140f393734e2d443c4e9f129d15a77fb12def323fd1a7238f
                                                                                                                    • Instruction ID: af575d7cd33bb50f46ed16bed7d1855b2984f862a5f681985a54cd94eeeb3eac
                                                                                                                    • Opcode Fuzzy Hash: 6c3537694a19b0c140f393734e2d443c4e9f129d15a77fb12def323fd1a7238f
                                                                                                                    • Instruction Fuzzy Hash: 2212EE71A093468BD321DF68CC81BBAB7E5FF84B14F084A1DF9858B291E730D945CB92
                                                                                                                    Function 016D6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID: $@
                                                                                                                    • API String ID: 2994545307-1077428164
                                                                                                                    • Opcode ID: 079c1de373d3435dab6d45fb258b1840381deb96083832fdfe99d55c13aa5fd4
                                                                                                                    • Instruction ID: bcb4e456941b9ff4d117f6a0da1ba461817242cc42f977c481447dc101f573cf
                                                                                                                    • Opcode Fuzzy Hash: 079c1de373d3435dab6d45fb258b1840381deb96083832fdfe99d55c13aa5fd4
                                                                                                                    • Instruction Fuzzy Hash: 3AC28F71A083419FD726CF69C881BABBBE5AF88718F04892DF989C7341D774D845CB92
                                                                                                                    Function 016B04E5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: kLsE
                                                                                                                    • API String ID: 3446177414-3058123920
                                                                                                                    • Opcode ID: ac226920c1f774c23da80b1c8802c82c123966d4783e242b4d3296f3c12e6de0
                                                                                                                    • Instruction ID: 22da41da0b8912bc80ef51ce427f37b1cfd4c0bba76a27beb98a068b6aa164ae
                                                                                                                    • Opcode Fuzzy Hash: ac226920c1f774c23da80b1c8802c82c123966d4783e242b4d3296f3c12e6de0
                                                                                                                    • Instruction Fuzzy Hash: DA51AE725047428BD724DF68C9806E7BBF8AF84304F10893EF69A87641E770E585CB91
                                                                                                                    Function 01732349 Relevance: 3.6, Strings: 2, Instructions: 1117COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: @$@
                                                                                                                    • API String ID: 0-149943524
                                                                                                                    • Opcode ID: 659159885575e7c8965b708de4c7b3ff58e761cb3ae79e694372e005220edcb9
                                                                                                                    • Instruction ID: eb2a56bdb9e0ba094372d07ffeb0c477d6ae2757bef85862ddba78602c3654be
                                                                                                                    • Opcode Fuzzy Hash: 659159885575e7c8965b708de4c7b3ff58e761cb3ae79e694372e005220edcb9
                                                                                                                    • Instruction Fuzzy Hash: 08928A71608342ABE721CE28CC84B6BFBE9BBC4754F04492DFA95D7252D770E844CB96
                                                                                                                    Function 016E4D1D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: minkernel\ntdll\ldrsnap.c
                                                                                                                    • API String ID: 3446177414-3711822496
                                                                                                                    • Opcode ID: 0042b7935ca577d42d0cd0fde00efacfacc411de1e8a1969f65757a2a37ff0a2
                                                                                                                    • Instruction ID: 8fc42681705da6158e8efa1c109f3b5c926931f20ca4eca50535d078e0cff653
                                                                                                                    • Opcode Fuzzy Hash: 0042b7935ca577d42d0cd0fde00efacfacc411de1e8a1969f65757a2a37ff0a2
                                                                                                                    • Instruction Fuzzy Hash: 73310733902221DBDF329A2CCC4CA75B6E4BB41664F06422AE609D7351DFA69C808785
                                                                                                                    Function 016E2CF0 Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .Local\$@
                                                                                                                    • API String ID: 0-380025441
                                                                                                                    • Opcode ID: 1162c1300686df3d944c9a477ddb5c29820bee41b21df2445a1765fea0f8bc05
                                                                                                                    • Instruction ID: efae45166fe183d2788f461186e8933cbb2ce195266597564a92b2708991f7fd
                                                                                                                    • Opcode Fuzzy Hash: 1162c1300686df3d944c9a477ddb5c29820bee41b21df2445a1765fea0f8bc05
                                                                                                                    • Instruction Fuzzy Hash: AF81E1725093029FDB11CF18C8A4A6BBBE9EF95700F048A5DFA85CB346D771D904CBA2
                                                                                                                    Function 016B6A50 Relevance: 2.0, APIs: 1, Instructions: 548COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0916d72978c147d1d037ef5a37212e10ce2202b939c9ed1f953f40792f6e8297
                                                                                                                    • Instruction ID: bf7bbadb4457c8ecaa6aec3649fa8bc76dad28b41eb32e146e9b3708b748c968
                                                                                                                    • Opcode Fuzzy Hash: 0916d72978c147d1d037ef5a37212e10ce2202b939c9ed1f953f40792f6e8297
                                                                                                                    • Instruction Fuzzy Hash: F4327B71A05215CFDB25CF6CC880BAABBF1FF48310F548569EA56AB395D734E882CB50
                                                                                                                    Function 016C0770 Relevance: 1.9, APIs: 1, Instructions: 414COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5acb70d332f7ebf2807618205259670e749cc915a2e966a28eef0d914a29e25e
                                                                                                                    • Instruction ID: 033e1bea7641a58d4fde18b5882311c12eb4f78a0ca69261baf44d72b3116387
                                                                                                                    • Opcode Fuzzy Hash: 5acb70d332f7ebf2807618205259670e749cc915a2e966a28eef0d914a29e25e
                                                                                                                    • Instruction Fuzzy Hash: DFF1AB75A00606DFEB29CF6CC894BBAB7B5FB85B04F14816CE5169B385D730E981CB90
                                                                                                                    Function 016BCC74 Relevance: 1.9, Strings: 1, Instructions: 607COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 9
                                                                                                                    • API String ID: 0-2473173378
                                                                                                                    • Opcode ID: f65521398eb5b9c4dc25ab7c53261cb905daab21876b6a8f53da08530940f332
                                                                                                                    • Instruction ID: f114697f41a9eb210c4f8b863f9be9c7e081c6cba21c73d163fce72e26d92305
                                                                                                                    • Opcode Fuzzy Hash: f65521398eb5b9c4dc25ab7c53261cb905daab21876b6a8f53da08530940f332
                                                                                                                    • Instruction Fuzzy Hash: 71424675E012588FEB25CFA8C8C0BEDBBB1BF48354F148169E919AB351D734AD82CB54
                                                                                                                    Function 016DE5E7 Relevance: 1.8, APIs: 1, Instructions: 278COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e0a7908f2262a720f641075b88dcc339e2dfbae985cf82a13b28296d399df2a4
                                                                                                                    • Instruction ID: 45f083d2dd516e82304638b189c45aa1a13141af4ae27d7a986723355f816090
                                                                                                                    • Opcode Fuzzy Hash: e0a7908f2262a720f641075b88dcc339e2dfbae985cf82a13b28296d399df2a4
                                                                                                                    • Instruction Fuzzy Hash: 1EA13531E006699FEB22DFACCC48BAEBBB5BB01714F050159EA10AB2C5D774AD45CBD1
                                                                                                                    Function 016BAF42 Relevance: 1.7, Strings: 1, Instructions: 457COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: #
                                                                                                                    • API String ID: 0-1885708031
                                                                                                                    • Opcode ID: 53139dadbe123e5d7a6a0c3865e6308a4e034fe7b0c68cf12bc90e21b01765a0
                                                                                                                    • Instruction ID: f99253e4997754dc2fedcbb365d37aaf3cce6ed543b5529556f3863f27dc9422
                                                                                                                    • Opcode Fuzzy Hash: 53139dadbe123e5d7a6a0c3865e6308a4e034fe7b0c68cf12bc90e21b01765a0
                                                                                                                    • Instruction Fuzzy Hash: E9029D75A002698BEF328A18CCD4BFEB7B9BF44350F1441EAD949A7251DB719EC28F44
                                                                                                                    Function 016ECDB1 Relevance: 1.7, APIs: 1, Instructions: 197timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: ba5b8791948144a480941f63d0f25e8533867635e2ddf104bdf183cefb716b32
                                                                                                                    • Instruction ID: ff5cf636599555d6401907b7d8af4072fdfa6476afb0460f041bd23acde4b9bc
                                                                                                                    • Opcode Fuzzy Hash: ba5b8791948144a480941f63d0f25e8533867635e2ddf104bdf183cefb716b32
                                                                                                                    • Instruction Fuzzy Hash: DE61DD71A01216DFCB19DF68C894AAEB7F5FF48314F10826DE612EB291DB329902CB55
                                                                                                                    Function 016C03E9 Relevance: 1.7, APIs: 1, Instructions: 184COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ___swprintf_l
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 48624451-0
                                                                                                                    • Opcode ID: 7d01af52474d547facabaf5951394d8b180d882bcda1f19c7e5210f7251f0292
                                                                                                                    • Instruction ID: be26209dbee873d6587370949c56be14760426c96e0b039b39383244a3d3f7ac
                                                                                                                    • Opcode Fuzzy Hash: 7d01af52474d547facabaf5951394d8b180d882bcda1f19c7e5210f7251f0292
                                                                                                                    • Instruction Fuzzy Hash: 12712772A0014ADFDB05DFA8C994BAEBBF8FF48704F144069E905E7255EB34AD41CBA4
                                                                                                                    Function 016E29F9 Relevance: 1.7, Strings: 1, Instructions: 411COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 0-2766056989
                                                                                                                    • Opcode ID: 225cb95fb7a7a35b9235e46769957073d282bdd9d436988398b863e9db386743
                                                                                                                    • Instruction ID: 4ecfcb9be4fd078a1cdd2488338dda62af11aa4f208d69bbdeb7e0d7dadf1699
                                                                                                                    • Opcode Fuzzy Hash: 225cb95fb7a7a35b9235e46769957073d282bdd9d436988398b863e9db386743
                                                                                                                    • Instruction Fuzzy Hash: 1D029FB1D012299BDB71DB54CC84BAAF7B9AF44704F0041DEE609A7242EB30AF95CF59
                                                                                                                    Function 016D0C44 Relevance: 1.7, APIs: 1, Instructions: 152timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: 22380424803cd492c437cbd9f638e853d1f4796426d5196db0707006868affb7
                                                                                                                    • Instruction ID: 53b0d95f77a2d82e5d7715eb36ad4bd549ca8485775a9c2d70259ce639a25816
                                                                                                                    • Opcode Fuzzy Hash: 22380424803cd492c437cbd9f638e853d1f4796426d5196db0707006868affb7
                                                                                                                    • Instruction Fuzzy Hash: A651BE74A00206DFDB24DF6CCD81ABEB7F5EF88614F54806DE90697255E631AA42CB50
                                                                                                                    Function 016EC720 Relevance: 1.6, APIs: 1, Instructions: 141timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: e5947d11862079e262f5e90727ddb6d10893d6eb0c081dfe7b41e7c01d9b6cd3
                                                                                                                    • Instruction ID: 0ffc5f8970d3ef4761b7157fd220cee3c019c7e289d713622ffe0b5c997d8b62
                                                                                                                    • Opcode Fuzzy Hash: e5947d11862079e262f5e90727ddb6d10893d6eb0c081dfe7b41e7c01d9b6cd3
                                                                                                                    • Instruction Fuzzy Hash: 2F412771545311ABCB20EF68DC44B6BBBE8EF95760F44862EF945D3290E770D800CB95
                                                                                                                    Function 016DEBFC Relevance: 1.6, APIs: 1, Instructions: 138COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 90a0393540d074a22b45805293aa3675bc95683385c65a882efea4fab8f909f0
                                                                                                                    • Instruction ID: 25c5141179b786c581d8dec61a02d628c7cbd986f89584a2b70ea24d37558d08
                                                                                                                    • Opcode Fuzzy Hash: 90a0393540d074a22b45805293aa3675bc95683385c65a882efea4fab8f909f0
                                                                                                                    • Instruction Fuzzy Hash: 9E41D4726043019FD724DF28CC94A2BB7E6FF88224F44482DE9A7CB715DB32E8498B54
                                                                                                                    Function 016A64BA Relevance: 1.6, APIs: 1, Instructions: 123timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: 312b28df9feaa4eca278b913a8f0b5cf569f940440473333483b7450114b63c1
                                                                                                                    • Instruction ID: 178247c8e5c6c9d8dccd8ee69294c1f651fe5aa77a3133dcdae53d742db2e413
                                                                                                                    • Opcode Fuzzy Hash: 312b28df9feaa4eca278b913a8f0b5cf569f940440473333483b7450114b63c1
                                                                                                                    • Instruction Fuzzy Hash: 8341D5B1208301EFDB21DE24DC91BABB7E9FB84A58F84451DEA8A67195D630ED40CB52
                                                                                                                    Function 016B262C Relevance: 1.6, APIs: 1, Instructions: 119timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: eec286eb88d6e748f9c5ef320291de058e332b0df6bc0ad0ebfb769849859215
                                                                                                                    • Instruction ID: 952846efa7dc5b27d0d58f46dece626b4095f57c3792cfa3a15f6093124c6128
                                                                                                                    • Opcode Fuzzy Hash: eec286eb88d6e748f9c5ef320291de058e332b0df6bc0ad0ebfb769849859215
                                                                                                                    • Instruction Fuzzy Hash: 914192B1501705CFCB22EF28CD907A9B7F6FF98710F1482ADD5169B2A1EB30A981CB55
                                                                                                                    Function 017307C3 Relevance: 1.6, APIs: 1, Instructions: 114timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: 631dea9a7c388bceabf7462c8658492eeb99c8faf9ad29fdc12c880dc57fef85
                                                                                                                    • Instruction ID: 5ecf158d2b7f5fd0d877382eb93c6d7c71991de25c2c5e03919bc7928087d150
                                                                                                                    • Opcode Fuzzy Hash: 631dea9a7c388bceabf7462c8658492eeb99c8faf9ad29fdc12c880dc57fef85
                                                                                                                    • Instruction Fuzzy Hash: D7419CB25043059FD720DF28C844B9BFBE8FF88624F008A2EF998C7251D7309804CB92
                                                                                                                    Function 016D245A Relevance: 1.6, APIs: 1, Instructions: 111COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9a041617e4caa74057aa23256386b460e21d33434451052f21e0f41c7ede66c8
                                                                                                                    • Instruction ID: 564d5db3b6d0590504a640fed0fd963e68a12ae6a886b8ec9336304cbbf2164c
                                                                                                                    • Opcode Fuzzy Hash: 9a041617e4caa74057aa23256386b460e21d33434451052f21e0f41c7ede66c8
                                                                                                                    • Instruction Fuzzy Hash: 4C314872A41242EBDB319F5DCC85AAAFBB9FBC0B20F55805DF9016B249C7705981CB80
                                                                                                                    Function 016B4859 Relevance: 1.6, APIs: 1, Instructions: 111timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: c92a4a1b30ae6fecedc3c67b3b1fa679dd4f693901454aec590dc089a636c568
                                                                                                                    • Instruction ID: 755c4d86f14dd4638de5335fd2e7dcc27a54dd3294e48a5a0628f03c6ab919f6
                                                                                                                    • Opcode Fuzzy Hash: c92a4a1b30ae6fecedc3c67b3b1fa679dd4f693901454aec590dc089a636c568
                                                                                                                    • Instruction Fuzzy Hash: BA41A2302043019BD725EF18DCD4BAABBEAEF80764F14442DEA568B392DF30D991CB91
                                                                                                                    Function 016A8A00 Relevance: 1.6, APIs: 1, Instructions: 85timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: 6052de595f80133ee7554efd8d0fd4959793d6305326f92259d7720bfcd4ee19
                                                                                                                    • Instruction ID: d5ebece6dbd7277c169759e694b5a03e5759373511d7bb5a3fc13bd2809f5690
                                                                                                                    • Opcode Fuzzy Hash: 6052de595f80133ee7554efd8d0fd4959793d6305326f92259d7720bfcd4ee19
                                                                                                                    • Instruction Fuzzy Hash: 4F31EEB6600B06EFCB26DF64D950BADB7B1FF48310F044159EA0253691C735AD90CBA1
                                                                                                                    Function 0173892A Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 81f649ef79e44749200025a9ab307cca47eaf25864d28d37dbbdcc869392a63e
                                                                                                                    • Instruction ID: 3b2be471ed6873d55ef973e26fdc849d903f05cab8a218a6f8f055d06c667991
                                                                                                                    • Opcode Fuzzy Hash: 81f649ef79e44749200025a9ab307cca47eaf25864d28d37dbbdcc869392a63e
                                                                                                                    • Instruction Fuzzy Hash: 0D0126722082019BE7246F59DCC4AAAFB79EFC1264B44022CF7821A193CB70AC81C797
                                                                                                                    Function 0173A4B0 Relevance: 1.5, APIs: 1, Instructions: 40timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: e0d6bf0029c226595e28cbe5008bb7ea2d6c121798a4e5d7882c47eedcf389a0
                                                                                                                    • Instruction ID: a82136c0047ad1429ff51d950cc7146ed026d22b191dde918963b556c5a8a8a6
                                                                                                                    • Opcode Fuzzy Hash: e0d6bf0029c226595e28cbe5008bb7ea2d6c121798a4e5d7882c47eedcf389a0
                                                                                                                    • Instruction Fuzzy Hash: 3F01853610020DABCF129F84D841EDA7F66FB8C6A4F068101FE19A6261C332E970EB81
                                                                                                                    Function 01738D20 Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: 0c17ee9e61413374799e2b0cc37e2da5efcc6b1e42e3eb2366554336136a2ccc
                                                                                                                    • Instruction ID: 309642f080fb5fd279a075389b781d4042c60968319d264a66325dc429a74aa1
                                                                                                                    • Opcode Fuzzy Hash: 0c17ee9e61413374799e2b0cc37e2da5efcc6b1e42e3eb2366554336136a2ccc
                                                                                                                    • Instruction Fuzzy Hash: 23F0B4725182446BD7216A1CEC88BDAFB6DFBD8720F894629F949271A286306CC0C780
                                                                                                                    Function 01736420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 0-3916222277
                                                                                                                    • Opcode ID: 7e0c6b13b4397c65c441868c7ed629992df46d7566727ded3c484900db417e4d
                                                                                                                    • Instruction ID: f366a52606609cda2cb1e327bad53efdbf76f481a999a779c30e79d4f0d7133d
                                                                                                                    • Opcode Fuzzy Hash: 7e0c6b13b4397c65c441868c7ed629992df46d7566727ded3c484900db417e4d
                                                                                                                    • Instruction Fuzzy Hash: AF9174B1900219BFEB21DF95CC85FAEBBB9EF58B50F154069F600AB191D774AD00CB64
                                                                                                                    Function 016E8402 Relevance: 1.5, Strings: 1, Instructions: 263COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 0-2766056989
                                                                                                                    • Opcode ID: 98684454559e146f71f55b4df8b5bb9b3211ffbc7fc8efa554d66add91859106
                                                                                                                    • Instruction ID: 214b880b4cbaac5c4b46be2291b6279773d1bc683873127a957d9e57ae620e9f
                                                                                                                    • Opcode Fuzzy Hash: 98684454559e146f71f55b4df8b5bb9b3211ffbc7fc8efa554d66add91859106
                                                                                                                    • Instruction Fuzzy Hash: E9919871509345AFD722EF65CC84EABBAEDFF88644F400A2EFA8493151E730D9058B66
                                                                                                                    Function 016E273C Relevance: 1.5, Strings: 1, Instructions: 249COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .Local
                                                                                                                    • API String ID: 0-5346580
                                                                                                                    • Opcode ID: 3d9dbbd908ad535f881915302ef2559230e57a1041b0a73be5b94ca0fbb70cde
                                                                                                                    • Instruction ID: 23bf8d4f8b8b38a29686d1848007d6ae6450baf4b29fd03471c5f2a8a740c596
                                                                                                                    • Opcode Fuzzy Hash: 3d9dbbd908ad535f881915302ef2559230e57a1041b0a73be5b94ca0fbb70cde
                                                                                                                    • Instruction Fuzzy Hash: 6BA1BF319012299BDB24CF59CC98BA9B3FABF59314F2542EDD908AB351D7309E81CF94
                                                                                                                    Function 016AA197 Relevance: 1.5, Strings: 1, Instructions: 238COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: \??\
                                                                                                                    • API String ID: 0-3047946824
                                                                                                                    • Opcode ID: ed6e6b34368243f55a886ee1970de1cc9d3bf94a5b7514420432a3dcaee1b55b
                                                                                                                    • Instruction ID: a0ec26698fdad7b8b80ed843e30e43ab958266f6e7e473b64d5808ccb0eaf408
                                                                                                                    • Opcode Fuzzy Hash: ed6e6b34368243f55a886ee1970de1cc9d3bf94a5b7514420432a3dcaee1b55b
                                                                                                                    • Instruction Fuzzy Hash: 03A17E719112299BDB32DF64CC88BAAF7B8FF44700F1141EAEA09A7250D7359E84CF54
                                                                                                                    Function 016E8620 Relevance: 1.5, Strings: 1, Instructions: 223COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 8
                                                                                                                    • API String ID: 0-4194326291
                                                                                                                    • Opcode ID: 864b8a8c6012b534d38724164a8adadc72e9e4509340b22ab08652a3fe704b83
                                                                                                                    • Instruction ID: 8e68d8ffa3f4f88ea9b12d5125dc7ab2bbb7c8c3e9c48a40f3e364c749523f1d
                                                                                                                    • Opcode Fuzzy Hash: 864b8a8c6012b534d38724164a8adadc72e9e4509340b22ab08652a3fe704b83
                                                                                                                    • Instruction Fuzzy Hash: B1818AB1A01368AFDF20CF9ACC45BAEBBB9EB49B14F204159F505B7241D375A941CBA0
                                                                                                                    Function 016E8BF0 Relevance: 1.5, Strings: 1, Instructions: 217COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: (
                                                                                                                    • API String ID: 0-3887548279
                                                                                                                    • Opcode ID: f44babff4afe37fb1ec43c6b335942e43ce3bb6fed486c6fd7b88854ebbca907
                                                                                                                    • Instruction ID: 5a98f4b00a0fc1306150cad1a9c8cf8a8dbd693cdf850d91c951aeb085a0cbd1
                                                                                                                    • Opcode Fuzzy Hash: f44babff4afe37fb1ec43c6b335942e43ce3bb6fed486c6fd7b88854ebbca907
                                                                                                                    • Instruction Fuzzy Hash: DD916871D01649CFDB11CFA8C884ADEBBF6BF59310F20426AE816AB391D771A942CF54
                                                                                                                    Function 016C2F7B Relevance: 1.5, Strings: 1, Instructions: 204COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 0-3916222277
                                                                                                                    • Opcode ID: 5bfa7ea05fd26f989555a058eb3e63978f28bb62ef15378fc7e05bff7c46014e
                                                                                                                    • Instruction ID: b44be3848afa179f39a77c01c103cd0101f100b8c7607096421e52b0f2d9373c
                                                                                                                    • Opcode Fuzzy Hash: 5bfa7ea05fd26f989555a058eb3e63978f28bb62ef15378fc7e05bff7c46014e
                                                                                                                    • Instruction Fuzzy Hash: 1C919931A002489FDB26CF68D884BBCBBB1FF45B10F18C06DE95AAB752D735A940CB50
                                                                                                                    Function 016C2F47 Relevance: 1.4, Strings: 1, Instructions: 190COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 0-3916222277
                                                                                                                    • Opcode ID: 5071983af1a9341326bf2895fee2c806ed7677bcaa648f88fb8516154092abc2
                                                                                                                    • Instruction ID: 3af47c8a5efe1da0e9fbe55a288df8ec6116d55e516bcafb5b255ec456b61df1
                                                                                                                    • Opcode Fuzzy Hash: 5071983af1a9341326bf2895fee2c806ed7677bcaa648f88fb8516154092abc2
                                                                                                                    • Instruction Fuzzy Hash: F6817931A042889FDB26CF68D884BBCBBB1FF45B10F18C06DE956AB752D735A941CB50
                                                                                                                    Function 016C2F72 Relevance: 1.4, Strings: 1, Instructions: 186COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 0-3916222277
                                                                                                                    • Opcode ID: 2544c7929e984f2c01f8f60cfa2ec6f30b55b4fcf92246f55ff08ececd3a6de6
                                                                                                                    • Instruction ID: 1662bb158f3db2b0477dbdbfa53c006d958e6269c7e70afad12b354de59408ea
                                                                                                                    • Opcode Fuzzy Hash: 2544c7929e984f2c01f8f60cfa2ec6f30b55b4fcf92246f55ff08ececd3a6de6
                                                                                                                    • Instruction Fuzzy Hash: 2A818B31A042889FDB26CF68D884BBCBBB1FF45B10F18C06DE956AB752D735A941CB50
                                                                                                                    Function 016C2A45 Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: u)j
                                                                                                                    • API String ID: 0-1146774532
                                                                                                                    • Opcode ID: 5e7a945185624cdc28d8a2ada0edb9702c4b2533a8b3ebb4cb467abac4946d0d
                                                                                                                    • Instruction ID: 48bba18b159f6d76cfedb76ac1a53eb9db3d728ffc67ae43ec0c725aa35a2aa7
                                                                                                                    • Opcode Fuzzy Hash: 5e7a945185624cdc28d8a2ada0edb9702c4b2533a8b3ebb4cb467abac4946d0d
                                                                                                                    • Instruction Fuzzy Hash: 95510372A046158FEB25CF5DCCA47BABBB1FB44B14F14405EED059B391D336A842CBA0
                                                                                                                    Function 016ACCC8 Relevance: 1.4, Strings: 1, Instructions: 164COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 0-2766056989
                                                                                                                    • Opcode ID: 2d9c1900cafe748ce042677f68c995bbe9e9fb4f146742af40b983182b34e94a
                                                                                                                    • Instruction ID: fe0f65e8267ce51e15670c123389b05b740d1061e06aaf6ad692178da31b6bc9
                                                                                                                    • Opcode Fuzzy Hash: 2d9c1900cafe748ce042677f68c995bbe9e9fb4f146742af40b983182b34e94a
                                                                                                                    • Instruction Fuzzy Hash: 9551D4BA504356DBC711EF68C844B6BB7E8AF88714F46092EFA85D7240E730DD04CBA6
                                                                                                                    Function 016AA580 Relevance: 1.4, Strings: 1, Instructions: 150COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: (
                                                                                                                    • API String ID: 0-3887548279
                                                                                                                    • Opcode ID: 06160e97f67d8df696a131f0503f5f770f4e6a2e08fa7eb569bc39d9f0f4269a
                                                                                                                    • Instruction ID: 30cf0c7f4458168bc23f01c61542fc2784474d3f8dc63ac7ba575467be2f4333
                                                                                                                    • Opcode Fuzzy Hash: 06160e97f67d8df696a131f0503f5f770f4e6a2e08fa7eb569bc39d9f0f4269a
                                                                                                                    • Instruction Fuzzy Hash: 855117B0A1135ADFCB11CF98C880A9EBFF5FF08714F10826AE505A7251D774A941CF94
                                                                                                                    Function 016B2140 Relevance: 1.4, Strings: 1, Instructions: 147COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: (
                                                                                                                    • API String ID: 0-3887548279
                                                                                                                    • Opcode ID: 2ba471babd5815dfdbeaeacca77c982b0fbc42b97e90a173afe1981d6f35956f
                                                                                                                    • Instruction ID: 7edef37c01962cd6a95942213ce6b42e41279d16faf786263a82b51f0cfaf789
                                                                                                                    • Opcode Fuzzy Hash: 2ba471babd5815dfdbeaeacca77c982b0fbc42b97e90a173afe1981d6f35956f
                                                                                                                    • Instruction Fuzzy Hash: C351FAB190161AEFCB11CF99C8906DDFBF1BF08710F50862EE918E7680D375A991CBA4
                                                                                                                    Function 016C28D0 Relevance: 1.4, Strings: 1, Instructions: 147COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: twj
                                                                                                                    • API String ID: 0-1637908201
                                                                                                                    • Opcode ID: f3625bf469942756152dcb2796e9513b87949f4b81ff56e4307d83fef2b4d836
                                                                                                                    • Instruction ID: a4d340151efb2e2af9d587f84e5be3ce0501beabf1265aec6f8f0f0b9b2e63a5
                                                                                                                    • Opcode Fuzzy Hash: f3625bf469942756152dcb2796e9513b87949f4b81ff56e4307d83fef2b4d836
                                                                                                                    • Instruction Fuzzy Hash: 51518371A003459BEF25DB99CC54BBEFBB6EF80B54F24401DE9056B288DB759841CB50
                                                                                                                    Function 016EC6A6 Relevance: 1.4, Strings: 1, Instructions: 110COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: minkernel\ntdll\ldrredirect.c
                                                                                                                    • API String ID: 0-3694840737
                                                                                                                    • Opcode ID: 6824f9562a3653f70d3da842d366dd18fc097fa082b3ab33e7de8659d679fe22
                                                                                                                    • Instruction ID: 5fe22ce091e41ca08bbf4ca2f898aef24c16d6faf5ec574398d8ed4ac81fed7c
                                                                                                                    • Opcode Fuzzy Hash: 6824f9562a3653f70d3da842d366dd18fc097fa082b3ab33e7de8659d679fe22
                                                                                                                    • Instruction Fuzzy Hash: BF3104716443129BC320EF28DC4AE2BBBD5EF94B20F04065CF945AB291D620EC05CBA3
                                                                                                                    Function 01734DD7 Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    • minkernel\ntdll\ldrutil.c, xrefs: 01734E06
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: minkernel\ntdll\ldrutil.c
                                                                                                                    • API String ID: 0-4055692389
                                                                                                                    • Opcode ID: d79a156417919afcb4ce056f028e1d4554ce5d73a585394543a8c7c0825bf9d8
                                                                                                                    • Instruction ID: 5b19173d587623cad123d75d46f5636534695328b068775aad0339d24380fc9d
                                                                                                                    • Opcode Fuzzy Hash: d79a156417919afcb4ce056f028e1d4554ce5d73a585394543a8c7c0825bf9d8
                                                                                                                    • Instruction Fuzzy Hash: 42216B731C81067BE72C9A6C8C49D36FB6CFBC9A74F140108F61396656C950DE00C635
                                                                                                                    Function 016D8DBF Relevance: .6, Instructions: 554COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 26a2a57fb56c43ca389adc484d5b39ac1ef2e4605fe693f46d991364f2373123
                                                                                                                    • Instruction ID: f7fefc90fffae08720b8ed16acf8ddc96471e2c1a5bc9d7711a930416c01cb1c
                                                                                                                    • Opcode Fuzzy Hash: 26a2a57fb56c43ca389adc484d5b39ac1ef2e4605fe693f46d991364f2373123
                                                                                                                    • Instruction Fuzzy Hash: F5225E70E0021ADBCF25CF99C8849BEFBF6BF48714B54809AE945AB245E734ED41CB64
                                                                                                                    Function 016B28F0 Relevance: .4, Instructions: 446COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7578769247557b2f963bdd945ae9d9e48cae786aede34c6f50fa7aa73d7b5b8b
                                                                                                                    • Instruction ID: 085f2d7db8b801b5afb4ef1d29329121b49ac8e542908e4469fd803274b405e9
                                                                                                                    • Opcode Fuzzy Hash: 7578769247557b2f963bdd945ae9d9e48cae786aede34c6f50fa7aa73d7b5b8b
                                                                                                                    • Instruction Fuzzy Hash: EDF1E3716083518BE725CF29CCA07ABBBE1BFC4750F08892DE98587391D775E885CB92
                                                                                                                    Function 016D4A35 Relevance: .4, Instructions: 423COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ebc7f223a89905c55a10d9bd692523c34124fc1ad656d048a5470a2d6266029e
                                                                                                                    • Instruction ID: d831ad4cccbfedf75d44dd4cab305760f82006fcfd6ccff4dc1c7e6c81ab5f15
                                                                                                                    • Opcode Fuzzy Hash: ebc7f223a89905c55a10d9bd692523c34124fc1ad656d048a5470a2d6266029e
                                                                                                                    • Instruction Fuzzy Hash: 7CF17171E0021A9BDB15CFA9C980BAEFBF6BF48710F048169E905AB754EB74DC42CB50
                                                                                                                    Function 016BA9D0 Relevance: .4, Instructions: 421COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 798c1d74f35f01d594969a9f4b6c9e2625f674f36f4dabe9a9b589dae673918d
                                                                                                                    • Instruction ID: bb92661e5f6dfc42d8cac72a4344f6e437ccf7f4356c3047bce4d5c2798fc469
                                                                                                                    • Opcode Fuzzy Hash: 798c1d74f35f01d594969a9f4b6c9e2625f674f36f4dabe9a9b589dae673918d
                                                                                                                    • Instruction Fuzzy Hash: 68E16E71E00219ABEB22CEDDCD84BEEBBBAFF04310F14456AE911E7255E7749981CB50
                                                                                                                    Function 016A8397 Relevance: .4, Instructions: 380COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: c5c38f2aef55ecef6e1b456d0727ef74aff4d22902b91d6a5fdfcf63e18f48fd
                                                                                                                    • Instruction ID: 0df9d2025b90750afe724de0e37f083242e419c389d962b07b55d188461e1633
                                                                                                                    • Opcode Fuzzy Hash: c5c38f2aef55ecef6e1b456d0727ef74aff4d22902b91d6a5fdfcf63e18f48fd
                                                                                                                    • Instruction Fuzzy Hash: C9D1BC75A00606DBDB15DF68CC80ABEBBEAAF54305F45462DE9129B280EB30EE51CF50
                                                                                                                    Function 016B65D0 Relevance: .4, Instructions: 365COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fc50ed78422dc85ce84f21371398149fa8d498d72f30c93ce895f420b68f425c
                                                                                                                    • Instruction ID: af34570dd7b98c81d7c7cf122cbc94f2c147563523ee07615982de7b71e8718f
                                                                                                                    • Opcode Fuzzy Hash: fc50ed78422dc85ce84f21371398149fa8d498d72f30c93ce895f420b68f425c
                                                                                                                    • Instruction Fuzzy Hash: 04E19F71508342CFC715DF28C8D0AAABBE1FF89308F45896DE99587352EB31E945CB92
                                                                                                                    Function 01738243 Relevance: .3, Instructions: 322COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 44fc8e8e43da417eb9280bef980917e355e266e3dfe67b355ffa181fa1ff9558
                                                                                                                    • Instruction ID: 984d1404ec261e9095e3a751aa59f65013c1e1126e16a5fc227628ac9333e9a4
                                                                                                                    • Opcode Fuzzy Hash: 44fc8e8e43da417eb9280bef980917e355e266e3dfe67b355ffa181fa1ff9558
                                                                                                                    • Instruction Fuzzy Hash: 76B1B076A00605AFDF24DF98C944AABFBB9EFC4304F10461DBA0297796DA30E905CB11
                                                                                                                    Function 016C0535 Relevance: .3, Instructions: 300COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7fd700fbd03bf2adbb2211fea5898c4dae515c14471c26ec91a7b73b47cf98cd
                                                                                                                    • Instruction ID: 6d07969c888ad60c41f4c7ba7b4bfa0ea7bae67562dd902e4647ea7f59cd077b
                                                                                                                    • Opcode Fuzzy Hash: 7fd700fbd03bf2adbb2211fea5898c4dae515c14471c26ec91a7b73b47cf98cd
                                                                                                                    • Instruction Fuzzy Hash: 4AB1E135600646EFDB25DBA8C954BBEBBFAEF84700F18015CE6529B385D730E942CB90
                                                                                                                    Function 016D0DE1 Relevance: .3, Instructions: 295COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 8affa789f5301fdf3f13db3c5f9bad9bb99f4c0f5d8c8bb60f58dd66830e5048
                                                                                                                    • Instruction ID: 40cfae0ed376d1dd954ebd714b65067c1b623858822521a8922637b9780e8e55
                                                                                                                    • Opcode Fuzzy Hash: 8affa789f5301fdf3f13db3c5f9bad9bb99f4c0f5d8c8bb60f58dd66830e5048
                                                                                                                    • Instruction Fuzzy Hash: D8C14C70E0525ADFDB25DFA9CC84AAEBBB6FF88304F10412DE505AB345DB71A841CB90
                                                                                                                    Function 016B83C0 Relevance: .3, Instructions: 281COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 1dcf1104a5be9eb35c7679047bf1102ce37aa9741724dc09cd14fb147b108586
                                                                                                                    • Instruction ID: 50aca704b6bb78d2c47859ec8f724af05f86b0c8b620f0cfc924b8d4d1f9ff4a
                                                                                                                    • Opcode Fuzzy Hash: 1dcf1104a5be9eb35c7679047bf1102ce37aa9741724dc09cd14fb147b108586
                                                                                                                    • Instruction Fuzzy Hash: A4C158711083418FD764DF28C894BABB7E9BF88304F44496DEA898B391D774E948CF92
                                                                                                                    Function 016AC427 Relevance: .3, Instructions: 280COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2ddfa22054daee89b501ece36079a230774076001f2373a765c1b9b092fbf4eb
                                                                                                                    • Instruction ID: f51701175f2b8e13ffac2f29127dc4d894eedebd35e2e42bb55759f25f75fa36
                                                                                                                    • Opcode Fuzzy Hash: 2ddfa22054daee89b501ece36079a230774076001f2373a765c1b9b092fbf4eb
                                                                                                                    • Instruction Fuzzy Hash: CEB16170A002668BDB25DF58CC90BA9B7F6EF44700F4485E9E54AE7281EB749D86CF24
                                                                                                                    Function 016F0185 Relevance: .3, Instructions: 276COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 63dc1f4ec8ba645fb2b68e6717b0eb625512ff5b1219fc3b430b1398f2c3e713
                                                                                                                    • Instruction ID: b221d4358f36f09a20559c2c22f1d4895c32d952c5d4739b213f660e07ea4c65
                                                                                                                    • Opcode Fuzzy Hash: 63dc1f4ec8ba645fb2b68e6717b0eb625512ff5b1219fc3b430b1398f2c3e713
                                                                                                                    • Instruction Fuzzy Hash: C3A1AF71B01626DBDB25DF69CD90BAAB7A2FF54314F14412DEB0597382EB34E812CB90
                                                                                                                    Function 017360E0 Relevance: .3, Instructions: 264COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d03cab724cc3f4f0d7ba673030c7d936b3af3b328a6bcee1ddc04102217e21e4
                                                                                                                    • Instruction ID: b6e45d40f7eba7ae255d8fd1a37c2c5658a13cbbe53b93432196b6993eae94f8
                                                                                                                    • Opcode Fuzzy Hash: d03cab724cc3f4f0d7ba673030c7d936b3af3b328a6bcee1ddc04102217e21e4
                                                                                                                    • Instruction Fuzzy Hash: AD916271D04216BFDB15CF68D884BBEFBB5AB88710F154169F610EB342D734EA009BA4
                                                                                                                    Function 016E63FF Relevance: .3, Instructions: 261COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2ff9185fc85cb90b18bab7e9e56709d2c6f564c446de00ee8c64a94ac37affd2
                                                                                                                    • Instruction ID: dde3b854c8c87802e6b080a4cf22c934fa9b574c658331a7e55af2bfb1bc6393
                                                                                                                    • Opcode Fuzzy Hash: 2ff9185fc85cb90b18bab7e9e56709d2c6f564c446de00ee8c64a94ac37affd2
                                                                                                                    • Instruction Fuzzy Hash: AC915B71B02325DBDB35DF18DC98BADBBE1BB91B24F54822CE5066B285D7709842C7D0
                                                                                                                    Function 016CE3F0 Relevance: .3, Instructions: 261COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: cdedeed13bfbdee1f112442ac0521162ef0fb9391bb4941bc1cfeb197b2c2786
                                                                                                                    • Instruction ID: cd9005845ab3ffdf279d1e75d4de871e07185a9ee3b53a9eb8dd78617aa9840b
                                                                                                                    • Opcode Fuzzy Hash: cdedeed13bfbdee1f112442ac0521162ef0fb9391bb4941bc1cfeb197b2c2786
                                                                                                                    • Instruction Fuzzy Hash: E8911572A016168BEB249B5CCC54B7AFBB2EFA4B14F05806DEE059B384E736D902C751
                                                                                                                    Function 016C0C00 Relevance: .3, Instructions: 260COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9a1baa40806ebefe0f44fb22c5e254fa5d04c6e6d86519b6bc1048c4b5819e06
                                                                                                                    • Instruction ID: 572360532bfcfbc3210539e840160bd4ce1f4ad22641a1c20a24153084c4f993
                                                                                                                    • Opcode Fuzzy Hash: 9a1baa40806ebefe0f44fb22c5e254fa5d04c6e6d86519b6bc1048c4b5819e06
                                                                                                                    • Instruction Fuzzy Hash: CCA1DE79600206DBD729CF28C890BBAFBE2EF45B00F14856DE5968B786D734F845CB91
                                                                                                                    Function 017389B3 Relevance: .3, Instructions: 259COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 71f924cb65a90d908230d377e9928452708172306de6dfaacff65b7de2b9d9bc
                                                                                                                    • Instruction ID: 2fda5e676a07621388dfaa23674921255288b68d57e4c7b35b65523b361cd81c
                                                                                                                    • Opcode Fuzzy Hash: 71f924cb65a90d908230d377e9928452708172306de6dfaacff65b7de2b9d9bc
                                                                                                                    • Instruction Fuzzy Hash: 3B9135B2645302AFD721EF688C90B5BFBA5ABD4724F44465CFA416B282C7709D01CB97
                                                                                                                    Function 016E4AD0 Relevance: .2, Instructions: 228COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 62c55a8172bb31a4147372386f54f9f89c5470f663c533b48f1f20d440014545
                                                                                                                    • Instruction ID: a6f0e7597e82315bbe4b555a31de0e4d255a64f773237c59fc4856d543f0fc73
                                                                                                                    • Opcode Fuzzy Hash: 62c55a8172bb31a4147372386f54f9f89c5470f663c533b48f1f20d440014545
                                                                                                                    • Instruction Fuzzy Hash: 5B6112326017129BDB228E2DCC45B3AF7E5AF84A50F14869DE955DB340CB34E802CB95
                                                                                                                    Function 01706ACC Relevance: .2, Instructions: 226COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 978a1a688aa726a2fa7b9f6c7bd9434505075bb7566bf3bcb402308a4316a59f
                                                                                                                    • Instruction ID: 55ea95998be58dd6f19877b916d8f82de81e7f7afa4843f52b2b6506d1b2c581
                                                                                                                    • Opcode Fuzzy Hash: 978a1a688aa726a2fa7b9f6c7bd9434505075bb7566bf3bcb402308a4316a59f
                                                                                                                    • Instruction Fuzzy Hash: 0A819EB1A007169BDB25CF69C850ABEFBF9FB48700F14852EE545D7680E734E950CBA4
                                                                                                                    Function 016A6D10 Relevance: .2, Instructions: 216COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 8e821fc342c56a34c1302151c4103258085479647a1624961981c02eda009243
                                                                                                                    • Instruction ID: f492b89e5303df305244dc1c7b5d8e3b65210bf8006e9d576e3549280249deaa
                                                                                                                    • Opcode Fuzzy Hash: 8e821fc342c56a34c1302151c4103258085479647a1624961981c02eda009243
                                                                                                                    • Instruction Fuzzy Hash: B5717772A44702EBDB22CE29C940B6BF7D4BB44358F044929EB59D7282D730EC84CB92
                                                                                                                    Function 016EE284 Relevance: .2, Instructions: 212COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 87fd124c5b5ee4a3c336d1a3a7cab82118cebabde4930405222679af4dc35888
                                                                                                                    • Instruction ID: 9ef8f9d4936bb86e3bbd0d417207723f678921055f0f6e073b2352700cc35c10
                                                                                                                    • Opcode Fuzzy Hash: 87fd124c5b5ee4a3c336d1a3a7cab82118cebabde4930405222679af4dc35888
                                                                                                                    • Instruction Fuzzy Hash: AC818D71A01609AFDB21CFA9C884BEEBBFAFF48314F14852DE655A7250D731AC05CB60
                                                                                                                    Function 016B64AB Relevance: .2, Instructions: 211COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: aae32320c27834b0424eb203e40db8103f7c9fe760a1a666c8fa4b6fc50f0fb7
                                                                                                                    • Instruction ID: 1f80de914fc80f91f0328b4a5e8f0af9e73c753fc4e5e445ac14cc7f0594d71b
                                                                                                                    • Opcode Fuzzy Hash: aae32320c27834b0424eb203e40db8103f7c9fe760a1a666c8fa4b6fc50f0fb7
                                                                                                                    • Instruction Fuzzy Hash: 6C71BDB29043059FCB21DF18CCC5B9BBBA9AF94764F40046CF9498B28AD734D599CBD2
                                                                                                                    Function 016CC640 Relevance: .2, Instructions: 206COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a1e813c4ef87ee45ba93b940b3e2be20bbab58e02b68f7fac511cf9e0c0eb586
                                                                                                                    • Instruction ID: 970c433f923774114b30178c35e9cfb820bac6fbf83055916d730468ea680a8a
                                                                                                                    • Opcode Fuzzy Hash: a1e813c4ef87ee45ba93b940b3e2be20bbab58e02b68f7fac511cf9e0c0eb586
                                                                                                                    • Instruction Fuzzy Hash: E371DD75D00229DBCB258F59C990BBEFBB1FF88B10F54815EE986AB354D3309841CBA1
                                                                                                                    Function 016EA660 Relevance: .2, Instructions: 200COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 504caaabef2dcef5cfc3e321491274c7c793c636a7c2c868d09d307c4795c6a1
                                                                                                                    • Instruction ID: 362f50929e603e7c2e1375ea1c9eae1765ddb49af0ffcfbaa5df1c95886ab703
                                                                                                                    • Opcode Fuzzy Hash: 504caaabef2dcef5cfc3e321491274c7c793c636a7c2c868d09d307c4795c6a1
                                                                                                                    • Instruction Fuzzy Hash: 99716DB5E0022A8FDF28CF98D9906ADFBB2BF48710F14816EE905A7345E7709942CB50
                                                                                                                    Function 0173035C Relevance: .2, Instructions: 198COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a2f0af9a4cc35be43268488dd58ae78b3cd43133769d1ae5baa3c223ab0f1c10
                                                                                                                    • Instruction ID: 09e06c16cccd77a4c7dfff647468220c2941d5dbd4510c11274d66addfa761f5
                                                                                                                    • Opcode Fuzzy Hash: a2f0af9a4cc35be43268488dd58ae78b3cd43133769d1ae5baa3c223ab0f1c10
                                                                                                                    • Instruction Fuzzy Hash: 8B715E71A00619AFDB11DFA9C984EEEFBB9FF88700F104569E505E7291DB34EA01CB54
                                                                                                                    Function 016B8AA0 Relevance: .2, Instructions: 197COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: f6c0d05b27b5e00fd74a1478294203eba99f8d75a14d8131b78ab0f08f90fbd9
                                                                                                                    • Instruction ID: f5c38ea599946257c932c2cdb3535294507de905e3ed764296c4288371bdee91
                                                                                                                    • Opcode Fuzzy Hash: f6c0d05b27b5e00fd74a1478294203eba99f8d75a14d8131b78ab0f08f90fbd9
                                                                                                                    • Instruction Fuzzy Hash: CD81B472A08305CFDB28CF5CD884BEDB7B9BB88320F6A412DD9016B286D7759D41CB94
                                                                                                                    Function 016BA471 Relevance: .2, Instructions: 194COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: bbaaccaa778a7143fd7195938a557d3b816165dccc343f69a42379f0dda0214e
                                                                                                                    • Instruction ID: 44f17abb27de82d8453865ea5c36edb655eb975e857d0d8d36f97d52554dc956
                                                                                                                    • Opcode Fuzzy Hash: bbaaccaa778a7143fd7195938a557d3b816165dccc343f69a42379f0dda0214e
                                                                                                                    • Instruction Fuzzy Hash: 437180751083469FD711CF98C880BAAB7E5FF84704F00882EFA85D7254E738DA8ACB56
                                                                                                                    Function 016C0A5B Relevance: .2, Instructions: 190COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4e50342b93411f12e745b3c56a91278769b5f4be0ae8ff076044a10367e83c72
                                                                                                                    • Instruction ID: bcdc87bffdbb24c9036475519642845da29eaf8f79d7486ec8ab917bde957e9c
                                                                                                                    • Opcode Fuzzy Hash: 4e50342b93411f12e745b3c56a91278769b5f4be0ae8ff076044a10367e83c72
                                                                                                                    • Instruction Fuzzy Hash: 30619D74600305EFDB29CF28C884B6ABBE1FF45B08F14855DE85A8B296D771E881CB91
                                                                                                                    Function 016C61D1 Relevance: .2, Instructions: 186COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fb639025cd0eb1bd9a62b9334040de8e034eb44ca5a9240e94a78040c57dd21a
                                                                                                                    • Instruction ID: ecfa1ba3d94f09e63277f8f1fae01d546a5ba69e5d1f7b5271531030cb501540
                                                                                                                    • Opcode Fuzzy Hash: fb639025cd0eb1bd9a62b9334040de8e034eb44ca5a9240e94a78040c57dd21a
                                                                                                                    • Instruction Fuzzy Hash: 4B718C34A016268FDB26CF98C8507BDF7B2FF85B04F24855CD956AB341DB74A942CB84
                                                                                                                    Function 0172E6F2 Relevance: .2, Instructions: 179COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ef0a7c141c3a5cce8b6942847947d8cc63a19e3317090fe97fff9fe87f3d7741
                                                                                                                    • Instruction ID: ecc47a2f04e08d55b3bdd17f49f344b1407978366dfc086f9fea0d2ec0902681
                                                                                                                    • Opcode Fuzzy Hash: ef0a7c141c3a5cce8b6942847947d8cc63a19e3317090fe97fff9fe87f3d7741
                                                                                                                    • Instruction Fuzzy Hash: 1B616D71E403299FDB24DFA9C840BAEFBB9FB48700F14406DE649EB291DB71A941CB54
                                                                                                                    Function 016BAC50 Relevance: .2, Instructions: 178COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 32c95f4b938b66571551700b0f0410aae690e21bda642ecb522e6919c1bbc30b
                                                                                                                    • Instruction ID: 95e6174ba5699fb21c7d7d6afb5d65afe22ecee1913cc3cdabd33137c6b2e14d
                                                                                                                    • Opcode Fuzzy Hash: 32c95f4b938b66571551700b0f0410aae690e21bda642ecb522e6919c1bbc30b
                                                                                                                    • Instruction Fuzzy Hash: 6C61CE72A046459FEB22DFACC880BEDBBB5FF54711F04456AE901AB391D774D980C760
                                                                                                                    Function 016F2160 Relevance: .2, Instructions: 168COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 644b335a334a56b57ae05515f8cea2679369ddf2a4c08bb21727ceb1c9a2e865
                                                                                                                    • Instruction ID: 863bd9fb2286817338a7a18df1b69b99a09f045fdb7113656ad6478a417b6411
                                                                                                                    • Opcode Fuzzy Hash: 644b335a334a56b57ae05515f8cea2679369ddf2a4c08bb21727ceb1c9a2e865
                                                                                                                    • Instruction Fuzzy Hash: A2512B75A006199FDB10CFA8CC507EDBBF5AF48324F25822EEA25EB684D734E9418F54
                                                                                                                    Function 016DEDD3 Relevance: .2, Instructions: 166COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: f360f01e573d5bf61b8daaae375b700c315a55e12fdd055472d09304bbec2b12
                                                                                                                    • Instruction ID: 2f23b4bb2d0c6164a9a48d096d36a3c97c5bcbed15fcdf0e15dfd36ac1f1048a
                                                                                                                    • Opcode Fuzzy Hash: f360f01e573d5bf61b8daaae375b700c315a55e12fdd055472d09304bbec2b12
                                                                                                                    • Instruction Fuzzy Hash: BB51DB71A007419FDB31DF5DCC84B6BB7AAFB94719F50482EE1028BA51CB75E889CB80
                                                                                                                    Function 016DCDF0 Relevance: .2, Instructions: 165COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6851680e3e689f07d8311deac1a97bfa9ae5f47be04d730b0759b45304561ce1
                                                                                                                    • Instruction ID: 3ac04b27f22b29ba51de3cfe077dfb7c8e125b60e13bb3e6e3ca72e2bfa77ac6
                                                                                                                    • Opcode Fuzzy Hash: 6851680e3e689f07d8311deac1a97bfa9ae5f47be04d730b0759b45304561ce1
                                                                                                                    • Instruction Fuzzy Hash: 80516E75E0060ADFCB15CF9CCD806EDFBB2FB88210F198169DD15B7249DA34AA41CB94
                                                                                                                    Function 016C2CDC Relevance: .2, Instructions: 162COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 948c4c58393c67a0bd3230382b8d2dea412a3fba20703058d630c0e76aa85500
                                                                                                                    • Instruction ID: 9c9e974deab55c212bf382fedd59b38264f105834633e29801201eede6361e47
                                                                                                                    • Opcode Fuzzy Hash: 948c4c58393c67a0bd3230382b8d2dea412a3fba20703058d630c0e76aa85500
                                                                                                                    • Instruction Fuzzy Hash: 7271AD71A046599FEB25CF68C9547B9BBF0FB04B14F18809DD849AB392C379A886CF50
                                                                                                                    Function 016EE443 Relevance: .2, Instructions: 158COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: e5193c9e506a15bd28df1b06075c9eb85aec31e6326390d5eafb571258a984ff
                                                                                                                    • Instruction ID: 9f0290b612e69ced619c58eed5069e0febcfcd575ac78aecc61f21cf3c5f829d
                                                                                                                    • Opcode Fuzzy Hash: e5193c9e506a15bd28df1b06075c9eb85aec31e6326390d5eafb571258a984ff
                                                                                                                    • Instruction Fuzzy Hash: B1518A71201A15DFCB22EFA9CD84EAAB3FAFF14784F54056EE64287260E735E941CB50
                                                                                                                    Function 016D45B1 Relevance: .2, Instructions: 156COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: f1f940062bb164c30f98cd5f3406246ca69af4dfd6fb89726bbd0b8788f8d1b5
                                                                                                                    • Instruction ID: 077cc773100d04a52176d77be3a05e3389597ed3b635fa56a78064016c469833
                                                                                                                    • Opcode Fuzzy Hash: f1f940062bb164c30f98cd5f3406246ca69af4dfd6fb89726bbd0b8788f8d1b5
                                                                                                                    • Instruction Fuzzy Hash: 7F519E71E0021AABDF15DF98C840BFEBBB5AF49750F058069EA05AB740DB34DD45CBA4
                                                                                                                    Function 0173E9E0 Relevance: .2, Instructions: 154COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 08e4cd0a40312db3601c2ec88b8b3ba4937567036288613210d62cd3e5d467c2
                                                                                                                    • Instruction ID: 004323dbd4a3afd5b528d5b3fded5025f888ff6a2123ac73ce9778dc7643be9f
                                                                                                                    • Opcode Fuzzy Hash: 08e4cd0a40312db3601c2ec88b8b3ba4937567036288613210d62cd3e5d467c2
                                                                                                                    • Instruction Fuzzy Hash: 4851A971D0021AEFEF169F94CC95FAEFB75AF80314F154669DA1267192DB309E408BA0
                                                                                                                    Function 016CE627 Relevance: .1, Instructions: 148COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d47253e4a4a3348f28855c699cf24d69dbff6b4e5528fe707f88bde34c08a6b2
                                                                                                                    • Instruction ID: d618b19e5c413f1e47c7e7f6f5abcde7b81990f53a06da0de6dc1455da32d957
                                                                                                                    • Opcode Fuzzy Hash: d47253e4a4a3348f28855c699cf24d69dbff6b4e5528fe707f88bde34c08a6b2
                                                                                                                    • Instruction Fuzzy Hash: A141B3725083129BD720DA75CC40B7BBBE9EF88B04F440A2EF685E7240EB75D905C7A6
                                                                                                                    Function 0173CBF0 Relevance: .1, Instructions: 148COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5f9202e5335404f092d15f1305cd33633317f983c823d67fa5bd3c0602980901
                                                                                                                    • Instruction ID: e1845bd778534082dc94805439954a16108156f8786bb68b075738140138361f
                                                                                                                    • Opcode Fuzzy Hash: 5f9202e5335404f092d15f1305cd33633317f983c823d67fa5bd3c0602980901
                                                                                                                    • Instruction Fuzzy Hash: 9E51907190021ADFCB22DFA9C9849AEFBB9FF88314B55851AE506B7302D735AD41CF90
                                                                                                                    Function 016ECC00 Relevance: .1, Instructions: 147COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ae2562343c42cedb98dfaedc3e763be09ecdbaa04771ff7f7597cdd05201f8bb
                                                                                                                    • Instruction ID: 53f629ae28b02cf48de9011b024b5ec9cbb09435a766388282f836adc1b3f003
                                                                                                                    • Opcode Fuzzy Hash: ae2562343c42cedb98dfaedc3e763be09ecdbaa04771ff7f7597cdd05201f8bb
                                                                                                                    • Instruction Fuzzy Hash: 32512930202207CBDB298E2CDD5C736BBD1EB42A54F18976DF906CB251D772D4A2D752
                                                                                                                    Function 016EA430 Relevance: .1, Instructions: 139COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: c73fc039a05b7332a8d0f9693bd96c280634e8fd771de01e22672864f0ea8f0a
                                                                                                                    • Instruction ID: 54da281c531d441dc65b45f03ff3473ad7f460dcad4918c35e0beac2c9060af2
                                                                                                                    • Opcode Fuzzy Hash: c73fc039a05b7332a8d0f9693bd96c280634e8fd771de01e22672864f0ea8f0a
                                                                                                                    • Instruction Fuzzy Hash: 1A4166716462129BCB39EFA89C84B7A77A6EBD4718F40412DFE029B281D7719811C794
                                                                                                                    Function 016E01F8 Relevance: .1, Instructions: 138COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 921734b39f6173df2978f7f309c35e5882034d6e73a88b8756efa8336b1223be
                                                                                                                    • Instruction ID: b67b5a4915200f18fb73f735d33b845650f242d6cbc0556f2cbea68f57a9905e
                                                                                                                    • Opcode Fuzzy Hash: 921734b39f6173df2978f7f309c35e5882034d6e73a88b8756efa8336b1223be
                                                                                                                    • Instruction Fuzzy Hash: 1441BC35A022169BDB11DFA8C844AEEB7F5AF48600F14825EF815A7340D7749C42CBA8
                                                                                                                    Function 016ACDEA Relevance: .1, Instructions: 138COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 507e2c8e0956ccb7f31e30cfc58e9b82afa8bd19cd7e3e97a1839e73772a016d
                                                                                                                    • Instruction ID: dadeabdc8fbcb5f3ff1258bd546146e9dd7125a21d5909f07cdde2b8f2ad1ba6
                                                                                                                    • Opcode Fuzzy Hash: 507e2c8e0956ccb7f31e30cfc58e9b82afa8bd19cd7e3e97a1839e73772a016d
                                                                                                                    • Instruction Fuzzy Hash: 02418076900319EADF26DB98CC80AEEFBF9FF44610F65415EE612A7290D7709E41CB50
                                                                                                                    Function 016F2750 Relevance: .1, Instructions: 137COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4e5994e520c12837e1c977685754e7d15b60516a2f9191962b35c18b1936a3e0
                                                                                                                    • Instruction ID: 85e24b8e4b6d66c19111ce24f53784a3d031986160e7f0cb9591453a1cc3060d
                                                                                                                    • Opcode Fuzzy Hash: 4e5994e520c12837e1c977685754e7d15b60516a2f9191962b35c18b1936a3e0
                                                                                                                    • Instruction Fuzzy Hash: F5513675A006258FCB15CF9CC580AAEF7B2FF84710F2881A9D915A7752D770EE82CB90
                                                                                                                    Function 016B6154 Relevance: .1, Instructions: 133COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 36fe06ab3a2bbf8362883890f829d0203774144e45bb44723ae36e179a322663
                                                                                                                    • Instruction ID: d16a6ff1c37189197b5e9f53b5e3474c78ad0226b707a5a2c598b03bc7dc7da6
                                                                                                                    • Opcode Fuzzy Hash: 36fe06ab3a2bbf8362883890f829d0203774144e45bb44723ae36e179a322663
                                                                                                                    • Instruction Fuzzy Hash: 6551E2709402069BEB258B2CCC50BE8BBB6FF15314F14C2ADE529A72C1DB3499C1CF84
                                                                                                                    Function 016B0BCD Relevance: .1, Instructions: 130COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9fe244aeddab3d989ae05b5fcac9be84da486b11f2ca1fad53dcf362b8f2effb
                                                                                                                    • Instruction ID: 57595eb1d9d625af687c428eb67c81ad66f62417aa566639549a17aceca2eeb4
                                                                                                                    • Opcode Fuzzy Hash: 9fe244aeddab3d989ae05b5fcac9be84da486b11f2ca1fad53dcf362b8f2effb
                                                                                                                    • Instruction Fuzzy Hash: 58418331A40328DBDB21DF68CD80BEABBB5EF45750F0504A9E908AB241DB749E81CF95
                                                                                                                    Function 016B0D59 Relevance: .1, Instructions: 130COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 82d43fc632cc137842f95cb99f1d2a0c8c84a1b847cef5ad47280106a6906778
                                                                                                                    • Instruction ID: 8f2efeda97853b729d2de14ae77081cced5a947c8cc3b7e6201ea8b6dc78161f
                                                                                                                    • Opcode Fuzzy Hash: 82d43fc632cc137842f95cb99f1d2a0c8c84a1b847cef5ad47280106a6906778
                                                                                                                    • Instruction Fuzzy Hash: 7241B4756003149FEB32DF28CC80BABBBBAAB55710F04449DF9459B281D770ED81CB55
                                                                                                                    Function 016E6F60 Relevance: .1, Instructions: 130COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6dcd53a2afbecdb508ac32a3fd90bd5f1436c8da61d1b1beb5c0955da83f5c9d
                                                                                                                    • Instruction ID: 7c9634c045905e989dedd6058bd652f6872c3947d75b7ba203fa824f689800e2
                                                                                                                    • Opcode Fuzzy Hash: 6dcd53a2afbecdb508ac32a3fd90bd5f1436c8da61d1b1beb5c0955da83f5c9d
                                                                                                                    • Instruction Fuzzy Hash: D95155B5A01709CFDB11CF69C884B9ABBF2BF48310F14862ED96A9B350D731A901CF90
                                                                                                                    Function 0172C730 Relevance: .1, Instructions: 129COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6e2767b5476bdc46e489d6c6e5e21f29793f1e766f26a80fed1626e236a1d992
                                                                                                                    • Instruction ID: 97d84af80379fba892f7276265e7c7dd7a6997a7a1bd3b2f8786c90e9c2537c6
                                                                                                                    • Opcode Fuzzy Hash: 6e2767b5476bdc46e489d6c6e5e21f29793f1e766f26a80fed1626e236a1d992
                                                                                                                    • Instruction Fuzzy Hash: 7E4166B1D0052DABDB21DA50CC85FDEB77DAB55714F0085E9EB08AB140DB709E89CFA8
                                                                                                                    Function 016B0887 Relevance: .1, Instructions: 128COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7be317a2441e60aadb028b15fd6f0ebb45ad04c412ba06e583cdf518797b844e
                                                                                                                    • Instruction ID: b134e2f5c88d74988a0251907b19fa6ad44c08219981c8d7adbc97a30a342b86
                                                                                                                    • Opcode Fuzzy Hash: 7be317a2441e60aadb028b15fd6f0ebb45ad04c412ba06e583cdf518797b844e
                                                                                                                    • Instruction Fuzzy Hash: E741E2706007019FE725DF28CC80A63BBF9FF48314B149A6EE54787A51EB30E886CB94
                                                                                                                    Function 016DA470 Relevance: .1, Instructions: 127COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 38818d0d82fbc9a8486bbfe1426ca1e5bc7a8dce3ed6a7fe2c0bd686b41a99c1
                                                                                                                    • Instruction ID: c8ba316cf95f4963d7cc2f87984e176a0c1df98be8bbabfce1f1b7759e91215b
                                                                                                                    • Opcode Fuzzy Hash: 38818d0d82fbc9a8486bbfe1426ca1e5bc7a8dce3ed6a7fe2c0bd686b41a99c1
                                                                                                                    • Instruction Fuzzy Hash: CE41F032D05204CFDB21CFACC894BEDBBB5FB88720F984199D412AB385DB759901CBA4
                                                                                                                    Function 016B8BF0 Relevance: .1, Instructions: 124COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2bc5dafa8de43d95b5d66022399e8bf9454e75d2737b7bc9baf00aa40d36935b
                                                                                                                    • Instruction ID: 58b7446163cf485b573d759e829603d56c4a7a1ce2ed35457d931a8207f09859
                                                                                                                    • Opcode Fuzzy Hash: 2bc5dafa8de43d95b5d66022399e8bf9454e75d2737b7bc9baf00aa40d36935b
                                                                                                                    • Instruction Fuzzy Hash: 0F410772900202CBD724DF4CCC80A9ABBBEFBD4714F68812ED9125B255D775D982CF90
                                                                                                                    Function 016A8918 Relevance: .1, Instructions: 123COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a266a34dc86aa70eb6c16680103f34a85d1b73018c38119cc6b51e7a35956c21
                                                                                                                    • Instruction ID: 7928c18f7e89fcb8995be7c757086b58429fd7e576d03c5b96e57be12445660c
                                                                                                                    • Opcode Fuzzy Hash: a266a34dc86aa70eb6c16680103f34a85d1b73018c38119cc6b51e7a35956c21
                                                                                                                    • Instruction Fuzzy Hash: C2413A759083069ED312DF69CC40A6BF6E9EF88B54F40092EF984D7250E730DE458B97
                                                                                                                    Function 016AA020 Relevance: .1, Instructions: 122COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                                    • Instruction ID: 5148fefe7e89be3fa9c7440db421741577d263e6ba572c5db8969ef0625b83ca
                                                                                                                    • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                                    • Instruction Fuzzy Hash: 32412E35A00311DBDB12DEA98840BB9FBA2EB50759F95806FE9459B280D732AE41CF90
                                                                                                                    Function 016B09AD Relevance: .1, Instructions: 122COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: c66bd530eb08152ec5996faf10b3d8c2f368e8f456fb0e0f85396ea2c82cd87e
                                                                                                                    • Instruction ID: e826cbfaf118636d44b1dd2402b6449fc302f8378f8793ca8de53d6f532bf222
                                                                                                                    • Opcode Fuzzy Hash: c66bd530eb08152ec5996faf10b3d8c2f368e8f456fb0e0f85396ea2c82cd87e
                                                                                                                    • Instruction Fuzzy Hash: EA416B71640601DFD321DF18C880BA6BBF5EF54714F248A6EE8498B352E771E9828B94
                                                                                                                    Function 016E0710 Relevance: .1, Instructions: 121COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9f0c50458855a09be12f916f7edb5fbf22469515b4fabd68e5ac243ec6b2fef0
                                                                                                                    • Instruction ID: 1beedfcd287e0e1483cd82145bca176547a3043050b0159e4eb91717bbbfd763
                                                                                                                    • Opcode Fuzzy Hash: 9f0c50458855a09be12f916f7edb5fbf22469515b4fabd68e5ac243ec6b2fef0
                                                                                                                    • Instruction Fuzzy Hash: D3415971A01705EFDB24CF98C994AAABBF9FF18700B104A6DE556D7290D370EA45CF90
                                                                                                                    Function 016AC156 Relevance: .1, Instructions: 119COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 00fe977dd45fcdf98b8240c00ce4ea31696b5c551622c56443df0109bd0851a9
                                                                                                                    • Instruction ID: 419ccf43fd43b149a864ca413c5d3f148b0e0410703fa8c47f12d03cacf83230
                                                                                                                    • Opcode Fuzzy Hash: 00fe977dd45fcdf98b8240c00ce4ea31696b5c551622c56443df0109bd0851a9
                                                                                                                    • Instruction Fuzzy Hash: B441E771900301CBCB21EF98CC80BE9B7B5FF55304F94816DE9469F382EA759986CB94
                                                                                                                    Function 016BA2C3 Relevance: .1, Instructions: 118COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 14531a462e9a3b25fa3ec525060c1de325aca7f60bcd5d6ce4bec8715e706197
                                                                                                                    • Instruction ID: 59bd3eedb15079c861f9106aefca61fe065bd4478c1838508c84f35fb88c615b
                                                                                                                    • Opcode Fuzzy Hash: 14531a462e9a3b25fa3ec525060c1de325aca7f60bcd5d6ce4bec8715e706197
                                                                                                                    • Instruction Fuzzy Hash: 0141E231A05659DBDB21DF9DC880BAEBBB5FF84700F2440A9E901DB396E375D981CB40
                                                                                                                    Function 016EC8F9 Relevance: .1, Instructions: 116COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: eace6f118aed6fab3851c76bf9d26b8b56f47b44d870110632474bfa5e03454a
                                                                                                                    • Instruction ID: ebb1d7ce28d64c2909e2a2ae6e42e0a2917ec25900605628cde752099a9cc6f9
                                                                                                                    • Opcode Fuzzy Hash: eace6f118aed6fab3851c76bf9d26b8b56f47b44d870110632474bfa5e03454a
                                                                                                                    • Instruction Fuzzy Hash: 2231A9B2A01345DFDB12CFA8D840799BBF0FB08724F2081AED519EB291D3369902CF94
                                                                                                                    Function 016A80A0 Relevance: .1, Instructions: 111COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d5bad1a613b281e996d896f4f16c1d526e0621ef089b5eaff44c4a79ca066bdf
                                                                                                                    • Instruction ID: 8c455853da926bcd00ba428221944bb82c3a1dcfbea0d6a69823bbd478d07447
                                                                                                                    • Opcode Fuzzy Hash: d5bad1a613b281e996d896f4f16c1d526e0621ef089b5eaff44c4a79ca066bdf
                                                                                                                    • Instruction Fuzzy Hash: BB41C071A05617EFDB01DF18CC80AA9B7B9FB54762FA48229D815A7280DB34FD428FD0
                                                                                                                    Function 016A8B50 Relevance: .1, Instructions: 111COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a75caaf7e9e5146fdc4cb6a3a9a0dfef386a14e557e32e2a50c568e0d63c8ac3
                                                                                                                    • Instruction ID: b276c3d624435b790b5bc40fca082a2bb01f9eab34f9473e7a28df67469d0b82
                                                                                                                    • Opcode Fuzzy Hash: a75caaf7e9e5146fdc4cb6a3a9a0dfef386a14e557e32e2a50c568e0d63c8ac3
                                                                                                                    • Instruction Fuzzy Hash: A0419CB1A01205CFCB15CF69CD809ADBBF6BF98321B50862ED466A73A0DB30AD41CF50
                                                                                                                    Function 016E2674 Relevance: .1, Instructions: 110COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5b44a849ea7847aa25eeb6b9eee1f0df9fedd61021992b03a8719eabe8e3dd18
                                                                                                                    • Instruction ID: 9b03b5d749482c6d5abd1010f828b79abfaed3d16092fd8aa92ee021ac73fb56
                                                                                                                    • Opcode Fuzzy Hash: 5b44a849ea7847aa25eeb6b9eee1f0df9fedd61021992b03a8719eabe8e3dd18
                                                                                                                    • Instruction Fuzzy Hash: 0E315B76F4122177FB119A958C49F6BBBADDB60A50F15015CFA01AB201D370DE02C6A1
                                                                                                                    Function 0172CCA0 Relevance: .1, Instructions: 108COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d96021d3fff5424e085168e09b26ebc3bc7e93b107a5a82a80522457accb14a0
                                                                                                                    • Instruction ID: 459d08cbc68033816105db1d779b5ddb72c19ea4d3b2cc9a6fa04cff8aff5d07
                                                                                                                    • Opcode Fuzzy Hash: d96021d3fff5424e085168e09b26ebc3bc7e93b107a5a82a80522457accb14a0
                                                                                                                    • Instruction Fuzzy Hash: FA31A632940129BFDB229B94CC50FEFBB7DEF64750F054069FA00AB250D6309D42CB94
                                                                                                                    Function 016A8CD0 Relevance: .1, Instructions: 107COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 91b475293a607d483a9e513eee8b7713d21fc860792c8ecc19a96bf394a0d745
                                                                                                                    • Instruction ID: 7cb2d463b18ffc2ed4b58eab48e83909b2d3f617897f5ace327bbba0d91ad78f
                                                                                                                    • Opcode Fuzzy Hash: 91b475293a607d483a9e513eee8b7713d21fc860792c8ecc19a96bf394a0d745
                                                                                                                    • Instruction Fuzzy Hash: 5131D572901205DFDB21EF18CC405AAF7F6FF64321B54856ED555A7390CB30AD418F94
                                                                                                                    Function 016C02E1 Relevance: .1, Instructions: 106COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 5edc165bbdfc8be8ee3faece5a37676e1d6bd213eca9610b85a78c39bba728db
                                                                                                                    • Instruction ID: 2509828407f3a15ac5c27bbbbd0423cc7aefafba27b2970e55d3d78a00840127
                                                                                                                    • Opcode Fuzzy Hash: 5edc165bbdfc8be8ee3faece5a37676e1d6bd213eca9610b85a78c39bba728db
                                                                                                                    • Instruction Fuzzy Hash: C3310431A04245EBDB118F6CCC84BEABBE9EF14750F0441A9F81AD7352C7749884CBA4
                                                                                                                    Function 016C26EB Relevance: .1, Instructions: 104COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 77993d3f09c14a64daaf5de3e0ed3c6e731ad8a59e5a2c4d89f2138cff726e65
                                                                                                                    • Instruction ID: d20dbe95dc68d6230fdc7b2d58a5670e8ab93a8bddf916bbb6ebd4f4a1b33d75
                                                                                                                    • Opcode Fuzzy Hash: 77993d3f09c14a64daaf5de3e0ed3c6e731ad8a59e5a2c4d89f2138cff726e65
                                                                                                                    • Instruction Fuzzy Hash: 2641BF357042428BD716DF1CC8A4B7AB7E6EF84A10F0484ADEC548B355DB34DC46CBA5
                                                                                                                    Function 016B4260 Relevance: .1, Instructions: 102COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 39398f7f211d376e8285132e24ef21b92846dc5634b7638a752a266fe7b7023e
                                                                                                                    • Instruction ID: 027386588ef3d61ab3309eab46d327a61d6dd8cd934b935e5a043b3c10bf9ed6
                                                                                                                    • Opcode Fuzzy Hash: 39398f7f211d376e8285132e24ef21b92846dc5634b7638a752a266fe7b7023e
                                                                                                                    • Instruction Fuzzy Hash: F741BF31204B45DFD722DF28C885FD6BBE5AF59714F14842DF69A8B251CB74E881CB50
                                                                                                                    Function 0172EB1D Relevance: .1, Instructions: 100COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 272d887484087b8de6bdc473d051766159e296a02d20d404ac773515b3846943
                                                                                                                    • Instruction ID: af9de8d1689f90f29f7af79b4e7bc4a9a56cb64b348422279aa8daf7fdf88f06
                                                                                                                    • Opcode Fuzzy Hash: 272d887484087b8de6bdc473d051766159e296a02d20d404ac773515b3846943
                                                                                                                    • Instruction Fuzzy Hash: 4D31D2326016A29BF322579CCD48F65FBD9FB44B40F1D00A8EA459B6D2DF28D882C224
                                                                                                                    Function 016B6484 Relevance: .1, Instructions: 99COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 445e980da78f85b86320b2ed0b8a7513974de732acb3001815b3b4d379162450
                                                                                                                    • Instruction ID: febc6cece45b1a15979d780f702d304cf0f3b0249626d3fb11c58adaa4390516
                                                                                                                    • Opcode Fuzzy Hash: 445e980da78f85b86320b2ed0b8a7513974de732acb3001815b3b4d379162450
                                                                                                                    • Instruction Fuzzy Hash: 5D31F4726007458FDB32CF1CC9C1BE6B7A9EB04B60F448479E9488B68BC725E585CB90
                                                                                                                    Function 016DEB20 Relevance: .1, Instructions: 96COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 162b200508f7bd1d982cad8a14e6e652db39629f0c9ff7115467a3ddcae8e5d7
                                                                                                                    • Instruction ID: 1bad8ccc200495dddeb2e9d4768c28e0cbce53f10ea9b04cf601f71e3732951b
                                                                                                                    • Opcode Fuzzy Hash: 162b200508f7bd1d982cad8a14e6e652db39629f0c9ff7115467a3ddcae8e5d7
                                                                                                                    • Instruction Fuzzy Hash: 3931C972E00215AFDB21DFADCD40AAEBBF9EF44750F014469E555DB250D771AE408BA0
                                                                                                                    Function 016B07AF Relevance: .1, Instructions: 95COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 904084026ffc12b3d2aa3c1fb9190aa055e2436f37a5ebd9dec4d4fa56a26fa0
                                                                                                                    • Instruction ID: e5e1bcc1a8da6d22469d88fad31077b02c57aa1281cd59740b899b59ff13fd9d
                                                                                                                    • Opcode Fuzzy Hash: 904084026ffc12b3d2aa3c1fb9190aa055e2436f37a5ebd9dec4d4fa56a26fa0
                                                                                                                    • Instruction Fuzzy Hash: 0F31D476A04712EBCB12DE288CD0AABBFB6AF94650F02452DFD56A7310DB30DD4187E5
                                                                                                                    Function 0172CA72 Relevance: .1, Instructions: 94COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: cf545468e3236c4abceec2b19038ece4652a9f1ece95ac853e9cff2e856374b1
                                                                                                                    • Instruction ID: 5797d1bcfe563ecf9ba55adb3dc3f5e5e05da121159f7c62a71a5f032c9c8c1f
                                                                                                                    • Opcode Fuzzy Hash: cf545468e3236c4abceec2b19038ece4652a9f1ece95ac853e9cff2e856374b1
                                                                                                                    • Instruction Fuzzy Hash: 3631033690056AAFEB16DA58CC51E7FFB75EBA0760F01416DEA05A7250D7309E02EBE0
                                                                                                                    Function 016DAF69 Relevance: .1, Instructions: 93COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 99268dc59ccd844fa0fc017be90bba83bd4893716af5344f1d1376c6a17c431a
                                                                                                                    • Instruction ID: f4d4bd05cbb5b8a78eb251c19f8baa76306e2abcdc4a3ed2db6142c59a8b9aa9
                                                                                                                    • Opcode Fuzzy Hash: 99268dc59ccd844fa0fc017be90bba83bd4893716af5344f1d1376c6a17c431a
                                                                                                                    • Instruction Fuzzy Hash: F6318F31E011299BDB219F298C48FAFB7B9EF45640F0640EAE909E7254DA349E81CF91
                                                                                                                    Function 016EA6C7 Relevance: .1, Instructions: 92COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e136c029909a3ccf1237e4fc7d16277c3fe1d3b2d70fb0f0b3587283bfba0b1c
                                                                                                                    • Instruction ID: 12a08c6592d3354cb3e36f3f617ca5d5230f1330235cd37da11ffc88e0c277ad
                                                                                                                    • Opcode Fuzzy Hash: e136c029909a3ccf1237e4fc7d16277c3fe1d3b2d70fb0f0b3587283bfba0b1c
                                                                                                                    • Instruction Fuzzy Hash: 97312CB6B41711AFDB61CFA9CD44B67BBF8BB08A50F04052DA59AC3751E730E9008B64
                                                                                                                    Function 016D438F Relevance: .1, Instructions: 89COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e12789efa051e6a1a7a6026e59cddde8385fbb30261a69ae1832a5e1ae6a4943
                                                                                                                    • Instruction ID: 4b84f64967a6e31de1e9c3e999e55b8358aebf3e796ec885a2305ddb5deae274
                                                                                                                    • Opcode Fuzzy Hash: e12789efa051e6a1a7a6026e59cddde8385fbb30261a69ae1832a5e1ae6a4943
                                                                                                                    • Instruction Fuzzy Hash: BA31D472F012059FDB20DFA8CD81A6EBBFAEB94704F008529D505D7A54DB30ED81CB90
                                                                                                                    Function 016ACB7E Relevance: .1, Instructions: 89COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7790bd36a42e865f7c718a67dc22d3f79e787f24dbf99b6834416aa25bbd7ff7
                                                                                                                    • Instruction ID: 8fea4bad12d15441dd4dac4c3c55ca99a0ebf1ec61145a184c26fcf88e54d9bf
                                                                                                                    • Opcode Fuzzy Hash: 7790bd36a42e865f7c718a67dc22d3f79e787f24dbf99b6834416aa25bbd7ff7
                                                                                                                    • Instruction Fuzzy Hash: 0E210436E4035AAADB119BB98800BEFFBB6AF14740F0580759E15E7380E270CD008BA0
                                                                                                                    Function 016AE420 Relevance: .1, Instructions: 88COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: c85d50102e704597547cb9ecc056b9453f7f057681f3fe68c0abdf33104ca808
                                                                                                                    • Instruction ID: d2e2cfd60a57bef2a44320627dc448085dc8fa587c084741ba40d0bdbc68bc89
                                                                                                                    • Opcode Fuzzy Hash: c85d50102e704597547cb9ecc056b9453f7f057681f3fe68c0abdf33104ca808
                                                                                                                    • Instruction Fuzzy Hash: 0731F532A0152C9BDB31DF18DC41FEEB7BEEB15740F4100A9E645A7290D775AE818FA0
                                                                                                                    Function 016E4588 Relevance: .1, Instructions: 87COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 277169c50a7bdf1e1def58b38a3c1dedac02a8c9ac2be01cc5a137e0a7ffea9f
                                                                                                                    • Instruction ID: 330da339369a0e4d8f97b414ae38bab8898a7958c7f825a9329f933824c60bee
                                                                                                                    • Opcode Fuzzy Hash: 277169c50a7bdf1e1def58b38a3c1dedac02a8c9ac2be01cc5a137e0a7ffea9f
                                                                                                                    • Instruction Fuzzy Hash: 63219131A01619EBCB11CF68CD84A8EBBF6FF48714F108569EE15DB242DA74EA05CF90
                                                                                                                    Function 016E44B0 Relevance: .1, Instructions: 87COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ae814c7407214844d89ad6ed95d1cc999d2a100dfff63ce6b597bfc832760b65
                                                                                                                    • Instruction ID: afe3d361644f672a18d58d0e3e693d1f1a5560a4327f6fc579e05f4ddbc4fb50
                                                                                                                    • Opcode Fuzzy Hash: ae814c7407214844d89ad6ed95d1cc999d2a100dfff63ce6b597bfc832760b65
                                                                                                                    • Instruction Fuzzy Hash: 2D21A0726097459BC721CF68CC84B6BB7E5FB88760F01861DF9549B681DB34E901CBA2
                                                                                                                    Function 016AE388 Relevance: .1, Instructions: 86COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 44134b3cc04c3b9165643a468610c299cbef36331bc2ea93ac49eb48e3b8bc4a
                                                                                                                    • Instruction ID: ec353d08943961fa2bdf1a850cd31df6ae6bf57e7461d45534f3aa4acf5ce43d
                                                                                                                    • Opcode Fuzzy Hash: 44134b3cc04c3b9165643a468610c299cbef36331bc2ea93ac49eb48e3b8bc4a
                                                                                                                    • Instruction Fuzzy Hash: 16318931600605EFEB21CFA8C984F6AB7F9FF85354F1045A9E9528B291E771EE02CB50
                                                                                                                    Function 0172E609 Relevance: .1, Instructions: 86COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b147af1ee8e3fd12797eec996c8a00d2f7420e0b907fd2ce638704925298275e
                                                                                                                    • Instruction ID: ce336413a8551f6af14e8da40d98effb68abb9aa293b859d886f2a9ed360d649
                                                                                                                    • Opcode Fuzzy Hash: b147af1ee8e3fd12797eec996c8a00d2f7420e0b907fd2ce638704925298275e
                                                                                                                    • Instruction Fuzzy Hash: 8831AE75A00256DFCB24CF1CC884DAEB7B6FF84304B198459F8099B391EB71EA52CB94
                                                                                                                    Function 016D8CB1 Relevance: .1, Instructions: 85COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: be42928480fe83a6920f429437d80c1551646c43924c5eabe80f3f6a5d3481a8
                                                                                                                    • Instruction ID: 8d7098004fae4a36541e6fa9aecc4cb2b46a9acc8b8504d24d3c2f6267ca3edf
                                                                                                                    • Opcode Fuzzy Hash: be42928480fe83a6920f429437d80c1551646c43924c5eabe80f3f6a5d3481a8
                                                                                                                    • Instruction Fuzzy Hash: DA214F37901215ABDB329A8DCC48FAFBB7DEF95690F154065FA059B244C734DD01CB90
                                                                                                                    Function 016B8D59 Relevance: .1, Instructions: 83COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 771e0484a404b195372877301509bf43f816fb0c262265de74eede4d8511304c
                                                                                                                    • Instruction ID: 4638eb0d473c7fd667e9815783e458993d6c01b3773669053bcee10fb72b51b2
                                                                                                                    • Opcode Fuzzy Hash: 771e0484a404b195372877301509bf43f816fb0c262265de74eede4d8511304c
                                                                                                                    • Instruction Fuzzy Hash: BD2145327406819BE726972CDD58BB5BBBCEF40B50F2940A9DE42877D3E364DC41C260
                                                                                                                    Function 017306F1 Relevance: .1, Instructions: 79COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: be19f804ebd41d66484c6f0c14fcc4e6f03f370cfccc85ad0d960d971a2dfdcd
                                                                                                                    • Instruction ID: 6ba2bae935728fb9f0d659001c0ea86cceafd9db0fe35434ca75c33046192d89
                                                                                                                    • Opcode Fuzzy Hash: be19f804ebd41d66484c6f0c14fcc4e6f03f370cfccc85ad0d960d971a2dfdcd
                                                                                                                    • Instruction Fuzzy Hash: 932191719001299BCF11DF59CC81ABEB7F9FF48740B514069F941A7241D738AD42CFA4
                                                                                                                    Function 0173019F Relevance: .1, Instructions: 78COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 85d8a5259c25c90e264644cca44afe1da49fae74ed9b9508b90d1ab640c3458b
                                                                                                                    • Instruction ID: 126c68d1cf9f7c5d772ff0a18094293e5722fc22399ef238c9a101cce6c176f1
                                                                                                                    • Opcode Fuzzy Hash: 85d8a5259c25c90e264644cca44afe1da49fae74ed9b9508b90d1ab640c3458b
                                                                                                                    • Instruction Fuzzy Hash: 25218972600645ABD715DB6CCD84A6AB7A8FF88B40F14406DF904DB7A2D634ED40CBA8
                                                                                                                    Function 01730283 Relevance: .1, Instructions: 74COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e712abe0d90965fe03148294eac2c4840326eabae48df280f28a9b7142af5cc0
                                                                                                                    • Instruction ID: 5dad5c48ae2916ac7cf3caf65ee84daaf28501a8a9249bcd130dad85612b8afe
                                                                                                                    • Opcode Fuzzy Hash: e712abe0d90965fe03148294eac2c4840326eabae48df280f28a9b7142af5cc0
                                                                                                                    • Instruction Fuzzy Hash: 7121AF729082469FD711EF69CD48BABFBDCEFD1640F08445EB98087252D734D904C7A6
                                                                                                                    Function 016D2835 Relevance: .1, Instructions: 73COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 64bd2d788f028294e4b4c6a3bcbecf18752c6c781c12e43fea1a3c70f58add07
                                                                                                                    • Instruction ID: e0335410bc9c8f7d4dc9a1ef2691818e42344d1ae09c6cb74b579ab9a8ef49b6
                                                                                                                    • Opcode Fuzzy Hash: 64bd2d788f028294e4b4c6a3bcbecf18752c6c781c12e43fea1a3c70f58add07
                                                                                                                    • Instruction Fuzzy Hash: 77213E32B05AC19BE323572C8D19F247B95EF41B70F2903ACF9709B7D6DB68D8428254
                                                                                                                    Function 016B6C50 Relevance: .1, Instructions: 73timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: e8ccae6e2f7e35f84e7bb989f2678c939a5afa5094da6a1dc038476e0161c08b
                                                                                                                    • Instruction ID: f3d96470a2c70ec155412cf33efb45ddb5820ca6a8176bcc6181f0d9f31cf51b
                                                                                                                    • Opcode Fuzzy Hash: e8ccae6e2f7e35f84e7bb989f2678c939a5afa5094da6a1dc038476e0161c08b
                                                                                                                    • Instruction Fuzzy Hash: CA318875601600CFC721CF6CC480B66BBE9FB88714F2484ADEA498B756DB31ED82CB90
                                                                                                                    Function 016EA30B Relevance: .1, Instructions: 70COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: af4ae299fc123972116c588dfc07c15c2a520cadab53db190fc57dfd47a58e8e
                                                                                                                    • Instruction ID: 6d9e938641e2e8a53b647e9a233403af2532c9ce8954b79366caf06d66972ca6
                                                                                                                    • Opcode Fuzzy Hash: af4ae299fc123972116c588dfc07c15c2a520cadab53db190fc57dfd47a58e8e
                                                                                                                    • Instruction Fuzzy Hash: 70219875241A119BC725DF69CC00B56B7E6EF48B04F24856CE509CBB62E371E842CB98
                                                                                                                    Function 01730946 Relevance: .1, Instructions: 70COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5af591cfb2e6d5b9d8f0c006822662ec8e25e7d05d9d54ef910123be701e2fd5
                                                                                                                    • Instruction ID: e93e1e9d18966d5a6a067d9f38e6ffc4bb57fe17a5114c18d9509bd230f8e993
                                                                                                                    • Opcode Fuzzy Hash: 5af591cfb2e6d5b9d8f0c006822662ec8e25e7d05d9d54ef910123be701e2fd5
                                                                                                                    • Instruction Fuzzy Hash: 6021E5B1E01249AFCB24DFAAD891AAEFBF9FF98610F10012FE505A7241DA709941CF54
                                                                                                                    Function 016C0BBE Relevance: .1, Instructions: 70COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0c69f4241e00a3ad9eb09b93fc90bf6c9fa7e6f95e9c03497c24141396e2d63e
                                                                                                                    • Instruction ID: f392f4826811b8618ffc47bad20b28f88a91d0dc544f90735468e2769974b5f7
                                                                                                                    • Opcode Fuzzy Hash: 0c69f4241e00a3ad9eb09b93fc90bf6c9fa7e6f95e9c03497c24141396e2d63e
                                                                                                                    • Instruction Fuzzy Hash: DE11CD39394142DFDB29DA18C855B7AF3A5EF82A15F18815DF8068B259DB30D881CB54
                                                                                                                    Function 016E0124 Relevance: .1, Instructions: 68COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 46eb36b7a6c8140c37ab79ae24ad727a5b013edb67e3bfdf748b7c30626e4c0d
                                                                                                                    • Instruction ID: 30560f4e1bfc5785ac8982b511cbb1de0907efd96c76f928c022f23366bb5f48
                                                                                                                    • Opcode Fuzzy Hash: 46eb36b7a6c8140c37ab79ae24ad727a5b013edb67e3bfdf748b7c30626e4c0d
                                                                                                                    • Instruction Fuzzy Hash: E711E273602605BFD7269F94CC84F9ABBB9EB80755F10012DF6008F280D6B1ED44CB54
                                                                                                                    Function 016B8770 Relevance: .1, Instructions: 68COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b14fd61afd372dd27cec6cff7b5d20bba2dac0671b10ec2035849835ef3ae5e3
                                                                                                                    • Instruction ID: 8e2f037538c22324bd404d10b4e187c819e9888b85654db9e2342ec57b6d07b1
                                                                                                                    • Opcode Fuzzy Hash: b14fd61afd372dd27cec6cff7b5d20bba2dac0671b10ec2035849835ef3ae5e3
                                                                                                                    • Instruction Fuzzy Hash: D611B2717116119BDB11CF4DC8C0AEABBEDAF8A715B1940BDEE089F304D7B2D9428790
                                                                                                                    Function 016EAAEE Relevance: .1, Instructions: 68COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 24a1be8a3b3cecc6c09c2884dded5306318366361ede00ec49aaa0184f86d080
                                                                                                                    • Instruction ID: 61d842b767e2ededb9da01dcfdf970f12c4e6f314c5e79b3f13e09006ac63bf4
                                                                                                                    • Opcode Fuzzy Hash: 24a1be8a3b3cecc6c09c2884dded5306318366361ede00ec49aaa0184f86d080
                                                                                                                    • Instruction Fuzzy Hash: AF218E71601641DFDB318F89C948A66FBE7EB94B50F148A3DE94687710C730EC02CB40
                                                                                                                    Function 016B80E9 Relevance: .1, Instructions: 66COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 88bb7655c411362eef079986abbbfe7444fa9efe135857a3159ae8b40e56765a
                                                                                                                    • Instruction ID: a0e6470552ead2b9c0d3e9c12f9dcaeb59c54def34553683aa2d49988b62de83
                                                                                                                    • Opcode Fuzzy Hash: 88bb7655c411362eef079986abbbfe7444fa9efe135857a3159ae8b40e56765a
                                                                                                                    • Instruction Fuzzy Hash: 7E216D75A01206DFCB14CF98C981AAEBBB9FB88719F24416DD105AB351CB71AD46CBD0
                                                                                                                    Function 016E674D Relevance: .1, Instructions: 65COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 23d90dc6762a523a227d848bc95e1998bfe9c2c6893954a63df03b1374cb7ec7
                                                                                                                    • Instruction ID: 8531d45c3161b236ea4698026082b9e4b1fb00bad48d61cfa2a08476a0dd5f4c
                                                                                                                    • Opcode Fuzzy Hash: 23d90dc6762a523a227d848bc95e1998bfe9c2c6893954a63df03b1374cb7ec7
                                                                                                                    • Instruction Fuzzy Hash: BD218C71641A01EFDB208F68CC80B76B7E9FF94650F44892DE5AAC7251EB70E841CB64
                                                                                                                    Function 016AEA80 Relevance: .1, Instructions: 64COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 30d54c5fc2799f518ac342c0b5fe61ca8f60b70b38c163c7bb3cfb4be493ff34
                                                                                                                    • Instruction ID: e26bca8eafbd44b7885e04bfbca2b78a396b5a9f64e7b79c1baf5a28098630af
                                                                                                                    • Opcode Fuzzy Hash: 30d54c5fc2799f518ac342c0b5fe61ca8f60b70b38c163c7bb3cfb4be493ff34
                                                                                                                    • Instruction Fuzzy Hash: B3117CB1501741AFE3319F66CD84A57BBF8FF58784B40892DE54A87621E771E804CFA4
                                                                                                                    Function 016DE8C0 Relevance: .1, Instructions: 63COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 635177b941854d6df9dd7d564d63827bf73bcdf52d208460b621a8408439aeac
                                                                                                                    • Instruction ID: 22fa074927b1b604dc74c7fe9bbdfa26d3df37580c411cf6c651f9d9228ae87f
                                                                                                                    • Opcode Fuzzy Hash: 635177b941854d6df9dd7d564d63827bf73bcdf52d208460b621a8408439aeac
                                                                                                                    • Instruction Fuzzy Hash: 771148327051109BCB19CB29CC80A7BB757EFD1270B28853CE922CF380E931C802C690
                                                                                                                    Function 016C2B79 Relevance: .1, Instructions: 62COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e531b1b116e796ede91b05f1854db9c15806d6ee9a8b6133ec4facf08ddfcfd2
                                                                                                                    • Instruction ID: 6a21f14ee13ee2c45b166b1523d74c2bf55c38f1beb281d5375495e3a4ca81b3
                                                                                                                    • Opcode Fuzzy Hash: e531b1b116e796ede91b05f1854db9c15806d6ee9a8b6133ec4facf08ddfcfd2
                                                                                                                    • Instruction Fuzzy Hash: FD116D72A056589BDB22CF99DC94BBEBBB8FB04B54F09409EED04A7341C374AC41CB90
                                                                                                                    Function 016E66B0 Relevance: .1, Instructions: 61COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 1a9c24f6d64ce25a8c224571dff82ff0e07c23e45a8464ef18faf4dd51eb4475
                                                                                                                    • Instruction ID: 5c00f7b5346fd9096843597eb5af2615f097b977a2b6b653365a3711e80f5b88
                                                                                                                    • Opcode Fuzzy Hash: 1a9c24f6d64ce25a8c224571dff82ff0e07c23e45a8464ef18faf4dd51eb4475
                                                                                                                    • Instruction Fuzzy Hash: 5C11BC76A42205DBCB29CF59C988A6ABBE9EBA4610F05817DE9059B310EB30DD00CB94
                                                                                                                    Function 016B0AD0 Relevance: .1, Instructions: 61COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a0cb38f11a0ce4d193993f42e92a8429a61735cfa4d33da09d4f786176161830
                                                                                                                    • Instruction ID: 6958a4ae0fb1c8d45b32f0479d16152669e4249375b907960589847763759307
                                                                                                                    • Opcode Fuzzy Hash: a0cb38f11a0ce4d193993f42e92a8429a61735cfa4d33da09d4f786176161830
                                                                                                                    • Instruction Fuzzy Hash: 7A21E3B5A00B059FD3A0CF29C880B52BBF4FB48B10F10492EE98AC7B40E371E854CB94
                                                                                                                    Function 0173E7E1 Relevance: .1, Instructions: 59COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                                    • Instruction ID: 974ae55d81a0a5094b80b71119c969365b937abbc4f004badbf74c46f26e29df
                                                                                                                    • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                                    • Instruction Fuzzy Hash: A611A072A40605EFE7219F48CC44B9AFBE6EF85754F05942CEA099B1A2DF31EC40DB90
                                                                                                                    Function 016D27ED Relevance: .1, Instructions: 58COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 59de7919d2142b9dcdef64c6ac87f689a956e2e7c9529beb08c98e3e94f986b0
                                                                                                                    • Instruction ID: e0882029ce1019c91238224fe4e27f2d434572e5da508c3a4dca3f177509b8ce
                                                                                                                    • Opcode Fuzzy Hash: 59de7919d2142b9dcdef64c6ac87f689a956e2e7c9529beb08c98e3e94f986b0
                                                                                                                    • Instruction Fuzzy Hash: 20014972B06A85AFE326A66DDC98F77BB9DEF80750F06007DF9008B241DA14DC00C2B1
                                                                                                                    Function 016B4690 Relevance: .1, Instructions: 57COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 53dcee232b463db8b7910bbce02ad26279233721ba9b713f85f67eeca3b8c7b5
                                                                                                                    • Instruction ID: d319093e7bba9c36b2d9d850902b43173069bf01cc48af82161952a8ce03d45e
                                                                                                                    • Opcode Fuzzy Hash: 53dcee232b463db8b7910bbce02ad26279233721ba9b713f85f67eeca3b8c7b5
                                                                                                                    • Instruction Fuzzy Hash: 1B110236240655AFDB21CF59CC84FA67BA4EB86B64F00412AF9068B342CB71E881CF60
                                                                                                                    Function 016E6620 Relevance: .1, Instructions: 56COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0fc78c6e0e3a2bfc446240ca2fc80994e7ab7b0c1f8c1ab7fc674ca404084a1a
                                                                                                                    • Instruction ID: cc0d4a3c5c8c7dae64432cd8d5ab8a77dff92dcc9b2795f76b79d281ae0dcb25
                                                                                                                    • Opcode Fuzzy Hash: 0fc78c6e0e3a2bfc446240ca2fc80994e7ab7b0c1f8c1ab7fc674ca404084a1a
                                                                                                                    • Instruction Fuzzy Hash: 7C110232A02225ABDB22DF59CCC0B9EFBF9EF94740F500118EA01A7300D730AD008F55
                                                                                                                    Function 016DE53E Relevance: .1, Instructions: 55COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                                    • Instruction ID: 32f4b82d250dafa4607c1a1bc8d35df94090ec055d93978d0717422d330c4f1a
                                                                                                                    • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                                    • Instruction Fuzzy Hash: 2C11E5726016C29BE723A72CCD48B65BB95EF01B84F1900A4DE41CB742F72AD846C250
                                                                                                                    Function 0173E75D Relevance: .1, Instructions: 54COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                                    • Instruction ID: 266514135afb0a36744bab99a98d7163546c006b1cbf4ed2725b539ccbc44518
                                                                                                                    • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                                    • Instruction Fuzzy Hash: D701B932600115AFE7225F58CC44F67FBA9EFC5B60F058478EA459B162DB71DD80C790
                                                                                                                    Function 016AC301 Relevance: .1, Instructions: 53COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 778c373ea81032540963c18d56f6d779ce83a666a1fd403f9c7d5110ae95739e
                                                                                                                    • Instruction ID: b711915da18539f6019a8488cd0b675cec3cb30d87e5da863dc49a588bd73d20
                                                                                                                    • Opcode Fuzzy Hash: 778c373ea81032540963c18d56f6d779ce83a666a1fd403f9c7d5110ae95739e
                                                                                                                    • Instruction Fuzzy Hash: 05F0B4332416379FD7325A5D8C40B6BAA9A9FD4BA0B554039F3059B744CAA08D02ABD4
                                                                                                                    Function 016AA250 Relevance: .1, Instructions: 52COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                                    • Instruction ID: e36c75b8a7ef6750ce787601baabe814b7dde1ee8be51ce8f0a62b498e2330e5
                                                                                                                    • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                                    • Instruction Fuzzy Hash: 430126315047229BCB318F59DC40A327BA5EF55B60744C62EFD958B281C331E821CF60
                                                                                                                    Function 0172E1D0 Relevance: .1, Instructions: 51COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a5ee08929a6889f45198cf87983c139e8b595414782871d9c0f84eb1facf727f
                                                                                                                    • Instruction ID: 4a24c7cbedee534321e3c72848400d73450bc044557078bc171472dc5b7eaf1a
                                                                                                                    • Opcode Fuzzy Hash: a5ee08929a6889f45198cf87983c139e8b595414782871d9c0f84eb1facf727f
                                                                                                                    • Instruction Fuzzy Hash: 3411ED32241640EFCB15EF09CC80F56BBB9FF54B44F2000A8FA068B261C631ED01CB94
                                                                                                                    Function 016B6259 Relevance: .1, Instructions: 51COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ee6bfb66c79b0102cacfd0df8b86fe4dd7cbdf41d81da1c41ad7d61a11e4623d
                                                                                                                    • Instruction ID: 98d8ff8fb77efd81f5d04d05e790b5f1e79550bf5862a6ba7a3e667f1d428fb9
                                                                                                                    • Opcode Fuzzy Hash: ee6bfb66c79b0102cacfd0df8b86fe4dd7cbdf41d81da1c41ad7d61a11e4623d
                                                                                                                    • Instruction Fuzzy Hash: 3F115E7054121DABEB25AF68CD51FE9B275BF04714F5081DCA714A61E0D7709E81CF88
                                                                                                                    Function 016E6DA0 Relevance: .1, Instructions: 51COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7b57f4f4dfdc694a89b6360ad5c5c3f3bcd20a529a5f65e9c4b2c9bdc8e4456f
                                                                                                                    • Instruction ID: 75d4a62e0c3b7d66c50d7b22ee9101c61c46b53a27480cc86d52a0f63bb47686
                                                                                                                    • Opcode Fuzzy Hash: 7b57f4f4dfdc694a89b6360ad5c5c3f3bcd20a529a5f65e9c4b2c9bdc8e4456f
                                                                                                                    • Instruction Fuzzy Hash: EC014C7260A11567EF259B55CC08BAF7FE5DB50B50F04425DEA065B3C0EB74D881C3E0
                                                                                                                    Function 01736050 Relevance: .0, Instructions: 50COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0edbbdbfff4bc864ec62c834b5cb1364860f620988109440b8cfdb9c964b36ca
                                                                                                                    • Instruction ID: f7e569ed585b227d7cb53eb932ba11a7f90862154f49f7668f8800f635513f31
                                                                                                                    • Opcode Fuzzy Hash: 0edbbdbfff4bc864ec62c834b5cb1364860f620988109440b8cfdb9c964b36ca
                                                                                                                    • Instruction Fuzzy Hash: 35112973900019BBCB11DB94CC84EEFBBBDEF58254F044166E906E7211EA34EA55CBE0
                                                                                                                    Function 016B208A Relevance: .0, Instructions: 50COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                                    • Instruction ID: 70658ec632f9f70033396bab09972216510eb42bb481d9c28000188a421cd3eb
                                                                                                                    • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                                    • Instruction Fuzzy Hash: 4401F5326002018BDF229A29DCD0B92B7A7BFC4600F1540ADED018F286DA71ACC1C790
                                                                                                                    Function 0173C810 Relevance: .0, Instructions: 50COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 9a22e102aefd2bcbe1a99ee1a23a3b806a6420dc65a77dca2d2b651deb481446
                                                                                                                    • Instruction ID: 0dc3ef57042016efb6ad92af891b42bbe30c21e5bf2297c08e292b7802e8e656
                                                                                                                    • Opcode Fuzzy Hash: 9a22e102aefd2bcbe1a99ee1a23a3b806a6420dc65a77dca2d2b651deb481446
                                                                                                                    • Instruction Fuzzy Hash: 1911E8B1A002099BCB04DFA9D545AAEBBF9FF58250F10806AA905E7351D674EE41CBA4
                                                                                                                    Function 016AC020 Relevance: .0, Instructions: 49COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                                    • Instruction ID: 7cf37735854ddfd67a02371c006d455f705518318b74c61567ca09693212bfbe
                                                                                                                    • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                                    • Instruction Fuzzy Hash: 0B01DD32140705DFDB3396A9CD04FA7B7E9FFD5614F54841DA95687540DA71E802CB50
                                                                                                                    Function 016F20F0 Relevance: .0, Instructions: 49COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e75a513dfaa4df359bc728837a5d8cbbb256c3d610761d86df1514b220d32a29
                                                                                                                    • Instruction ID: e6a1b7addec0584ef45e5ce1fe72fabcaf50e4445c54364b6f6575c685fde2ab
                                                                                                                    • Opcode Fuzzy Hash: e75a513dfaa4df359bc728837a5d8cbbb256c3d610761d86df1514b220d32a29
                                                                                                                    • Instruction Fuzzy Hash: E3116D35A0020DAFCB05DF64CC51FAEBBB6FB45654F10405DEA019B290DA35EE12CB94
                                                                                                                    Function 016EE5CF Relevance: .0, Instructions: 49COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a41f1bb019fe921198e3159c9b104362888558204eb5bf81bc31434cbcaf2532
                                                                                                                    • Instruction ID: 687b1d128e87d8250d14933a7c658820b778327bc3cb13125d4a765d2dc91f2f
                                                                                                                    • Opcode Fuzzy Hash: a41f1bb019fe921198e3159c9b104362888558204eb5bf81bc31434cbcaf2532
                                                                                                                    • Instruction Fuzzy Hash: E201A771241A11BFD311AB79CD40E67F7EDFF95A54B04062DB60583651DB24EC11C6E8
                                                                                                                    Function 0173C460 Relevance: .0, Instructions: 48COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 78399f9cc9d2dda8b95151c76525e7960003bef5d53b1805840c6d1b6626266e
                                                                                                                    • Instruction ID: a94de7247811fa8b632c8458ed38fdff8fa1d31281df8e3942580cdae60e4e50
                                                                                                                    • Opcode Fuzzy Hash: 78399f9cc9d2dda8b95151c76525e7960003bef5d53b1805840c6d1b6626266e
                                                                                                                    • Instruction Fuzzy Hash: EA115B71A00209ABDB15EFA8C844EAEBBB6EB88350F00405AF901A7345DA35E911CB90
                                                                                                                    Function 0173C97C Relevance: .0, Instructions: 48COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 14ca8eabf642391e4adb1042b1d2d653537c6fd00a3ad88364a5b8786f14e181
                                                                                                                    • Instruction ID: f1112ca7559300c4150f2b0d3f937f4ac632b715e3ca56ed81fd2d8f2e4185d5
                                                                                                                    • Opcode Fuzzy Hash: 14ca8eabf642391e4adb1042b1d2d653537c6fd00a3ad88364a5b8786f14e181
                                                                                                                    • Instruction Fuzzy Hash: B4113C716183059FC700DF69D841A5BBBE4EF99710F00855FBA98D7351D630E900CB96
                                                                                                                    Function 0173CA11 Relevance: .0, Instructions: 48COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 60504a8b5322011576900e440c1c5f577d0860d7da39a6f7e5e6a40b10d60bec
                                                                                                                    • Instruction ID: ec4a6ec7cc6fd9a23c8780db53322d7c4883e30096411dd43a98c83597949737
                                                                                                                    • Opcode Fuzzy Hash: 60504a8b5322011576900e440c1c5f577d0860d7da39a6f7e5e6a40b10d60bec
                                                                                                                    • Instruction Fuzzy Hash: 9D1179B16083089FC300DF69C841A5BBBE4FF99750F00851FBA58D73A1E630E901CB96
                                                                                                                    Function 01712045 Relevance: .0, Instructions: 46COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d070d009cec517deda217c49c1204ab4902f8b4741d5b4904d4d9fbd3867cc99
                                                                                                                    • Instruction ID: cab4de9054d6336408677c732a13c808399a8c15bfd60572836180d8654d9e74
                                                                                                                    • Opcode Fuzzy Hash: d070d009cec517deda217c49c1204ab4902f8b4741d5b4904d4d9fbd3867cc99
                                                                                                                    • Instruction Fuzzy Hash: 73015A36A083118BE751CF19C840A6AF7E6EB98710F144A6AFA85A7365D731EC44C792
                                                                                                                    Function 016CE016 Relevance: .0, Instructions: 46COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                                    • Instruction ID: 7768cfc10826b348c96625c15c13b0a8641b37098003eeaaf2faa140217eb292
                                                                                                                    • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                                    • Instruction Fuzzy Hash: 95017C32300680DFE323861DC948F36BBE8EB55B54F0904AAFA09CB6E2D769DC51C661
                                                                                                                    Function 016A826B Relevance: .0, Instructions: 46COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ed09c6a2d71e6aa7dbb0185e9ea0117b9f2675f58e4756db669a4dec9be6691f
                                                                                                                    • Instruction ID: a133327bc7e8c9153ee4f4f567c09e39c967bcf4106eb19e35602a36fd13f7e9
                                                                                                                    • Opcode Fuzzy Hash: ed09c6a2d71e6aa7dbb0185e9ea0117b9f2675f58e4756db669a4dec9be6691f
                                                                                                                    • Instruction Fuzzy Hash: C401A731B00505DBD714EF69DC04ABFB7ADFF80620B9580699901A7785DE60DD01CAD0
                                                                                                                    Function 01734C0F Relevance: .0, Instructions: 46COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d3be3984540e4e2f443c66e54f6ebaa07f91019dbdb3e562b9108183fc108a71
                                                                                                                    • Instruction ID: 28906e7bff62fa4b4daee32df3462e679eaf8dcdd36d93c74da1504769eb627c
                                                                                                                    • Opcode Fuzzy Hash: d3be3984540e4e2f443c66e54f6ebaa07f91019dbdb3e562b9108183fc108a71
                                                                                                                    • Instruction Fuzzy Hash: C001F2B2B10306ABDB259F9DC9C0BADFBEDEBD4B50F440128EA0597202E7B4DC048754
                                                                                                                    Function 016B2582 Relevance: .0, Instructions: 45COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fdd90691d9d8dcec606c52f8f4aa6d2d15b052f4191f0c76aca3fa9c0d910a27
                                                                                                                    • Instruction ID: d4eb4ef78fae83b0073bda72b66e4b301a460007e426b7558f3452b69b2e7add
                                                                                                                    • Opcode Fuzzy Hash: fdd90691d9d8dcec606c52f8f4aa6d2d15b052f4191f0c76aca3fa9c0d910a27
                                                                                                                    • Instruction Fuzzy Hash: C8F0A433741B11BBC7329B5A8D90F97BAEEEB84E90F15446DE60697640DA30ED41CBA0
                                                                                                                    Function 016DC073 Relevance: .0, Instructions: 43COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 186ba59089a022de0fe75da19e9f9a25daa67385135c4d0e061e5f5da52e9a9e
                                                                                                                    • Instruction ID: 84aa0190b76ca2dd4fe8928dada1b2cd477f228b069803512820cce8cfd9ee7c
                                                                                                                    • Opcode Fuzzy Hash: 186ba59089a022de0fe75da19e9f9a25daa67385135c4d0e061e5f5da52e9a9e
                                                                                                                    • Instruction Fuzzy Hash: 0DF0AFB2A00615ABD324CF4D9D40E67FBEADBD5A80F04812CA605C7320EA31ED04CB90
                                                                                                                    Function 016ECA6F Relevance: .0, Instructions: 42COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                                                    • Instruction ID: 7306d421e07b0f0ffabb2c667470022f86de8d2435ba5b4cad92e8c1fe8b20b8
                                                                                                                    • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                                                    • Instruction Fuzzy Hash: 010144322016859BD3229B1CCC0CF99FBD8EF41710F0881A9FE048B7A2D77AC802C211
                                                                                                                    Function 017320DE Relevance: .0, Instructions: 41COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 3ea9f1ddad9bfb5b4ed44cbe36d528a65cb52b07c504df335728bdaec5edf3ac
                                                                                                                    • Instruction ID: 32936b10a3a6239097f0eda9d041387e05b2e07d7739b8a4e7aacc7d798ca9f2
                                                                                                                    • Opcode Fuzzy Hash: 3ea9f1ddad9bfb5b4ed44cbe36d528a65cb52b07c504df335728bdaec5edf3ac
                                                                                                                    • Instruction Fuzzy Hash: 2EF0C875740309BBEB24EA4CCD56FAABB6CEB80B64F50005DF6056B686D5B0A504C691
                                                                                                                    Function 017363C0 Relevance: .0, Instructions: 41COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b8876ef4560123714944e026a14010e42f3722aa8b4e83154c385705386cccce
                                                                                                                    • Instruction ID: 6f7f8b9b59836c99dd551e5ad99d5dff33cabb9201e2fd9be49ccf2a7347e193
                                                                                                                    • Opcode Fuzzy Hash: b8876ef4560123714944e026a14010e42f3722aa8b4e83154c385705386cccce
                                                                                                                    • Instruction Fuzzy Hash: 13F0127210001DBFEF019F94DD80DEFBB7EEB55698B104129FA1196160D631DE21A7A0
                                                                                                                    Function 016AC0F0 Relevance: .0, Instructions: 39COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2ac7f2dd838b006d3ba0a7711f763a0429e7de452b4ad1e1c3238f7a6b97afd3
                                                                                                                    • Instruction ID: f7d6dd5680fab4fd0a5b27fb76a1402767ad09320dbff7cf6f3a6c1331949ccd
                                                                                                                    • Opcode Fuzzy Hash: 2ac7f2dd838b006d3ba0a7711f763a0429e7de452b4ad1e1c3238f7a6b97afd3
                                                                                                                    • Instruction Fuzzy Hash: AAF024713043415BF750AA1D9C11B23729AE7D0652FA5806AEB058F7C1EE70EC028BB5
                                                                                                                    Function 016E656A Relevance: .0, Instructions: 39COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6c62e5f56168340588e2491fc6c55b34d05b3c954d787370079c07a53c9391ad
                                                                                                                    • Instruction ID: 833b1a2b0bcc0af56443e5a1db749307c678b4200eca5a90a28bf19fabfe3382
                                                                                                                    • Opcode Fuzzy Hash: 6c62e5f56168340588e2491fc6c55b34d05b3c954d787370079c07a53c9391ad
                                                                                                                    • Instruction Fuzzy Hash: D201A4703016819BE322972CCD4CF657BE4FB50B04F4842A8FA019B6E7D728D8428614
                                                                                                                    Function 016EA5D0 Relevance: .0, Instructions: 38COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 0f6c4338ec00d002c86ff99042277f9e3779f7d76078e733f5ff53a4180604cc
                                                                                                                    • Instruction ID: 365a9a029a36d12c9a4aa73969b6cdeb51ca10b0fa7f5e536f37d97b1cb6e12a
                                                                                                                    • Opcode Fuzzy Hash: 0f6c4338ec00d002c86ff99042277f9e3779f7d76078e733f5ff53a4180604cc
                                                                                                                    • Instruction Fuzzy Hash: FD012CB2201740AFD321DF64CE09B2277E8F785B25F058A7DB219C7180E330E801CB4A
                                                                                                                    Function 016C0218 Relevance: .0, Instructions: 36COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2dd544a27501035724fff92d651e066b698364279b8dc1ca24c2a9cf9974d7fa
                                                                                                                    • Instruction ID: 78ff30548ea1840ce882fd453dedec870e23661df9f9b6763a6a4d9fb230d14b
                                                                                                                    • Opcode Fuzzy Hash: 2dd544a27501035724fff92d651e066b698364279b8dc1ca24c2a9cf9974d7fa
                                                                                                                    • Instruction Fuzzy Hash: 8CF09479915601CFE32A9F18CC20730BBA2FB81F20FA1822EE5018B392D73CC845CB51
                                                                                                                    Function 0173E872 Relevance: .0, Instructions: 36COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 8131d6dfb1e0f05e7222055ba00f4a0047b676927548f67fe4833d003efa681a
                                                                                                                    • Instruction ID: 560edb845f61e9df3888acdcf2cd33a45b5b8272ad02801203bf0c5c61bab640
                                                                                                                    • Opcode Fuzzy Hash: 8131d6dfb1e0f05e7222055ba00f4a0047b676927548f67fe4833d003efa681a
                                                                                                                    • Instruction Fuzzy Hash: A9F08233F916129BE3319A4ECC80F96F7A9EFD5A60F191079AA049B261CB60EC41C7D0
                                                                                                                    Function 0173C89D Relevance: .0, Instructions: 36COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5e8c67742cd94a2274246658a6d095d17231590d32cf5f446d50982764761473
                                                                                                                    • Instruction ID: 791b9fc4ca9e496fc025f6d5cf47f6e2461de7f5991b8cee1e52f31f447d1128
                                                                                                                    • Opcode Fuzzy Hash: 5e8c67742cd94a2274246658a6d095d17231590d32cf5f446d50982764761473
                                                                                                                    • Instruction Fuzzy Hash: 6AF0C8716053049FC310EF38C945A1BB7E4FF98710F40465EB994DB391E634EA00C796
                                                                                                                    Function 016C266C Relevance: .0, Instructions: 35COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 1a8f62dd483dc2126bb4ef90645147c577306089457323c6210648aa526dea22
                                                                                                                    • Instruction ID: 558a048c297543c6e58f856f3baa093887e2b0bbadb5c9dd546cfece72ab2ad8
                                                                                                                    • Opcode Fuzzy Hash: 1a8f62dd483dc2126bb4ef90645147c577306089457323c6210648aa526dea22
                                                                                                                    • Instruction Fuzzy Hash: AEF090327156418FC312DF6DD840766F3E9FF55211B04417AE945C7205EB78D952CB94
                                                                                                                    Function 016E0854 Relevance: .0, Instructions: 35COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                                                    • Instruction ID: df9faf87b07c053c5964ef0e4f6e294cf784bb0feb2d062668eb21cc786c9f38
                                                                                                                    • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                                                    • Instruction Fuzzy Hash: ABF02472700201AFE714DB21CC04F57B6FAEF98340F258078A545C72A0FAB0ED01C654
                                                                                                                    Function 0173C912 Relevance: .0, Instructions: 34COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 33f0c530f3c1c8df6bcd59bb98013594cee980098d7ef07c2816204181ef166b
                                                                                                                    • Instruction ID: 6617b2bcee05cce0a7546b6edaf21bdb3417381fe495da39b7b0941fcf511e7f
                                                                                                                    • Opcode Fuzzy Hash: 33f0c530f3c1c8df6bcd59bb98013594cee980098d7ef07c2816204181ef166b
                                                                                                                    • Instruction Fuzzy Hash: 63F06270A01249DFCB04EF69C515BAEB7B5FF58300F00805AB955EB385DA34EA01CB54
                                                                                                                    Function 016B47FB Relevance: .0, Instructions: 33COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2d54ec047516dc784400605b7153a834d826a88a3cfff227c47f2af286d628b6
                                                                                                                    • Instruction ID: cb9d1443bb366ed218a58c1885c61f659be45bef1a3ba2bc6da2d8ab316df1f0
                                                                                                                    • Opcode Fuzzy Hash: 2d54ec047516dc784400605b7153a834d826a88a3cfff227c47f2af286d628b6
                                                                                                                    • Instruction Fuzzy Hash: 97F0B4319166E19FE732DB5CCCC4BA1BBE4DB01660F0A496AE58B87643CF64D8C0C791
                                                                                                                    Function 016EC5ED Relevance: .0, Instructions: 31COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 55d2fbd540321e24fc6ae4bdf7617f7801c164a7ef681b3377362c6a41ede44f
                                                                                                                    • Instruction ID: 6bbd48167efe7ec40cbebb92280fec2f30d837f4bc06b178cfb9c260114a39e7
                                                                                                                    • Opcode Fuzzy Hash: 55d2fbd540321e24fc6ae4bdf7617f7801c164a7ef681b3377362c6a41ede44f
                                                                                                                    • Instruction Fuzzy Hash: FFF0E2715136719FE3229B1CC94CB23BBE49B857A1F089725D44A87652C364E881CE50
                                                                                                                    Function 016F2619 Relevance: .0, Instructions: 31COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 45c25d90bbb005ca3a51a0e548ad18c23c0ce8c105f3add510330fe6c677b30c
                                                                                                                    • Instruction ID: 43d47a8f7fda50586a3e89d7eee14acbb919d7220a6ac0ffbc835e1b8974dc58
                                                                                                                    • Opcode Fuzzy Hash: 45c25d90bbb005ca3a51a0e548ad18c23c0ce8c105f3add510330fe6c677b30c
                                                                                                                    • Instruction Fuzzy Hash: 0DE0D8323006012BE7119E598CD0F577B6FDFD6B10F04007DB6045F252CAE2DC098AA8
                                                                                                                    Function 0172035C Relevance: .0, Instructions: 30COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d686609aa5636bbeb8eb45ce840330d6a3fe488abb698859fe5c2a4ac7472896
                                                                                                                    • Instruction ID: 7b840357b168373df11fd16e9897f2e04a463cdeab9be70e94b83f94e42026ab
                                                                                                                    • Opcode Fuzzy Hash: d686609aa5636bbeb8eb45ce840330d6a3fe488abb698859fe5c2a4ac7472896
                                                                                                                    • Instruction Fuzzy Hash: 42F01D31A55AC1DFE3278B1CCC48F657BA4EB01B60F1902D4F522CB6F2D7689842C615
                                                                                                                    Function 017201DA Relevance: .0, Instructions: 29COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 695efabd4245ad5634dfe4a889b4c53fedba2a3276a13ee318552dc71ff97b6c
                                                                                                                    • Instruction ID: ce3bd9ffb05cba84eb10471a112f1aa362b7333121c83f8aa60c14f5ecc2bde6
                                                                                                                    • Opcode Fuzzy Hash: 695efabd4245ad5634dfe4a889b4c53fedba2a3276a13ee318552dc71ff97b6c
                                                                                                                    • Instruction Fuzzy Hash: 4AF01F70608B81DFE321CFA8D440B26B7E4FB09300F0086AAF294CB6A1D374E841CB12
                                                                                                                    Function 016B0710 Relevance: .0, Instructions: 28COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                                    • Instruction ID: 9aa83a09331188d2edb44a93d6284d58af99676290d531bd2d9819833d1634c7
                                                                                                                    • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                                    • Instruction Fuzzy Hash: 43F0A03A204741DBDB26CF19C490AE6BBE8EB55350B0004A8F8468B341DB31E982CB54
                                                                                                                    Function 016E49D0 Relevance: .0, Instructions: 28COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                                                    • Instruction ID: d1eb67d7c0217158937b425b972a653fea1083cf302fa24f613943a20f78c7a7
                                                                                                                    • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                                                    • Instruction Fuzzy Hash: 60E09232245145ABD3211A6D8C08B6676E6DBD47B0F150529EA01CB258EF70DC41C79C
                                                                                                                    Function 016AEC20 Relevance: .0, Instructions: 28COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b2902f53431a9e488bb3a35122719d683f2200cde1b251d880592bb7dfab3b44
                                                                                                                    • Instruction ID: a37d9e0208206c2f0d16d93bd4fbac278e8dadb7bd90c4cfc1357ec78fb9a550
                                                                                                                    • Opcode Fuzzy Hash: b2902f53431a9e488bb3a35122719d683f2200cde1b251d880592bb7dfab3b44
                                                                                                                    • Instruction Fuzzy Hash: 4EF0E531184289AFEF18DB04CC04F157799EB04724F84841DF52A8B192CB76DC84CF68
                                                                                                                    Function 01734CA8 Relevance: .0, Instructions: 28COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 43eecd3c08fe7f7df93ce42b225f7ebba8bd63f8cfa5a27548bae60b679425d2
                                                                                                                    • Instruction ID: 7b1f3fff0cb5bad40734537a360b77ad53908e28dee944a38cf928d9c3bcecc1
                                                                                                                    • Opcode Fuzzy Hash: 43eecd3c08fe7f7df93ce42b225f7ebba8bd63f8cfa5a27548bae60b679425d2
                                                                                                                    • Instruction Fuzzy Hash: A2E026332001012AEE3563699D08FD3BF96DFC17B0F050029B60A874A1CF21C431C240
                                                                                                                    Function 016B25E0 Relevance: .0, Instructions: 23COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: a8588fdf70e6a11b697cf3251b9186f5ae95654d19cffd0ec6182796228b142d
                                                                                                                    • Instruction ID: 2dbddf02a0eaece8e7cc7badb2501981d2054d1a550138f4e7c5af7b7f562652
                                                                                                                    • Opcode Fuzzy Hash: a8588fdf70e6a11b697cf3251b9186f5ae95654d19cffd0ec6182796228b142d
                                                                                                                    • Instruction Fuzzy Hash: BAE092721005549BC321BB29DD51FDA7B9BEBA0764F01451DB11657190CB30B850C788
                                                                                                                    Function 01734000 Relevance: .0, Instructions: 22COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                                    • Instruction ID: 279616f50348b54e873b8af36f017f576ecaa1141ba5bba870c29589382a34a0
                                                                                                                    • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                                    • Instruction Fuzzy Hash: F4E0C2383003058FE719CF19C040B62BBB6FFD5A10F28C0A8A9498F206EB33E842CB40
                                                                                                                    Function 016ECA38 Relevance: .0, Instructions: 22COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a2b55090170c27f44c24eb9eed15c5cb093a92c8fca4f822841cbac43c92af12
                                                                                                                    • Instruction ID: 22f4ca41343392e67c454923a88844c4f0a84728e89fc5f70aa0975036aa615a
                                                                                                                    • Opcode Fuzzy Hash: a2b55090170c27f44c24eb9eed15c5cb093a92c8fca4f822841cbac43c92af12
                                                                                                                    • Instruction Fuzzy Hash: 5CD02B325870206ACB35E11C7C08FA33ADADB84760F018864F90892011D514CC8187C8
                                                                                                                    Function 0170E1D8 Relevance: .0, Instructions: 21COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 1fa6682665435e3bf81aac6b3c1c2a3abb7dabd95150390b2ab7a04d4b5ac629
                                                                                                                    • Instruction ID: c12110b7e96155a1ba7cbbd495b2d91129080f317e0d761fb12a6f704a83e718
                                                                                                                    • Opcode Fuzzy Hash: 1fa6682665435e3bf81aac6b3c1c2a3abb7dabd95150390b2ab7a04d4b5ac629
                                                                                                                    • Instruction Fuzzy Hash: 89E0C2723145509FD201D64CE890C3BFBEDFBC8200F500297F884D3610C229DE11CBA1
                                                                                                                    Function 016A823B Relevance: .0, Instructions: 21COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0dde1fb00fd2b926610cb540773fb9450d19403d8368e537e34001dc73afbaa9
                                                                                                                    • Instruction ID: aee8b6367db64d2a1da252a52bee6e3990546b292a0bc597b5a8c4250ea0ac60
                                                                                                                    • Opcode Fuzzy Hash: 0dde1fb00fd2b926610cb540773fb9450d19403d8368e537e34001dc73afbaa9
                                                                                                                    • Instruction Fuzzy Hash: 19E0C231040A14EFDB322F19DC10F61BAAAFF94B11F20886DE181170A48771AC82CF88
                                                                                                                    Function 016A8C8D Relevance: .0, Instructions: 21COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e6a1cdd19ba1a5464da095337881f18fe8733fdfe244ff243a2ac1a8627d2a69
                                                                                                                    • Instruction ID: 92b202d0b419df985639c021dfc294567acd48fe7831bb387f8402d4c2d08272
                                                                                                                    • Opcode Fuzzy Hash: e6a1cdd19ba1a5464da095337881f18fe8733fdfe244ff243a2ac1a8627d2a69
                                                                                                                    • Instruction Fuzzy Hash: E5E08631042621DED7326F16DD04F52B6A6BB50B12F40442DA103075F0C770DC85CE89
                                                                                                                    Function 016B2050 Relevance: .0, Instructions: 20COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: e2d6421fcf51fc0f2ce81205cad45689cf79449cff53899da0d2709727df72f5
                                                                                                                    • Instruction ID: cf8bf67d0b7791a078dff092abb6d8364e51b5b8c7bf6e1e27801616a6550a0e
                                                                                                                    • Opcode Fuzzy Hash: e2d6421fcf51fc0f2ce81205cad45689cf79449cff53899da0d2709727df72f5
                                                                                                                    • Instruction Fuzzy Hash: 7EE0C2321004606BC311FB5DDD50F9A739FEFA4770F044229F151872D0CA20BC40C798
                                                                                                                    Function 016E8A90 Relevance: .0, Instructions: 20COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                                                                                    • Instruction ID: 1d097c3e99036ade0c3005c860e611e76d217701d4cc3d7d5ed0f1c366c80346
                                                                                                                    • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                                                                                    • Instruction Fuzzy Hash: D1E08633111A1887C728DE1CD915B7277E8EF45720F09473EAA1347791C634E544C794
                                                                                                                    Function 016B2324 Relevance: .0, Instructions: 19COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 30376b8f6942b512d21a7ff22882938c19e04cf1545c63af249bf3b6d6559961
                                                                                                                    • Instruction ID: de1e031cef5a5963822f3265da410d79611907cd6693bd061cd2422b5f12316c
                                                                                                                    • Opcode Fuzzy Hash: 30376b8f6942b512d21a7ff22882938c19e04cf1545c63af249bf3b6d6559961
                                                                                                                    • Instruction Fuzzy Hash: EAE04631800186DFDB27AB59C9A4BEEFBB2FB88304F98005CD800321A0CB346890CB58
                                                                                                                    Function 016AA740 Relevance: .0, Instructions: 18COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 80a23e6447b73173346f2999f4b3a87c02860673b62991cded2a1bd378972dde
                                                                                                                    • Instruction ID: 655250f5ca61615808be86546d75d955ad288f867488ee552de74443372db81c
                                                                                                                    • Opcode Fuzzy Hash: 80a23e6447b73173346f2999f4b3a87c02860673b62991cded2a1bd378972dde
                                                                                                                    • Instruction Fuzzy Hash: 9FE08C30500545EBDB27AB9ACC94FEAFBB2BB88704F44059DD100265A0C728A8D0CF98
                                                                                                                    Function 01706AA4 Relevance: .0, Instructions: 17COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fb32f8a4abc51be972f9ddb29922803d5ff50af5a24517df2a19369e20eb1f2c
                                                                                                                    • Instruction ID: 6e82aa29634112922658baaf4b6e07d7cdfccd0034dc5d52c0479bb11caea467
                                                                                                                    • Opcode Fuzzy Hash: fb32f8a4abc51be972f9ddb29922803d5ff50af5a24517df2a19369e20eb1f2c
                                                                                                                    • Instruction Fuzzy Hash: 9ED05E36511A50EFC3329F1BEE00C53FBF9FBC4F20705062EA54583A20C670A846CBA0
                                                                                                                    Function 016EE59C Relevance: .0, Instructions: 16COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: daaa7d3009ea744d07f9e08accc962f8ae29a2b4d64e956cf5d4d68ea4780215
                                                                                                                    • Instruction ID: 9a9263f3b28e74c046fc33a1c48775eaa527be58dcbdfb6197b11608f3186380
                                                                                                                    • Opcode Fuzzy Hash: daaa7d3009ea744d07f9e08accc962f8ae29a2b4d64e956cf5d4d68ea4780215
                                                                                                                    • Instruction Fuzzy Hash: 98D0A932208620ABD732AA1CFC00FD373E9BB88B20F0A045DF008C7150C360AC82CA88
                                                                                                                    Function 0172E908 Relevance: .0, Instructions: 16COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ca9a9a0ba620b78d8a2c60997a25aa35dfde848f9b98ee4321ba6aa288af4782
                                                                                                                    • Instruction ID: ed1419424b9703532c18cf429dc182b4b4c58e95955d7bd44ab55cee8a9a1db0
                                                                                                                    • Opcode Fuzzy Hash: ca9a9a0ba620b78d8a2c60997a25aa35dfde848f9b98ee4321ba6aa288af4782
                                                                                                                    • Instruction Fuzzy Hash: EEE0EC35A506849FDF12DF59CA40F9EBBB5FB94B40F150058E5485B660C635A901CB40
                                                                                                                    Function 016AA0E3 Relevance: .0, Instructions: 15COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6fae157940f5a138273a1c795e13f34e5419f85a62f40bfb8e3377858a39b448
                                                                                                                    • Instruction ID: 62591badb98d755b3ff06b62da33e0ee330653ba2ad7c9f826852ec4dc49841a
                                                                                                                    • Opcode Fuzzy Hash: 6fae157940f5a138273a1c795e13f34e5419f85a62f40bfb8e3377858a39b448
                                                                                                                    • Instruction Fuzzy Hash: 5CD02232212030A3CB2856956C00FAB6906EF80A94F0A002E340A93A00C1048C43CAE0
                                                                                                                    Function 016EA830 Relevance: .0, Instructions: 14COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0eb8aa549dbf07f54bc0b203a27983cb9c38d34c775957e4477bfa26f88d2c7e
                                                                                                                    • Instruction ID: 30f4838e3642892b06b76e0483030c64cc7fb32b6570f400db0ee0ce29f84b9a
                                                                                                                    • Opcode Fuzzy Hash: 0eb8aa549dbf07f54bc0b203a27983cb9c38d34c775957e4477bfa26f88d2c7e
                                                                                                                    • Instruction Fuzzy Hash: 29D012371D054DBBCB119F66DC01FA57BA9E764BA0F448024B504875A0C63AE950D584
                                                                                                                    Function 016ECA24 Relevance: .0, Instructions: 14COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 350cac99465ff177df9e19d42dd434c9c867c91baf4da62ed88d98313d714c36
                                                                                                                    • Instruction ID: b8f9af6761c3aabf11a338fd175f41c3d069a4dd96da77a7bbf0a9ea12bd668f
                                                                                                                    • Opcode Fuzzy Hash: 350cac99465ff177df9e19d42dd434c9c867c91baf4da62ed88d98313d714c36
                                                                                                                    • Instruction Fuzzy Hash: 55D0A730502011CBDF16DF0CCE18D7E76F0FB10740B40016CEB0151520D325DC02C600
                                                                                                                    Function 016C02A0 Relevance: .0, Instructions: 13COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                                    • Instruction ID: eb00322307471ef32b43e3856a9017608f11166bdc406a45b4581491cc295407
                                                                                                                    • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                                    • Instruction Fuzzy Hash: FBD09239216A80CFD61A8B0CC9A4B2573A4FB44F44F814494E402CBB22E72CD940CA00
                                                                                                                    Function 016EC700 Relevance: .0, Instructions: 12COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4437e647b2b4e703394cfa8271e7a9dde31e81d5545b5ce8aedd04872345699a
                                                                                                                    • Instruction ID: 1a9a4cd45239b05e9e1f122571abaedf26ffac2fb41553e0cc582ec88d6464fe
                                                                                                                    • Opcode Fuzzy Hash: 4437e647b2b4e703394cfa8271e7a9dde31e81d5545b5ce8aedd04872345699a
                                                                                                                    • Instruction Fuzzy Hash: B2C01232290648AFC712AA99CD01F567BAAEBA8B40F004025F2048B670C631E820EA88
                                                                                                                    Function 016AE0D0 Relevance: .0, Instructions: 11COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: df9e894434fcc8d2dd4b6c1bf807ebecda3d68aef3b3137c3c184770ea1aff41
                                                                                                                    • Instruction ID: 26460b640d5b99528ffae38165594e6c41478c9894fbd0ac5ddff6981d00767b
                                                                                                                    • Opcode Fuzzy Hash: df9e894434fcc8d2dd4b6c1bf807ebecda3d68aef3b3137c3c184770ea1aff41
                                                                                                                    • Instruction Fuzzy Hash: C4C04CF7B140A0AA8714DF615804B76A58B93E5212B99C17DB195C2148D93AC8019A64
                                                                                                                    Function 016D0310 Relevance: .0, Instructions: 11COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                                    • Instruction ID: 8c16171356bd3db684a2e340a2ba455b885cb3a5180710aeea3f49d8bd9850bc
                                                                                                                    • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                                    • Instruction Fuzzy Hash: 0BD01236100249EFCB01DF41C890D9A772BFBD8710F108019FD19076108A31ED62DA50
                                                                                                                    Function 016EC7F0 Relevance: .0, Instructions: 10COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2a93b78b4f3aab30918e7eb6a748612c734bffc3b04e31a2f267280f2c313703
                                                                                                                    • Instruction ID: c2622d9c59b4f498559475e83739eb386b4228c7b45984b5ef66968e5051cae8
                                                                                                                    • Opcode Fuzzy Hash: 2a93b78b4f3aab30918e7eb6a748612c734bffc3b04e31a2f267280f2c313703
                                                                                                                    • Instruction Fuzzy Hash: 23C002353016458FCF12CB29C688A9DB7E4BB45640B4944D4E804DB722D665EC018B00
                                                                                                                    Function 016B0750 Relevance: .0, Instructions: 9COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                                    • Instruction ID: 0cf4c8904fa09592c1ca401a9e81b06bf22b33e93162f1094f773881b40529df
                                                                                                                    • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                                    • Instruction Fuzzy Hash: F7C04C75701641CFCF16DB19D794F5577E4F744740F154894E805CB721E625FC01CA10
                                                                                                                    Function 016EC68B Relevance: .0, Instructions: 8COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4104ecdd11a365f69b8417b2a1404e322110ede242665c0514157017a146bc99
                                                                                                                    • Instruction ID: 3a471c2c205b50084cfee024330d48f76e7b7539ba7cd9e94566c0fa1d6c5b64
                                                                                                                    • Opcode Fuzzy Hash: 4104ecdd11a365f69b8417b2a1404e322110ede242665c0514157017a146bc99
                                                                                                                    • Instruction Fuzzy Hash: 98C09232151450AFC722EB09CE85F563BAAFB64BA4FC84068B105C26A2C228E820CB58
                                                                                                                    Function 016EA060 Relevance: .0, Instructions: 7COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 75e1cf65d9f8c0e9fa4e3eee3b949005c21d4aa932b739b658db39a27f3808d6
                                                                                                                    • Instruction ID: 357b9ae71a6f29d1a6ee542246c318cd7c2078d37198924617b0c0855cbe9468
                                                                                                                    • Opcode Fuzzy Hash: 75e1cf65d9f8c0e9fa4e3eee3b949005c21d4aa932b739b658db39a27f3808d6
                                                                                                                    • Instruction Fuzzy Hash: C7B012730218809BC71A6F04ED40E413766E7D4730F36046CB007478608A25DC51D608
                                                                                                                    Function 0171634C Relevance: .0, Instructions: 4COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: ab27d0e19bc8b3d3cc183f932446174a87e1dae8b67ccaab3f7db6ffdfc867e2
                                                                                                                    • Instruction ID: 743c54f749fe6e3a6f39fca419838d5e249dfa5446e5d37bd539dcce4efcd3ae
                                                                                                                    • Opcode Fuzzy Hash: ab27d0e19bc8b3d3cc183f932446174a87e1dae8b67ccaab3f7db6ffdfc867e2
                                                                                                                    • Instruction Fuzzy Hash: D5B011B2202880CBC202CB88E8A8B20B3A0FB00A00F0000A8A80283A02C228E8208800
                                                                                                                    Function 016EA950 Relevance: .0, Instructions: 4COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 581a630ff1c3e78aa7bd7181688fc29c6c476f27700cb95cafc8dc3a50891ae5
                                                                                                                    • Instruction ID: ae9d4c3138aa6fa964cb9698e2db7142be720813fb0b60309e6eb27356cda8a6
                                                                                                                    • Opcode Fuzzy Hash: 581a630ff1c3e78aa7bd7181688fc29c6c476f27700cb95cafc8dc3a50891ae5
                                                                                                                    • Instruction Fuzzy Hash: 2EA011320208808BCB02AB08CE80A00B22ABB00A00F8008A8A00002832822888008A00
                                                                                                                    Function 01712BF6 Relevance: .0, Instructions: 4COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fb6497d98dbca5d8ab111afa168aff7ee6b11b9e5a0af3185f73636f9294bcf1
                                                                                                                    • Instruction ID: 79b56af39344125651d59b800b50392623c5eb2293423a4aeabda25fb6e1ef3c
                                                                                                                    • Opcode Fuzzy Hash: fb6497d98dbca5d8ab111afa168aff7ee6b11b9e5a0af3185f73636f9294bcf1
                                                                                                                    • Instruction Fuzzy Hash: DAB011B2202C80CBC202CB88C888B2033A0FB00B00F0008A0A80283A02C22CEAA0CA00
                                                                                                                    Function 016E0A50 Relevance: .0, Instructions: 4COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 3b0b307c3be0d404b29e4e027334f1b7dbcccb1ed22bba2e199e3f74ee91561b
                                                                                                                    • Instruction ID: 9d66f165d8133dd221c86d749209b95cc1f739683ea712ff2c3b23dcf8710710
                                                                                                                    • Opcode Fuzzy Hash: 3b0b307c3be0d404b29e4e027334f1b7dbcccb1ed22bba2e199e3f74ee91561b
                                                                                                                    • Instruction Fuzzy Hash: 04A02232222880CFCB03BF88CE00F0033B2FB00A00FC882A8B002838B2822CCC00CA00
                                                                                                                    Function 016F4A80 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 51timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: 0I8w$0I8w$0I8w$0I8w$0I8w$0I8w
                                                                                                                    • API String ID: 3446177414-2549722193
                                                                                                                    • Opcode ID: e8013205a08d2a146238cf656fab8deea651012a3230cf8695514e123370899f
                                                                                                                    • Instruction ID: 168348995f0916504f147618ce9b2593668b22c9061cdf707e80d149726473df
                                                                                                                    • Opcode Fuzzy Hash: e8013205a08d2a146238cf656fab8deea651012a3230cf8695514e123370899f
                                                                                                                    • Instruction Fuzzy Hash: 7301B532E892115AD7609E2CBC087877BD1B7C5778FC5816DEB088F289DB705C61D394
                                                                                                                    Function 016F2890 Relevance: 9.2, APIs: 6, Instructions: 190COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ___swprintf_l
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 48624451-0
                                                                                                                    • Opcode ID: ff75d7c849805be9e858107ebaadff3f8b6313d71b32b5ef2b5e3512b1cd39f6
                                                                                                                    • Instruction ID: 22dd7e3688224ae4a30785550cbc9ec3523567b46570e8a25017821193a72dbd
                                                                                                                    • Opcode Fuzzy Hash: ff75d7c849805be9e858107ebaadff3f8b6313d71b32b5ef2b5e3512b1cd39f6
                                                                                                                    • Instruction Fuzzy Hash: 2C51D6B5A00256AFCB11DB9D8C9097FFBB8BB08240B54826DF565D7641D334DE458BA0
                                                                                                                    Function 016CA250 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 404COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 017179FA
                                                                                                                    • SsHd, xrefs: 016CA3E4
                                                                                                                    • RtlpFindActivationContextSection_CheckParameters, xrefs: 017179D0, 017179F5
                                                                                                                    • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 017179D5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                                                                                                    • API String ID: 0-929470617
                                                                                                                    • Opcode ID: 061bbe1a373cfe35810069fac16f549dc3c2637e66c9360b0fe0627bfe41bae0
                                                                                                                    • Instruction ID: b66aac4733b5cc96afcd24f824c86825f421271e56a593b916bb08cbed33ecb1
                                                                                                                    • Opcode Fuzzy Hash: 061bbe1a373cfe35810069fac16f549dc3c2637e66c9360b0fe0627bfe41bae0
                                                                                                                    • Instruction Fuzzy Hash: FAE1B1716043068FD725CEACCC94B3ABBE1EB84B14F148A2DE956CB395E731D985CB81
                                                                                                                    Function 016CD770 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 0171936B
                                                                                                                    • RtlpFindActivationContextSection_CheckParameters, xrefs: 01719341, 01719366
                                                                                                                    • GsHd, xrefs: 016CD874
                                                                                                                    • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 01719346
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: GsHd$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
                                                                                                                    • API String ID: 3446177414-576511823
                                                                                                                    • Opcode ID: f0908942ed59c6ce4040a053b197258752e9a9b762a99fcc96cb01ecc966a4a0
                                                                                                                    • Instruction ID: dcf2bfee9d92321bda2ff985d92cded254b7c6bad732648c648e65865d805ef0
                                                                                                                    • Opcode Fuzzy Hash: f0908942ed59c6ce4040a053b197258752e9a9b762a99fcc96cb01ecc966a4a0
                                                                                                                    • Instruction Fuzzy Hash: 92E1C1746043429FDB20CF5CC890B6BBBE5FB88718F144A3DEA958B285D770E845CB92
                                                                                                                    Function 016FB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __aulldvrm
                                                                                                                    • String ID: +$-$0$0
                                                                                                                    • API String ID: 1302938615-699404926
                                                                                                                    • Opcode ID: 3c0166d9ed1e6585338f8beb812d0714c23e94af90cb0c8803cf42abb3091ffa
                                                                                                                    • Instruction ID: faadc6f7a6e447a6bd3e962208ff1e5096a7cba03e3d72da589e135dde6ec7c3
                                                                                                                    • Opcode Fuzzy Hash: 3c0166d9ed1e6585338f8beb812d0714c23e94af90cb0c8803cf42abb3091ffa
                                                                                                                    • Instruction Fuzzy Hash: 7C81CE70E052599EEF298E6CCC917FEBBB2AF85320F1C421EDA61A7391C7349841CB55
                                                                                                                    Function 016B9126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: $$@
                                                                                                                    • API String ID: 3446177414-1194432280
                                                                                                                    • Opcode ID: 62e7aa8cf2220ac4365e15ec8e7a8fb425c5fcb1edf52ac7482a11a9272a2906
                                                                                                                    • Instruction ID: 19570fba6693a8cb16151a890a77b978aefa9711920b12cdc1fda8034f62aaa6
                                                                                                                    • Opcode Fuzzy Hash: 62e7aa8cf2220ac4365e15ec8e7a8fb425c5fcb1edf52ac7482a11a9272a2906
                                                                                                                    • Instruction Fuzzy Hash: 30812BB1D002699BDB31CB58CC44BEEB7B4AF48714F1441EAEA19B7680D7305E84CFA4
                                                                                                                    Function 016F4960 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: 0I8w$0I8w$0I8w$X
                                                                                                                    • API String ID: 3446177414-113150377
                                                                                                                    • Opcode ID: 71aeb3776d1e5a46663cd3856c07bfd7e6e279b6a40d337abdac552e6836307c
                                                                                                                    • Instruction ID: c45beb0e7642b9bc95f5f4951a428eb4f763b7405c914a93559694235c959ba4
                                                                                                                    • Opcode Fuzzy Hash: 71aeb3776d1e5a46663cd3856c07bfd7e6e279b6a40d337abdac552e6836307c
                                                                                                                    • Instruction Fuzzy Hash: 6731AE3190120AEBCF22CF5CDC44B8E7BB1AB89768F40806DFF1496249D7709A65DF85
                                                                                                                    Function 016DDB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: , passed to %s$Invalid heap signature for heap at %p$RtlUnlockHeap
                                                                                                                    • API String ID: 3446177414-56086060
                                                                                                                    • Opcode ID: 5621ce0c7280ea9c4cb2eda4e96d5ca84bc5cd81f0ea2f84997d0189f1b04bbb
                                                                                                                    • Instruction ID: 01ecd47a78398a63ef4c0012cf4d82f4bbe0c00436e589a0c1a0b0e06e709787
                                                                                                                    • Opcode Fuzzy Hash: 5621ce0c7280ea9c4cb2eda4e96d5ca84bc5cd81f0ea2f84997d0189f1b04bbb
                                                                                                                    • Instruction Fuzzy Hash: 53413371A00741EFD722EF6CC885B6ABBA4EF45728F148569E54287395CB74A884CB90
                                                                                                                    Function 016DDBA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: , passed to %s$Invalid heap signature for heap at %p$RtlLockHeap
                                                                                                                    • API String ID: 3446177414-3526935505
                                                                                                                    • Opcode ID: 599c5c1ca0ad624b1eb6dd8f3ef4c3de55f50c940c26373d637f5f871ec0b075
                                                                                                                    • Instruction ID: d5220a3dd67178931b62a095ad9d56458f4297be7c0b36b695a0dfe9f43b1492
                                                                                                                    • Opcode Fuzzy Hash: 599c5c1ca0ad624b1eb6dd8f3ef4c3de55f50c940c26373d637f5f871ec0b075
                                                                                                                    • Instruction Fuzzy Hash: 40313631504784DFE722FB6CCC19BA6BBE8EF01B60F448199E44387696C7F8A884CB51
                                                                                                                    Function 016AC070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: $
                                                                                                                    • API String ID: 3446177414-3993045852
                                                                                                                    • Opcode ID: ebc2af14998b6c106812545bfe9c788e250bdb10e05f3ef05e98a3c399f2041f
                                                                                                                    • Instruction ID: 41f5b427b72f177ae5fa3b03d8ac8edbf2d0b2ce905abcbca70d6bd243342c0e
                                                                                                                    • Opcode Fuzzy Hash: ebc2af14998b6c106812545bfe9c788e250bdb10e05f3ef05e98a3c399f2041f
                                                                                                                    • Instruction Fuzzy Hash: A4115E32904318EBCF26AF94EC486ACBB72FF84774F108119F926672D0CB716A50CB80
                                                                                                                    Function 016DEF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 0f780c76bf352ee39d134c3bcce3765609e8b9c21059702dfc66c12429045ba9
                                                                                                                    • Instruction ID: 822d749b1460a8477d33bcf7cd46b54a5bd4fb1a31beecf16f6e5393672fc33d
                                                                                                                    • Opcode Fuzzy Hash: 0f780c76bf352ee39d134c3bcce3765609e8b9c21059702dfc66c12429045ba9
                                                                                                                    • Instruction Fuzzy Hash: DAE10071D00608DFCB25CFA9C980AADFBF1BF48314F2485AAE946A7361D770A942CF50
                                                                                                                    Function 0172EF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: a50b8aa3eb4d399175e0ee73131ec21662ac80efe4a8616c241a257b8687e5dc
                                                                                                                    • Instruction ID: 5764a22a1022c0209fb472e9172af6d4202d57cd71664c094fb481d9563a75b4
                                                                                                                    • Opcode Fuzzy Hash: a50b8aa3eb4d399175e0ee73131ec21662ac80efe4a8616c241a257b8687e5dc
                                                                                                                    • Instruction Fuzzy Hash: 27711571E002299FDF05CFA8C984AEDFBB5BF49714F15402AEA05FB254D734A906CBA4
                                                                                                                    Function 0172F1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3446177414-0
                                                                                                                    • Opcode ID: 9f161ab3eb423f2c5d78efcffddac8130b62c432fd30704051f076c65d8fe6b9
                                                                                                                    • Instruction ID: baa67f0b3cf7b52cd8af4a6ac077c66a496cb6f2df8a635fcfaa9a0940432019
                                                                                                                    • Opcode Fuzzy Hash: 9f161ab3eb423f2c5d78efcffddac8130b62c432fd30704051f076c65d8fe6b9
                                                                                                                    • Instruction Fuzzy Hash: C45101B6E002299FDF09CF98D845ADDFBF1BF49314F19812AE905AB291D734A902CF54
                                                                                                                    Function 016E7B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4281723722-0
                                                                                                                    • Opcode ID: f7f9ed810f910f312331091073d67a04351c139badd79e0100f7b76cf470d843
                                                                                                                    • Instruction ID: 0234d085e2b3c6f36174a3b9fa18315f20e1cc1c8b8b9f02b02ad16e209712b2
                                                                                                                    • Opcode Fuzzy Hash: f7f9ed810f910f312331091073d67a04351c139badd79e0100f7b76cf470d843
                                                                                                                    • Instruction Fuzzy Hash: BC310776E00229EFCF25DFA8D844AADBBF1BB48720F14812AE512B7294D7355D01CF54
                                                                                                                    Function 016B59C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 0-2766056989
                                                                                                                    • Opcode ID: 403899e9794ffeba0e2e74a24cf0a64aa52a74b60979d2ba916cfb603f4db113
                                                                                                                    • Instruction ID: 9f162cdff854a496f7aa713a4fde9f149eaf8b04157515041f679cc3da5e0f87
                                                                                                                    • Opcode Fuzzy Hash: 403899e9794ffeba0e2e74a24cf0a64aa52a74b60979d2ba916cfb603f4db113
                                                                                                                    • Instruction Fuzzy Hash: 03323670D0426ADFDB22DF68CD84BE9BBB5BB18304F0081E9D54AA7241D7B49AC5CF91
                                                                                                                    Function 016F7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __aulldvrm
                                                                                                                    • String ID: +$-
                                                                                                                    • API String ID: 1302938615-2137968064
                                                                                                                    • Opcode ID: d84d73e5c23e50fb3757e9c39722a22be4762bc4311d32b0c95698253cae6a4f
                                                                                                                    • Instruction ID: 3575b52f1180bb44adf63a81df13f7069c007861f0d613f5de7338933573bedb
                                                                                                                    • Opcode Fuzzy Hash: d84d73e5c23e50fb3757e9c39722a22be4762bc4311d32b0c95698253cae6a4f
                                                                                                                    • Instruction Fuzzy Hash: 42919071E0121A9AEB24DF6DCC81ABEBBA5BF44320F54461EEB65E73C0D7309941CB51
                                                                                                                    Function 016CD02D Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: Bl$l
                                                                                                                    • API String ID: 3446177414-208461968
                                                                                                                    • Opcode ID: 099ff8e36623607aa4492a2c461e0c050bbae0f3dd55831431a077600b47e617
                                                                                                                    • Instruction ID: 3afb29116c3dc230e7b3b41cdcae32d3b99d1b7aaec290401e45c266d2d00fdf
                                                                                                                    • Opcode Fuzzy Hash: 099ff8e36623607aa4492a2c461e0c050bbae0f3dd55831431a077600b47e617
                                                                                                                    • Instruction Fuzzy Hash: 4AA1A431A013299BEB319B98CC94BB9B7B6EB85714F0480FDDA0967241CB74AD85CBD1
                                                                                                                    Function 016F5DA4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __startOneArgErrorHandling.LIBCMT ref: 016F5E34
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorHandling__start
                                                                                                                    • String ID: pow
                                                                                                                    • API String ID: 3213639722-2276729525
                                                                                                                    • Opcode ID: 13267ecf5eeaff46b547e0516b20dac3a2e43a1fb495f94097c0d44a51c96dc0
                                                                                                                    • Instruction ID: 25eea3cb46210a6b8904d95215a0c31618509d63dcda22c88c9aa8868f35f44b
                                                                                                                    • Opcode Fuzzy Hash: 13267ecf5eeaff46b547e0516b20dac3a2e43a1fb495f94097c0d44a51c96dc0
                                                                                                                    • Instruction Fuzzy Hash: 67514771A0920696DB22BB1CCD0136E2F94EB40711F24C95CE3D7863D9EB748CA6CB4A
                                                                                                                    Function 016DD7B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • RtlDebugPrintTimes.NTDLL ref: 016DD959
                                                                                                                      • Part of subcall function 016B4859: RtlDebugPrintTimes.NTDLL ref: 016B48F7
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: $$$
                                                                                                                    • API String ID: 3446177414-233714265
                                                                                                                    • Opcode ID: 3244642a4ec1674d002a6bd3e885d1dbdcd30f8abf40cad208d50dce991a4531
                                                                                                                    • Instruction ID: 8a113b96fc6eabb9767f3a45309045a31c55775dfaf7b9e51266fe9c0aec7fe8
                                                                                                                    • Opcode Fuzzy Hash: 3244642a4ec1674d002a6bd3e885d1dbdcd30f8abf40cad208d50dce991a4531
                                                                                                                    • Instruction Fuzzy Hash: A2511F71E003469FDB21EFA8C8857ADBBB2BF88314F25815DD5056B2C5C770A885CB80
                                                                                                                    Function 0173CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 0173CFBD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CallFilterFunc@8
                                                                                                                    • String ID: @$@4Cw@4Cw
                                                                                                                    • API String ID: 4062629308-3101775584
                                                                                                                    • Opcode ID: 497ad50a5f3705fffcbe9b89d2ddff271adc4d67f616472d374c5e85a1d447e1
                                                                                                                    • Instruction ID: 1e228192486b6304c1cfdf759a57f645245786bf9d272fed2d50abbe56964b13
                                                                                                                    • Opcode Fuzzy Hash: 497ad50a5f3705fffcbe9b89d2ddff271adc4d67f616472d374c5e85a1d447e1
                                                                                                                    • Instruction Fuzzy Hash: 3641C0B1900225DFDB219FA9CC40AAEFBB9FF94B50F40812EEA05DB255D734D801CB64
                                                                                                                    Function 0172FD82 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: $
                                                                                                                    • API String ID: 3446177414-3993045852
                                                                                                                    • Opcode ID: fe5426f8c40937f87b5aa107e6eec80881882e24975e6b0c6003bcdaa75f69d1
                                                                                                                    • Instruction ID: 44c18f92134849e96b56f5967ed0e51ff70fa63cb84690f49662c194e7de1582
                                                                                                                    • Opcode Fuzzy Hash: fe5426f8c40937f87b5aa107e6eec80881882e24975e6b0c6003bcdaa75f69d1
                                                                                                                    • Instruction Fuzzy Hash: 79419E75E00219ABDF12DF99C880AEEFBB5FF48B14F144159E905A7341C7719D52CBA0
                                                                                                                    Function 016ADF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000009.00000002.2185169509.00000000016A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01680000, based on PE: true
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001680000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001687000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001700000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001706000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.0000000001742000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A3000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000009.00000002.2185169509.00000000017A9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_9_2_1680000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DebugPrintTimes
                                                                                                                    • String ID: 0$0
                                                                                                                    • API String ID: 3446177414-203156872
                                                                                                                    • Opcode ID: c816e2c38407b38de824ead4eb22e9406c40009a0ce871e3410274295ddb11d9
                                                                                                                    • Instruction ID: 34d5ee22a3cdd33f7ec591056262701318665d38f00008291d2e9fd0cf30bc8f
                                                                                                                    • Opcode Fuzzy Hash: c816e2c38407b38de824ead4eb22e9406c40009a0ce871e3410274295ddb11d9
                                                                                                                    • Instruction Fuzzy Hash: 984147B16087069FC311CF68C884A1BBBE5BB89318F44492EF988DB341D771EA15CF96

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:1%
                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                    Signature Coverage:10.1%
                                                                                                                    Total number of Nodes:69
                                                                                                                    Total number of Limit Nodes:7
                                                                                                                    execution_graph 20204 10da82dd 20208 10da831a 20204->20208 20205 10da83fa 20206 10da8328 SleepEx 20206->20206 20206->20208 20208->20205 20208->20206 20211 10db2f12 socket NtCreateFile getaddrinfo 20208->20211 20212 10da9432 NtCreateFile 20208->20212 20213 10da80f2 socket getaddrinfo 20208->20213 20211->20208 20212->20208 20213->20208 20214 10db4bac 20215 10db4bb1 20214->20215 20248 10db4bb6 20215->20248 20249 10daab72 20215->20249 20217 10db4c2c 20218 10db4c85 20217->20218 20220 10db4c69 20217->20220 20221 10db4c54 20217->20221 20217->20248 20263 10db2ab2 NtProtectVirtualMemory 20218->20263 20222 10db4c6e 20220->20222 20223 10db4c80 20220->20223 20259 10db2ab2 NtProtectVirtualMemory 20221->20259 20261 10db2ab2 NtProtectVirtualMemory 20222->20261 20223->20218 20227 10db4c97 20223->20227 20224 10db4c8d 20264 10dac102 ObtainUserAgentString NtProtectVirtualMemory 20224->20264 20231 10db4cbe 20227->20231 20232 10db4c9c 20227->20232 20229 10db4c5c 20260 10dabee2 ObtainUserAgentString NtProtectVirtualMemory 20229->20260 20230 10db4c76 20262 10dabfc2 ObtainUserAgentString NtProtectVirtualMemory 20230->20262 20235 10db4cd9 20231->20235 20236 10db4cc7 20231->20236 20231->20248 20253 10db2ab2 NtProtectVirtualMemory 20232->20253 20235->20248 20267 10db2ab2 NtProtectVirtualMemory 20235->20267 20265 10db2ab2 NtProtectVirtualMemory 20236->20265 20239 10db4cac 20254 10dabde2 ObtainUserAgentString 20239->20254 20240 10db4ccf 20266 10dac2f2 ObtainUserAgentString NtProtectVirtualMemory 20240->20266 20242 10db4ce5 20268 10dac712 ObtainUserAgentString NtProtectVirtualMemory 20242->20268 20246 10db4cb4 20255 10da8412 20246->20255 20251 10daab93 20249->20251 20250 10daacce 20250->20217 20251->20250 20252 10daacb5 CreateMutexExW 20251->20252 20252->20250 20253->20239 20254->20246 20256 10da8440 20255->20256 20257 10da8473 20256->20257 20258 10da844d CreateThread 20256->20258 20257->20248 20258->20248 20259->20229 20260->20248 20261->20230 20262->20248 20263->20224 20264->20248 20265->20240 20266->20248 20267->20242 20268->20248 20269 10dae8c2 20271 10dae934 20269->20271 20270 10dae9a6 20271->20270 20272 10dae995 ObtainUserAgentString 20271->20272 20272->20270 20273 10db3232 20275 10db325c 20273->20275 20276 10db3334 20273->20276 20274 10db3410 NtCreateFile 20274->20276 20275->20274 20275->20276 20277 10db4e12 20281 10db3942 20277->20281 20279 10db4e45 NtProtectVirtualMemory 20280 10db4e70 20279->20280 20282 10db3967 20281->20282 20282->20279 20283 10db3f82 20284 10db3fb8 20283->20284 20286 10db4081 20284->20286 20288 10db4022 20284->20288 20289 10db05b2 20284->20289 20287 10db4117 getaddrinfo 20286->20287 20286->20288 20287->20288 20290 10db060a socket 20289->20290 20291 10db05ec 20289->20291 20290->20286 20291->20290

                                                                                                                    Executed Functions

                                                                                                                    Function 10DB3232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642filenativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 291 10db3232-10db3256 292 10db38bd-10db38cd 291->292 293 10db325c-10db3260 291->293 293->292 294 10db3266-10db32a0 293->294 295 10db32bf 294->295 296 10db32a2-10db32a6 294->296 298 10db32c6 295->298 296->295 297 10db32a8-10db32ac 296->297 299 10db32ae-10db32b2 297->299 300 10db32b4-10db32b8 297->300 301 10db32cb-10db32cf 298->301 299->298 300->301 302 10db32ba-10db32bd 300->302 303 10db32f9-10db330b 301->303 304 10db32d1-10db32f7 call 10db3942 301->304 302->301 308 10db3378 303->308 309 10db330d-10db3332 303->309 304->303 304->308 312 10db337a-10db33a0 308->312 310 10db33a1-10db33a8 309->310 311 10db3334-10db333b 309->311 315 10db33aa-10db33d3 call 10db3942 310->315 316 10db33d5-10db33dc 310->316 313 10db333d-10db3360 call 10db3942 311->313 314 10db3366-10db3370 311->314 313->314 314->308 321 10db3372-10db3373 314->321 315->308 315->316 318 10db33de-10db340a call 10db3942 316->318 319 10db3410-10db3458 NtCreateFile call 10db3172 316->319 318->308 318->319 327 10db345d-10db345f 319->327 321->308 327->308 328 10db3465-10db346d 327->328 328->308 329 10db3473-10db3476 328->329 330 10db3478-10db3481 329->330 331 10db3486-10db348d 329->331 330->312 332 10db348f-10db34b8 call 10db3942 331->332 333 10db34c2-10db34ec 331->333 332->308 338 10db34be-10db34bf 332->338 339 10db38ae-10db38b8 333->339 340 10db34f2-10db34f5 333->340 338->333 339->308 341 10db34fb-10db34fe 340->341 342 10db3604-10db3611 340->342 343 10db355e-10db3561 341->343 344 10db3500-10db3507 341->344 342->312 349 10db3567-10db3572 343->349 350 10db3616-10db3619 343->350 346 10db3509-10db3532 call 10db3942 344->346 347 10db3538-10db3559 344->347 346->308 346->347 354 10db35e9-10db35fa 347->354 355 10db35a3-10db35a6 349->355 356 10db3574-10db359d call 10db3942 349->356 352 10db36b8-10db36bb 350->352 353 10db361f-10db3626 350->353 359 10db3739-10db373c 352->359 360 10db36bd-10db36c4 352->360 362 10db3628-10db3651 call 10db3942 353->362 363 10db3657-10db366b call 10db4e92 353->363 354->342 355->308 358 10db35ac-10db35b6 355->358 356->308 356->355 358->308 368 10db35bc-10db35e6 358->368 364 10db3742-10db3749 359->364 365 10db37c4-10db37c7 359->365 369 10db36c6-10db36ef call 10db3942 360->369 370 10db36f5-10db3734 360->370 362->308 362->363 363->308 379 10db3671-10db36b3 363->379 372 10db374b-10db3774 call 10db3942 364->372 373 10db377a-10db37bf 364->373 365->308 375 10db37cd-10db37d4 365->375 368->354 369->339 369->370 389 10db3894-10db38a9 370->389 372->339 372->373 373->389 380 10db37fc-10db3803 375->380 381 10db37d6-10db37f6 call 10db3942 375->381 379->312 387 10db382b-10db3835 380->387 388 10db3805-10db3825 call 10db3942 380->388 381->380 387->339 390 10db3837-10db383e 387->390 388->387 389->312 390->339 394 10db3840-10db3886 390->394 394->389
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateFile
                                                                                                                    • String ID: `
                                                                                                                    • API String ID: 823142352-2679148245
                                                                                                                    • Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                                                                                    • Instruction ID: a825fd6b9579a2e8892d1a8440246ea529b27ebc62087355b399d6b481b846bf
                                                                                                                    • Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                                                                                    • Instruction Fuzzy Hash: 8F225B70A18A499FCB99DF28C4956AEF7E1FB99300F41422EE85ED7250DF30E851DB81
                                                                                                                    Function 10DB4E12 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 430 10db4e12-10db4e6e call 10db3942 NtProtectVirtualMemory 433 10db4e7d-10db4e8f 430->433 434 10db4e70-10db4e7c 430->434
                                                                                                                    APIs
                                                                                                                    • NtProtectVirtualMemory.NTDLL ref: 10DB4E67
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MemoryProtectVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2706961497-0
                                                                                                                    • Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                                                                                    • Instruction ID: 54cfffe6d9d626c21384a64b81b489635f0fbc2e5d07f80b256e75f939096650
                                                                                                                    • Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                                                                                    • Instruction Fuzzy Hash: F801B134628B884F8B88EF6CD48112AB7E4FBCE314F000B3EE99AC3250EB70C5414B42
                                                                                                                    Function 10DB4E0A Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 435 10db4e0a-10db4e38 436 10db4e45-10db4e6e NtProtectVirtualMemory 435->436 437 10db4e40 call 10db3942 435->437 438 10db4e7d-10db4e8f 436->438 439 10db4e70-10db4e7c 436->439 437->436
                                                                                                                    APIs
                                                                                                                    • NtProtectVirtualMemory.NTDLL ref: 10DB4E67
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MemoryProtectVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2706961497-0
                                                                                                                    • Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                                                                                    • Instruction ID: f0b33b85fef60c7e869b90efea5a5a9dedd99feaee1a900689bd94a8040bb3a9
                                                                                                                    • Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                                                                                    • Instruction Fuzzy Hash: 3B01A234628B884B8B48EB2C94412A6B3E5FBCE314F004B3EE9DAC3240DB61D5024B82
                                                                                                                    Function 10DB3F82 Relevance: 20.1, APIs: 1, Strings: 10, Instructions: 815COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 0 10db3f82-10db3fb6 1 10db3fb8-10db3fbc 0->1 2 10db3fd6-10db3fd9 0->2 1->2 3 10db3fbe-10db3fc2 1->3 4 10db3fdf-10db3fed 2->4 5 10db48fe-10db490c 2->5 3->2 6 10db3fc4-10db3fc8 3->6 7 10db3ff3-10db3ff7 4->7 8 10db48f6-10db48f7 4->8 6->2 9 10db3fca-10db3fce 6->9 10 10db3ff9-10db3ffd 7->10 11 10db3fff-10db4000 7->11 8->5 9->2 12 10db3fd0-10db3fd4 9->12 10->11 13 10db400a-10db4010 10->13 11->13 12->2 12->4 14 10db403a-10db4060 13->14 15 10db4012-10db4020 13->15 16 10db4068-10db407c call 10db05b2 14->16 17 10db4062-10db4066 14->17 15->14 18 10db4022-10db4026 15->18 22 10db4081-10db40a2 16->22 17->16 20 10db40a8-10db40ab 17->20 18->8 19 10db402c-10db4035 18->19 19->8 23 10db40b1-10db40b8 20->23 24 10db4144-10db4150 20->24 22->20 25 10db48ee-10db48ef 22->25 27 10db40ba-10db40dc call 10db3942 23->27 28 10db40e2-10db40f5 23->28 24->25 26 10db4156-10db4165 24->26 25->8 29 10db417f-10db418f 26->29 30 10db4167-10db4178 call 10db0552 26->30 27->28 28->25 32 10db40fb-10db4101 28->32 34 10db4191-10db41da call 10db0732 29->34 35 10db41e5-10db421b 29->35 30->29 32->25 37 10db4107-10db4109 32->37 34->35 52 10db41dc-10db41e1 34->52 40 10db422d-10db4231 35->40 41 10db421d-10db422b 35->41 37->25 42 10db410f-10db4111 37->42 45 10db4233-10db4245 40->45 46 10db4247-10db424b 40->46 44 10db427f-10db4280 41->44 42->25 47 10db4117-10db4132 getaddrinfo 42->47 51 10db4283-10db42e0 call 10db4d62 call 10db1482 call 10db0e72 call 10db5002 44->51 45->44 48 10db424d-10db425f 46->48 49 10db4261-10db4265 46->49 47->24 50 10db4134-10db413c 47->50 48->44 53 10db426d-10db4279 49->53 54 10db4267-10db426b 49->54 50->24 63 10db42e2-10db42e6 51->63 64 10db42f4-10db4354 call 10db4d92 51->64 52->35 53->44 54->51 54->53 63->64 66 10db42e8-10db42ef call 10db1042 63->66 69 10db435a-10db4396 call 10db4d62 call 10db5262 call 10db5002 64->69 70 10db448c-10db44b8 call 10db4d62 call 10db5262 64->70 66->64 85 10db43bb-10db43e9 call 10db5262 * 2 69->85 86 10db4398-10db43b7 call 10db5262 call 10db5002 69->86 79 10db44ba-10db44d5 70->79 80 10db44d9-10db4590 call 10db5262 * 3 call 10db5002 * 2 call 10db1482 70->80 79->80 112 10db4595-10db45b9 call 10db5262 80->112 101 10db43eb-10db4410 call 10db5002 call 10db5262 85->101 102 10db4415-10db441d 85->102 86->85 101->102 105 10db441f-10db4425 102->105 106 10db4442-10db4448 102->106 109 10db4467-10db4487 call 10db5262 105->109 110 10db4427-10db443d 105->110 111 10db444e-10db4456 106->111 106->112 109->112 110->112 111->112 117 10db445c-10db445d 111->117 121 10db45bb-10db45cc call 10db5262 call 10db5002 112->121 122 10db45d1-10db46ad call 10db5262 * 7 call 10db5002 call 10db4d62 call 10db5002 call 10db0e72 call 10db1042 112->122 117->109 132 10db46af-10db46b3 121->132 122->132 135 10db46ff-10db472d call 10db06b2 132->135 136 10db46b5-10db46fa call 10db0382 call 10db07b2 132->136 143 10db472f-10db4735 135->143 144 10db475d-10db4761 135->144 158 10db48e6-10db48e7 136->158 143->144 147 10db4737-10db474c 143->147 148 10db490d-10db4913 144->148 149 10db4767-10db476b 144->149 147->144 152 10db474e-10db4754 147->152 153 10db4779-10db4784 148->153 154 10db4919-10db4920 148->154 155 10db48aa-10db48df call 10db07b2 149->155 156 10db4771-10db4773 149->156 152->144 160 10db4756 152->160 161 10db4786-10db4793 153->161 162 10db4795-10db4796 153->162 154->161 155->158 156->153 156->155 158->25 160->144 161->162 165 10db479c-10db47a0 161->165 162->165 167 10db47a2-10db47af 165->167 168 10db47b1-10db47b2 165->168 167->168 170 10db47b8-10db47c4 167->170 168->170 173 10db47c6-10db47ef call 10db4d92 call 10db4d62 170->173 174 10db47f4-10db4861 170->174 173->174 185 10db48a3-10db48a4 174->185 186 10db4863 174->186 185->155 186->185 188 10db4865-10db486a 186->188 188->185 190 10db486c-10db4872 188->190 190->185 192 10db4874-10db48a1 190->192 192->185 192->186
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: getaddrinfo
                                                                                                                    • String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
                                                                                                                    • API String ID: 300660673-1117930895
                                                                                                                    • Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                                                                                    • Instruction ID: 465cd75c139d13884ab9088171ed4b5826b1cb9a0f9adf9253f524fc4c80083f
                                                                                                                    • Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                                                                                    • Instruction Fuzzy Hash: A652BE34618B488BCB59EF68C4847EAB7E1FB56300F54462ED49FC7186DE30B94ACB91
                                                                                                                    Function 10DAE8C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • ObtainUserAgentString.URLMON ref: 10DAE9A0
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AgentObtainStringUser
                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                    • API String ID: 2681117516-319646191
                                                                                                                    • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                    • Instruction ID: 198331e30d149e7ffa96fa09f846d71f42f8afc33cd88fdab64d2b72c6c844b6
                                                                                                                    • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                    • Instruction Fuzzy Hash: 1131E131614A0D8FCB45EFA8C8857EEB7E0FF58214F44422AE44ED7280EF789645CB99
                                                                                                                    Function 10DAE8BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • ObtainUserAgentString.URLMON ref: 10DAE9A0
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AgentObtainStringUser
                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                    • API String ID: 2681117516-319646191
                                                                                                                    • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                    • Instruction ID: dff44426946198d792c9d257445341fb4c95196321d42ddbf6d0ceafb2496b50
                                                                                                                    • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                    • Instruction Fuzzy Hash: A5210630610A0D8BCB45EFA8C8457EE7BE0FF59304F44421EE45AD7280DF749604CB95
                                                                                                                    Function 10DAAB66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148synchronizationCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateMutex
                                                                                                                    • String ID: .dll$el32$kern
                                                                                                                    • API String ID: 1964310414-1222553051
                                                                                                                    • Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                                                                                    • Instruction ID: d0c50f899260546665539eb6b5759f11b5fff5b001c5760d6beebc206b2aa62a
                                                                                                                    • Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                                                                                    • Instruction Fuzzy Hash: 98416B74918A08CFDB84EFA8C8D97AD77E0FB58300F44427AD84ADB259DF309945CB95
                                                                                                                    Function 10DAAB72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138synchronizationCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateMutex
                                                                                                                    • String ID: .dll$el32$kern
                                                                                                                    • API String ID: 1964310414-1222553051
                                                                                                                    • Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                                                                                    • Instruction ID: ab7bb1fd6eea7eb55ad23434e3e88a3793d0d820c8904ef6f860555253d50497
                                                                                                                    • Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                                                                                    • Instruction Fuzzy Hash: B2412974918A088FDB84EFA8C499BAD77F0FB68300F44417AD84EDB255DE309945CB95
                                                                                                                    Function 10DB05B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49networkCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 399 10db05b2-10db05ea 400 10db060a-10db062b socket 399->400 401 10db05ec-10db0604 call 10db3942 399->401 401->400
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: socket
                                                                                                                    • String ID: sock
                                                                                                                    • API String ID: 98920635-2415254727
                                                                                                                    • Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                                                                                    • Instruction ID: 1001521f85259efb7cf95a423fb7902406ff4c8a7f12117673f8b527c1347ae4
                                                                                                                    • Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                                                                                    • Instruction Fuzzy Hash: 0901447061861C8FCB84DF1CD048B54BBE0FB59354F1545ADE85ECB266D7B0C981CB86
                                                                                                                    Function 10DA82DD Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 404 10da82dd-10da8320 call 10db3942 407 10da83fa-10da840e 404->407 408 10da8326 404->408 409 10da8328-10da8339 SleepEx 408->409 409->409 410 10da833b-10da8341 409->410 411 10da834b-10da8352 410->411 412 10da8343-10da8349 410->412 414 10da8370-10da8376 411->414 415 10da8354-10da835a 411->415 412->411 413 10da835c-10da836a call 10db2f12 412->413 413->414 417 10da8378-10da837e 414->417 418 10da83b7-10da83bd 414->418 415->413 415->414 417->418 422 10da8380-10da838a 417->422 419 10da83bf-10da83cf call 10da8e72 418->419 420 10da83d4-10da83db 418->420 419->420 420->409 424 10da83e1-10da83f5 call 10da80f2 420->424 422->418 425 10da838c-10da83b1 call 10da9432 422->425 424->409 425->418
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Sleep
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3472027048-0
                                                                                                                    • Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                                                                                    • Instruction ID: fb765b7df95bad45c58645982a1fd654f4bdd8653f3d4533069621d3cbf3552a
                                                                                                                    • Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                                                                                    • Instruction Fuzzy Hash: B9316B74A04B49DFDB94DF29808A2A5F7A0FB54300F48467ECD1DCB106CB74A860CFA1
                                                                                                                    Function 10DA8412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 440 10da8412-10da8446 call 10db3942 443 10da8448-10da8472 call 10db5c9e CreateThread 440->443 444 10da8473-10da847d 440->444
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569837606.0000000010CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 10CD0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_10cd0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2422867632-0
                                                                                                                    • Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                                                                                    • Instruction ID: ebb0dfc94fdc45f8d1d65a25ebc1b72ec24cf98cf8ffb5a81b6ddd97947bf13a
                                                                                                                    • Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                                                                                    • Instruction Fuzzy Hash: 1DF02230228A084FDB88EB2CD44262AB3D0EBAD200F40063EA98EC3264CA68C5818716

                                                                                                                    Non-executed Functions

                                                                                                                    Function 0E213D02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                                                                                                    • API String ID: 0-393284711
                                                                                                                    • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                    • Instruction ID: f21c8b831cc179e97331274a5ff2833738217c571d66b19b852bf04cb984b771
                                                                                                                    • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                    • Instruction Fuzzy Hash: B1E16CB4528F488FC764EF68C4947AAB7E0FB68301F504A6E959FC7241DF30AA41CB85
                                                                                                                    Function 0E352D02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                                                                                                    • API String ID: 0-393284711
                                                                                                                    • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                    • Instruction ID: a9231d345ff04e7a55ff388ca8cf7f5815165e52b81dc80be8747baa6d8f3d88
                                                                                                                    • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                    • Instruction Fuzzy Hash: 1AE14A75618B488FC764EF78C494BAABBE0FB58300F504A2E999BC7355DF30A941CB85
                                                                                                                    Function 0E216792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                                                                                                    • API String ID: 0-2916316912
                                                                                                                    • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                    • Instruction ID: 5283abe2d2d07094f0a7b9c42f990d8bcddebe337f963dfc1c1fdbda6853b074
                                                                                                                    • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                    • Instruction Fuzzy Hash: 6EB18C34528B488FDB54EF68C485AEEB7F1FFA8300F50496ED49AC7251EF7099058B86
                                                                                                                    Function 0E355792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                                                                                                    • API String ID: 0-2916316912
                                                                                                                    • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                    • Instruction ID: 0685d757e8571b331a8bd1515befd0640bfd56a56dbf1ebe19b4ea4ba14bcc80
                                                                                                                    • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                    • Instruction Fuzzy Hash: 02B15B31518B488ADB55EF68C485AEEBBF1FF58300F90491ED89AC7351EF70A9058B86
                                                                                                                    Function 0E214622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                                                                                                    • API String ID: 0-1539916866
                                                                                                                    • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                    • Instruction ID: 1fca11d774f5ac56af47d141c2e811d3c41bed173de7d26f8f1447d3421614f5
                                                                                                                    • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                    • Instruction Fuzzy Hash: 0241D370A28B088FDB14EF88A4497BD7BE2FB58700F40026ED409D7245DBB59D458BD6
                                                                                                                    Function 0E353622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                                                                                                    • API String ID: 0-1539916866
                                                                                                                    • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                    • Instruction ID: 60c8e05ac71d0e79b86e916cf07e59c2906069227f825140367639657a983382
                                                                                                                    • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                    • Instruction Fuzzy Hash: B341BF71A18B088FDF14DF88E445AAEBBE2FB88740F00025ED809D3345DBB59D458BD6
                                                                                                                    Function 0E21BAB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                                                                                                    • API String ID: 0-355182820
                                                                                                                    • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                    • Instruction ID: 17b75cb216c198aef53c70c726ec80c738a8217596994e449f019e2719e7453f
                                                                                                                    • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                    • Instruction Fuzzy Hash: 98C15E75228B098FC758EF28C8956AAF3E1FBA4304F404B5E955AC7250DF70EA15CB86
                                                                                                                    Function 0E35AAB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                                                                                                    • API String ID: 0-355182820
                                                                                                                    • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                    • Instruction ID: 502c170ca98978383495a4e9d37aad2c7c36ad5c1df29893fa359d13fc6ba84c
                                                                                                                    • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                    • Instruction Fuzzy Hash: 47C14B71218B099FC758EF24C495AAAF7E1FB94304F504B2ED89AC7310DF70A955CB86
                                                                                                                    Function 0E21BF12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                                                                                                    • API String ID: 0-97273177
                                                                                                                    • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                    • Instruction ID: 51f3648c83b58a3e5564c0ec5378e0ce13eb0a5d425006fd9834b4b7a8226e41
                                                                                                                    • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                    • Instruction Fuzzy Hash: EE51C3355687488FD71DDF18C8812AAB7E5FBD5700F501A6EE8CBC7241DBB49A06CB82
                                                                                                                    Function 0E35AF12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                                                                                                    • API String ID: 0-97273177
                                                                                                                    • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                    • Instruction ID: 8770e50cf6afbf3331e14f4f48435202d28e007298669b64be5425a8f5a61b26
                                                                                                                    • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                    • Instruction Fuzzy Hash: 9951D3321187488FD719DF18C8816AAFBE5FB85704F501A2EE8DBC7341DBB49906CB82
                                                                                                                    Function 0E2152F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                    • API String ID: 0-639201278
                                                                                                                    • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                    • Instruction ID: e4b1cf030eba516a63dc3efb48afdc59a66e54406e407b9096ed397aab69ef0a
                                                                                                                    • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                    • Instruction Fuzzy Hash: D2C17074628A194FC758EF68D895AAAF3E1FFA8300F5547A9844EC7250DF30EE018B85
                                                                                                                    Function 0E2152F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                    • API String ID: 0-639201278
                                                                                                                    • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                    • Instruction ID: 43364a7201381d58698d452b6b02d981cb3cd1ee653426a02b69b3d1ceceee85
                                                                                                                    • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                    • Instruction Fuzzy Hash: B3C17074628A194FC758EF68D895AAAF3E1FFA8300F5547A9844EC7254DF30EE018BC5
                                                                                                                    Function 0E3542F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                    • API String ID: 0-639201278
                                                                                                                    • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                    • Instruction ID: daa8b95738892c9a92f8fbd5be02e4489efd67c50f462b0905305349a35951d9
                                                                                                                    • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                    • Instruction Fuzzy Hash: AEC19E72618A198FC758EB68D495EAAF7E1FB94300F814729885BC7350DF70AA41CB85
                                                                                                                    Function 0E3542F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                    • API String ID: 0-639201278
                                                                                                                    • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                    • Instruction ID: ae56487730b7eb920b3190681cec67c433fcca8a35c980353558276e2d67a5be
                                                                                                                    • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                    • Instruction Fuzzy Hash: 2CC19E72618A198FC758EF68D495EAAFBE1FB98300F814729885BC7350DF709E41CB85
                                                                                                                    Function 0E216CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                    • API String ID: 0-2058692283
                                                                                                                    • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                    • Instruction ID: f8b4159e42848258777530a8d238c8c8a765d228f2f9d3d5e72dab9d6c14dd38
                                                                                                                    • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                    • Instruction Fuzzy Hash: BCA191706287488FDB19EFA8D4447EEB7E1FF98300F40466EE48AD7251EF709A458789
                                                                                                                    Function 0E355CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                    • API String ID: 0-2058692283
                                                                                                                    • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                    • Instruction ID: 470653fdef08580b5cfa8ca7f31c57fb8a3ebcbd4615090625e4c48bbee6bc8c
                                                                                                                    • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                    • Instruction Fuzzy Hash: 6AA190716187488BDB19EFA8D444BEEBBE1FF84300F404A2DD88AD7351EF7099458789
                                                                                                                    Function 0E216CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                    • API String ID: 0-2058692283
                                                                                                                    • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                    • Instruction ID: 7dced495fa2be3fb53ad2a7b14c28cb7d6338650ffb292e6192fb1db0cd6f012
                                                                                                                    • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                    • Instruction Fuzzy Hash: 6391A0706287488FDB19EFA8D444BEEB7E1FF98300F40466EE48AD7251EF709A458785
                                                                                                                    Function 0E355CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                    • API String ID: 0-2058692283
                                                                                                                    • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                    • Instruction ID: e414240574c34d70802610dc14d49278e196f3c63d8d249cd19c9c004ff56587
                                                                                                                    • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                    • Instruction Fuzzy Hash: BD917E716187488BDB29EFA8D444BEEBBE1FF98300F404A2DD88AD7351EB7099458785
                                                                                                                    Function 0E216352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $.$e$n$v
                                                                                                                    • API String ID: 0-1849617553
                                                                                                                    • Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                    • Instruction ID: 0d6d0caaeb8c7e9542c41f054f312d39d9150169e953b02511d26be53d110011
                                                                                                                    • Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                    • Instruction Fuzzy Hash: 2B71A3356287498FD758EFA8C4847AEB7F1FF68304F00066ED44AC7261EB71E9458B81
                                                                                                                    Function 0E355352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $.$e$n$v
                                                                                                                    • API String ID: 0-1849617553
                                                                                                                    • Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                    • Instruction ID: b5fc63013b43d089476d03d2612cac0b5b300403e5e47383b2bbe65914977622
                                                                                                                    • Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                    • Instruction Fuzzy Hash: 317174326187488FD758EF68C484BAABBF1FF54304F400A2ED84AD7361EB71E9458B85
                                                                                                                    Function 0E211C32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 2.dl$dll$l32.$ole3$shel
                                                                                                                    • API String ID: 0-1970020201
                                                                                                                    • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                    • Instruction ID: 79f2433f08e256ae132362e946533d0973f25d8cbf0bbe25a8ed0f7434b7f66c
                                                                                                                    • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                    • Instruction Fuzzy Hash: 495150B4918B4C8FDB54EFA4C0456EEB7F1FF68301F404A6E959AD7214DF3096418B89
                                                                                                                    Function 0E350C32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 2.dl$dll$l32.$ole3$shel
                                                                                                                    • API String ID: 0-1970020201
                                                                                                                    • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                    • Instruction ID: 9a74ea75fd7b41e9a4beb3b8b3f84a5c2918dba46528d5db8eb26161922d56bb
                                                                                                                    • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                    • Instruction Fuzzy Hash: DF513DB1914B4C8BDB54EFA4C045AEEFBE1FF58300F404A2ED89AE7214EF7095458B89
                                                                                                                    Function 0E21286F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 4$\$dll$ion.$vers
                                                                                                                    • API String ID: 0-1610437797
                                                                                                                    • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                    • Instruction ID: 18b60664b9ef6bba593c9e37bc5c0ea53023a8a28e2a0f1c212793a2511506e4
                                                                                                                    • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                    • Instruction Fuzzy Hash: E5417335228B4D8FDB75EF2498557EA77E4FBA4301F40466E984EC7250DF30DA058782
                                                                                                                    Function 0E35186F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 4$\$dll$ion.$vers
                                                                                                                    • API String ID: 0-1610437797
                                                                                                                    • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                    • Instruction ID: 49472c500fe1066248d9061f4ca47f9a9472330560c7c87c7e8e58de9873f4db
                                                                                                                    • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                    • Instruction Fuzzy Hash: 98416331659B888FCBB5EF249855BEAB7E4FB98301F50462E985EC7340EF30D9458782
                                                                                                                    Function 0E2144B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 32.d$cli.$dll$sspi$user
                                                                                                                    • API String ID: 0-327345718
                                                                                                                    • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                    • Instruction ID: a0a9cd83d0233261cdf17269260ac32418752575e160a13e8e696aeffec1635e
                                                                                                                    • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                    • Instruction Fuzzy Hash: 48415E70A29E0D9FCB54FF6880947AD77E1FB78300F5046AAA80ED7210DA71DA418B86
                                                                                                                    Function 0E3534B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: 32.d$cli.$dll$sspi$user
                                                                                                                    • API String ID: 0-327345718
                                                                                                                    • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                    • Instruction ID: 9c03649ac4da94b335a4a8a0425fcd634c6021730c07f7185a225eba2a441c57
                                                                                                                    • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                    • Instruction Fuzzy Hash: D4415D72A18E0D8FCB54EF688095BAD7BF1FB58340F40596AAC0AD7314EA71D9408B86
                                                                                                                    Function 0E212432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$el32$h$kern
                                                                                                                    • API String ID: 0-4264704552
                                                                                                                    • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                    • Instruction ID: 14008aedad4ed450213b6ee962c90104c5c14261434fa89c54be9834ee3a89f3
                                                                                                                    • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                    • Instruction Fuzzy Hash: 78419771618B4D8FD769DF2884943AABBE1FBA8300F104A6F949EC3265DF70C945CB41
                                                                                                                    Function 0E351432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$el32$h$kern
                                                                                                                    • API String ID: 0-4264704552
                                                                                                                    • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                    • Instruction ID: 87966d4aae2291740aab912f0082c50145fd3ec715a36917e667302cae62cbd8
                                                                                                                    • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                    • Instruction Fuzzy Hash: 4F416E71609B498FD7A9DF2980847AABBE1FB98300F104B6E989FC3355DB70C945CB81
                                                                                                                    Function 0E2190B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $Snif$f fr$om:
                                                                                                                    • API String ID: 0-3434893486
                                                                                                                    • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                    • Instruction ID: 41030c57d46885bcd7fc071fad2611e1c009d2300035c9b48583df3c55b55163
                                                                                                                    • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                    • Instruction Fuzzy Hash: 4C31E47552CB885FD71AEB28C4846DAB7D4FBA4300F504D5EE49BC7251EE30AA49CB83
                                                                                                                    Function 0E3580B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $Snif$f fr$om:
                                                                                                                    • API String ID: 0-3434893486
                                                                                                                    • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                    • Instruction ID: 9b8a3d824d4561b7a532b9ee220623005a90ced91721a58e5e9e993d582cd250
                                                                                                                    • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                    • Instruction Fuzzy Hash: F431A77151CB885FD719EB24D484ADABBD4FB94300F504D1ED89BD7351EE30A945CB42
                                                                                                                    Function 0E2190C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $Snif$f fr$om:
                                                                                                                    • API String ID: 0-3434893486
                                                                                                                    • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                    • Instruction ID: 074a1fca4333034d01bafee20a85b507504648ff86c3c39143f92f40dcf5c7a1
                                                                                                                    • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                    • Instruction Fuzzy Hash: 0531F67552CB485FD719DB24C4946DAB7D4FBA4300F504D5EE49BC3251EE30EA49CA83
                                                                                                                    Function 0E3580C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $Snif$f fr$om:
                                                                                                                    • API String ID: 0-3434893486
                                                                                                                    • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                    • Instruction ID: b9461220ba6987b0291edc147fbc2f7177827ba960328c5145011d5705093a51
                                                                                                                    • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                    • Instruction Fuzzy Hash: 2931A572518B486FD719EB24C484ADABBD4FB94300F504D2EE89BD7351EE30E946CB42
                                                                                                                    Function 0E214FC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$chro$hild$me_c
                                                                                                                    • API String ID: 0-3136806129
                                                                                                                    • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                    • Instruction ID: 8ac045a77e7f13339c1f04bbf8c717422fbadc69223a3bf050671a17fe256f49
                                                                                                                    • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                    • Instruction Fuzzy Hash: 2D317074128B494FC784EF688494BAAB7E1FFE8200F954AAD984EC7214DF30DA45C792
                                                                                                                    Function 0E353FC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$chro$hild$me_c
                                                                                                                    • API String ID: 0-3136806129
                                                                                                                    • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                    • Instruction ID: 7185ce559c8face5cbedc0a5cee8adff4702e62220fc3d049a68dbb991536965
                                                                                                                    • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                    • Instruction Fuzzy Hash: EB312F72118B588FC784EF688494FAABBE1FB94300F94496D984AC7355DF30CD45CB56
                                                                                                                    Function 0E214FBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$chro$hild$me_c
                                                                                                                    • API String ID: 0-3136806129
                                                                                                                    • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                    • Instruction ID: 9a1e9e62f048b1666442a0fedb8de4c242d040987bd2d8ceb3f7a15541ec655e
                                                                                                                    • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                    • Instruction Fuzzy Hash: E8319274128B494FC794EF6884947AAB7E1FFE8300F954ABD944AC7254DF30CA05C782
                                                                                                                    Function 0E353FBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .dll$chro$hild$me_c
                                                                                                                    • API String ID: 0-3136806129
                                                                                                                    • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                    • Instruction ID: 4eb97d9dc50b36e597ead753399bfcf52e22699cbfe8f497a00582b5de65e6bd
                                                                                                                    • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                    • Instruction Fuzzy Hash: 1F315072118B088FC784EF688494FAABBE1FB94300F944A6D984AC7355DF30CD45CB52
                                                                                                                    Function 0E2178C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                    • API String ID: 0-319646191
                                                                                                                    • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                    • Instruction ID: 34d47968e1d3377c87f02b7e33787a59a045a3db4b3bbcd02d7adb0680ac3999
                                                                                                                    • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                    • Instruction Fuzzy Hash: 5731D131624A0C8BCB14EFA8C8847EDBBE0FB68205F40066AD84EE7240DF748A45C799
                                                                                                                    Function 0E3568C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                    • API String ID: 0-319646191
                                                                                                                    • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                    • Instruction ID: 6a104f7ead4bfe4d65f7a8feb8abcd2d0b9010d881a2f972b65e83ce53ac28bb
                                                                                                                    • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                    • Instruction Fuzzy Hash: B731D132614A0C8BCB04EFA8C884BEEBBE0FB58214F40462AD85ED7340DE748A45C789
                                                                                                                    Function 0E2178BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                    • API String ID: 0-319646191
                                                                                                                    • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                    • Instruction ID: c63f7e36516159293c21df06bf00d7b4ea1bee1966213cfe7302134d32f00767
                                                                                                                    • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                    • Instruction Fuzzy Hash: 3D21E671A20A4D8BCF15EFA8C8847EDBBE0FF68204F40466AD45AD7240DF748B05C795
                                                                                                                    Function 0E3568BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                    • API String ID: 0-319646191
                                                                                                                    • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                    • Instruction ID: afc1b4630bb165f1362903ae25ad21cb9eb3058e619f16aec5291ac6a6afea90
                                                                                                                    • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                    • Instruction Fuzzy Hash: E421A571614A4C8BCB05EFA8C845BEEBFE1FF58204F80461AD85AD7350DF749A45C785
                                                                                                                    Function 0E218E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .$l$l$t
                                                                                                                    • API String ID: 0-168566397
                                                                                                                    • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                    • Instruction ID: 8ca9c6dffd6718aeb94410bc31c1b2db5e3eeaeb8fff29f18b7d18df045c0d3f
                                                                                                                    • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                    • Instruction Fuzzy Hash: 4D218D74A24A0D9FDB08EFA8C4447AEBBF0FF28300F504A6ED409D3600DB749A51CB84
                                                                                                                    Function 0E218E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .$l$l$t
                                                                                                                    • API String ID: 0-168566397
                                                                                                                    • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                    • Instruction ID: 114c08aa6a1c9e0fdc9c829692f961b725de05aaaf5d7d05e7d0e1c280f2fb0e
                                                                                                                    • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                    • Instruction Fuzzy Hash: DF217F74A24A0D9BDB08EFA8D4447EDBBF1FF28314F504A6ED409D3600DB759A55CB84
                                                                                                                    Function 0E357E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .$l$l$t
                                                                                                                    • API String ID: 0-168566397
                                                                                                                    • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                    • Instruction ID: 4afc8c8d94a8e53b8279b1aec6755cde6f949fe19593187ad9ff5087d6d66a87
                                                                                                                    • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                    • Instruction Fuzzy Hash: 46215C71A24A0D9BDB08EFA8D444BEABBF1FF58304F904A2ED409D3700DB7499518B84
                                                                                                                    Function 0E357E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: .$l$l$t
                                                                                                                    • API String ID: 0-168566397
                                                                                                                    • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                    • Instruction ID: d466fbc62e50ad250df4ef005e179ad22ef65d83e0470b8fe801a55dfdb9e7a6
                                                                                                                    • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                    • Instruction Fuzzy Hash: CD214B71A24B0D9BDB48EFA8D044BAABAF1FF58304F904A2ED409D3710DB7499918B84
                                                                                                                    Function 0E218FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4568980866.000000000E1B0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E1B0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e1b0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: auth$logi$pass$user
                                                                                                                    • API String ID: 0-2393853802
                                                                                                                    • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                    • Instruction ID: 81ed96b61fb2c1eb871ea5ea6e4a6372799ae6bd611888c4cedc6a3474be5204
                                                                                                                    • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                    • Instruction Fuzzy Hash: AD21C030624B0D8BCB05DF9998A06EEB7E1FF88354F00465AD80ADB244D7B1DA548BC2
                                                                                                                    Function 0E357FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000A.00000002.4569080941.000000000E2C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E2C0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_10_2_e2c0000_explorer.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: auth$logi$pass$user
                                                                                                                    • API String ID: 0-2393853802
                                                                                                                    • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                    • Instruction ID: 87a758779e1c8ba3bf5887f4cb87080246c64779d650bdc489e429e99d7f0646
                                                                                                                    • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                    • Instruction Fuzzy Hash: C121C071614B0D8BCB05DF999890AEEBBE1EF88344F014A19D80AEB348D7B0D9158BC2

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:7.3%
                                                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                                                    Signature Coverage:0%
                                                                                                                    Total number of Nodes:75
                                                                                                                    Total number of Limit Nodes:7
                                                                                                                    execution_graph 16097 e34668 16098 e3467a 16097->16098 16099 e34686 16098->16099 16103 e34778 16098->16103 16108 e34204 16099->16108 16101 e346a5 16104 e3479d 16103->16104 16112 e34888 16104->16112 16116 e34878 16104->16116 16109 e3420f 16108->16109 16124 e35cc4 16109->16124 16111 e37083 16111->16101 16114 e348af 16112->16114 16113 e3498c 16113->16113 16114->16113 16120 e344f0 16114->16120 16117 e348af 16116->16117 16118 e3498c 16117->16118 16119 e344f0 CreateActCtxA 16117->16119 16119->16118 16121 e35918 CreateActCtxA 16120->16121 16123 e359db 16121->16123 16123->16123 16125 e35cc9 16124->16125 16128 e35ce4 16125->16128 16127 e37315 16127->16111 16129 e35cef 16128->16129 16132 e35d14 16129->16132 16131 e373fa 16131->16127 16133 e35d1f 16132->16133 16136 e35d44 16133->16136 16135 e374ed 16135->16131 16137 e35d4f 16136->16137 16139 e387eb 16137->16139 16142 e3ae99 16137->16142 16138 e38829 16138->16135 16139->16138 16146 e3cf80 16139->16146 16152 e3aec1 16142->16152 16156 e3aed0 16142->16156 16143 e3aeae 16143->16139 16147 e3cf35 16146->16147 16148 e3cf86 16146->16148 16147->16138 16149 e3cfd5 16148->16149 16164 e3d260 16148->16164 16168 e3d250 16148->16168 16149->16138 16153 e3aed0 16152->16153 16159 e3b3b1 16153->16159 16154 e3aedf 16154->16143 16158 e3b3b1 GetModuleHandleW 16156->16158 16157 e3aedf 16157->16143 16158->16157 16160 e3b404 16159->16160 16161 e3b3e1 16159->16161 16160->16154 16161->16160 16162 e3b608 GetModuleHandleW 16161->16162 16163 e3b635 16162->16163 16163->16154 16165 e3d26d 16164->16165 16166 e3d2a7 16165->16166 16172 e3b2e8 16165->16172 16166->16149 16169 e3d26d 16168->16169 16170 e3d2a7 16169->16170 16171 e3b2e8 GetModuleHandleW 16169->16171 16170->16149 16171->16170 16173 e3b2f3 16172->16173 16175 e3dfc0 16173->16175 16176 e3d60c 16173->16176 16175->16175 16177 e3d617 16176->16177 16178 e35d44 GetModuleHandleW 16177->16178 16179 e3e02f 16178->16179 16179->16175 16180 e3d378 16181 e3d37a GetCurrentProcess 16180->16181 16183 e3d410 GetCurrentThread 16181->16183 16184 e3d409 16181->16184 16185 e3d446 16183->16185 16186 e3d44d GetCurrentProcess 16183->16186 16184->16183 16185->16186 16189 e3d483 16186->16189 16187 e3d4ab GetCurrentThreadId 16188 e3d4dc 16187->16188 16189->16187 16190 e3d9c8 16191 e3d9ca DuplicateHandle 16190->16191 16192 e3da5e 16191->16192

                                                                                                                    Executed Functions

                                                                                                                    Function 00E3D369 Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 00E3D3F6
                                                                                                                    • GetCurrentThread.KERNEL32 ref: 00E3D433
                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 00E3D470
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00E3D4C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Current$ProcessThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2063062207-0
                                                                                                                    • Opcode ID: 10dc8dd87aa1fb0228e02b929ad9e29c4c4c03549c4019a2b1166f79664d8dae
                                                                                                                    • Instruction ID: ebb7515995872101ee28f54db5308b9a4f6120c5b4e4d57e7fe26c6072a5d4aa
                                                                                                                    • Opcode Fuzzy Hash: 10dc8dd87aa1fb0228e02b929ad9e29c4c4c03549c4019a2b1166f79664d8dae
                                                                                                                    • Instruction Fuzzy Hash: 7A5176B0D053498FDB54CFA9D948BAEBFF1EF88314F208459E018A72A0DB746984CF61
                                                                                                                    Function 00E3D378 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 00E3D3F6
                                                                                                                    • GetCurrentThread.KERNEL32 ref: 00E3D433
                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 00E3D470
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00E3D4C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Current$ProcessThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2063062207-0
                                                                                                                    • Opcode ID: 9c5ebfdb441c626cebcb538b394b810150739fba6d7d715c3677c62600c7ee70
                                                                                                                    • Instruction ID: ed1bfd58732e762e945467d4bb4fc957fa1a95cbeeffbc2d8688a75327ee85e2
                                                                                                                    • Opcode Fuzzy Hash: 9c5ebfdb441c626cebcb538b394b810150739fba6d7d715c3677c62600c7ee70
                                                                                                                    • Instruction Fuzzy Hash: EF5145B0D013498FDB54CFAAD948B9EBBF1EF88314F248459E019A7260DB74A984CF65
                                                                                                                    Function 00E3B3B1 Relevance: 1.7, APIs: 1, Instructions: 210COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 59 e3b3b1-e3b3df 60 e3b3e1-e3b3ee call e39f4c 59->60 61 e3b40b-e3b40f 59->61 68 e3b3f0 60->68 69 e3b404 60->69 63 e3b423-e3b464 61->63 64 e3b411-e3b41b 61->64 70 e3b471-e3b47f 63->70 71 e3b466-e3b46e 63->71 64->63 116 e3b3f6 call e3b659 68->116 117 e3b3f6 call e3b668 68->117 69->61 72 e3b4a3-e3b4a5 70->72 73 e3b481-e3b486 70->73 71->70 78 e3b4a8-e3b4af 72->78 75 e3b491 73->75 76 e3b488-e3b48f call e39f58 73->76 74 e3b3fc-e3b3fe 74->69 77 e3b540-e3b5be 74->77 80 e3b493-e3b4a1 75->80 76->80 109 e3b5c2-e3b600 77->109 110 e3b5c0-e3b5c1 77->110 81 e3b4b1-e3b4b9 78->81 82 e3b4bc-e3b4c3 78->82 80->78 81->82 83 e3b4d0-e3b4d9 call e39f68 82->83 84 e3b4c5-e3b4cd 82->84 90 e3b4e6-e3b4eb 83->90 91 e3b4db-e3b4e3 83->91 84->83 92 e3b509-e3b516 90->92 93 e3b4ed-e3b4f4 90->93 91->90 99 e3b539-e3b53f 92->99 100 e3b518-e3b536 92->100 93->92 95 e3b4f6-e3b506 call e39f78 call e3afbc 93->95 95->92 100->99 111 e3b602-e3b605 109->111 112 e3b608-e3b633 GetModuleHandleW 109->112 110->109 111->112 113 e3b635-e3b63b 112->113 114 e3b63c-e3b650 112->114 113->114 116->74 117->74
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 00E3B626
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleModule
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4139908857-0
                                                                                                                    • Opcode ID: 96f01e0c060fcbe2957fb2c7eadf36d55d077477241325372675deb3376712f6
                                                                                                                    • Instruction ID: d9a378b18c7fe954ef3d75810c6c7dc8c3c1e0811ee49fea7e8d592ef16b5421
                                                                                                                    • Opcode Fuzzy Hash: 96f01e0c060fcbe2957fb2c7eadf36d55d077477241325372675deb3376712f6
                                                                                                                    • Instruction Fuzzy Hash: 5681A970A00B058FD724DF29D4497AABBF1FF88304F00896ED59AE7A52E774E805CB94
                                                                                                                    Function 00E3590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 118 e3590c-e359d9 CreateActCtxA 120 e359e2-e35a3c 118->120 121 e359db-e359e1 118->121 128 e35a4b-e35a4f 120->128 129 e35a3e-e35a41 120->129 121->120 130 e35a51-e35a5d 128->130 131 e35a60 128->131 129->128 130->131 133 e35a61 131->133 133->133
                                                                                                                    APIs
                                                                                                                    • CreateActCtxA.KERNEL32(?), ref: 00E359C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Create
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2289755597-0
                                                                                                                    • Opcode ID: 87dcf04d22158a6c3542d1e1485ccf7cc10099a004d700d33bf4e25fd21242e3
                                                                                                                    • Instruction ID: bf315169847e2a49456725642232ecb4293a2f33a034370290a35abe36fb5085
                                                                                                                    • Opcode Fuzzy Hash: 87dcf04d22158a6c3542d1e1485ccf7cc10099a004d700d33bf4e25fd21242e3
                                                                                                                    • Instruction Fuzzy Hash: CB4100B1C0071DCBEB24CFA9C984BDEBBB5BF89304F20815AD408AB251DB716946CF50
                                                                                                                    Function 00E344F0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 134 e344f0-e359d9 CreateActCtxA 137 e359e2-e35a3c 134->137 138 e359db-e359e1 134->138 145 e35a4b-e35a4f 137->145 146 e35a3e-e35a41 137->146 138->137 147 e35a51-e35a5d 145->147 148 e35a60 145->148 146->145 147->148 150 e35a61 148->150 150->150
                                                                                                                    APIs
                                                                                                                    • CreateActCtxA.KERNEL32(?), ref: 00E359C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Create
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2289755597-0
                                                                                                                    • Opcode ID: 1fc7f6c0072d7ba7bd5645d0f89c499c3ecf270dfa57f9b7508f70875b84dd52
                                                                                                                    • Instruction ID: cc1b94d21a162ca137fa10ce2a75eb22ad4f93d60f615b861b451c6bdd57dad6
                                                                                                                    • Opcode Fuzzy Hash: 1fc7f6c0072d7ba7bd5645d0f89c499c3ecf270dfa57f9b7508f70875b84dd52
                                                                                                                    • Instruction Fuzzy Hash: 2941D271C0071DCBDB24CFA9C984B9EBBB5BF88704F20815AD418BB251DB756945CF90
                                                                                                                    Function 00E3D9C1 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 151 e3d9c1-e3d9c6 152 e3d9ca-e3da5c DuplicateHandle 151->152 153 e3d9c8-e3d9c9 151->153 154 e3da65-e3da82 152->154 155 e3da5e-e3da64 152->155 153->152 155->154
                                                                                                                    APIs
                                                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E3DA4F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DuplicateHandle
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3793708945-0
                                                                                                                    • Opcode ID: 7ba9ba2715587f696107630f1437b4e7d66a9e9a90c82a5376adbb9f96caa1ce
                                                                                                                    • Instruction ID: 1b0a58d23c02e92f074ef652a86a1aca90e8754d4b9d600490b6a1476261b6fe
                                                                                                                    • Opcode Fuzzy Hash: 7ba9ba2715587f696107630f1437b4e7d66a9e9a90c82a5376adbb9f96caa1ce
                                                                                                                    • Instruction Fuzzy Hash: FC21D2B5904249DFDB10CF9AE984AEEBFF4BB48324F14801AE918A3310D374A954CFA1
                                                                                                                    Function 00E3D9C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 158 e3d9c8-e3da5c DuplicateHandle 160 e3da65-e3da82 158->160 161 e3da5e-e3da64 158->161 161->160
                                                                                                                    APIs
                                                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E3DA4F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DuplicateHandle
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3793708945-0
                                                                                                                    • Opcode ID: 09918fbacfd3bd3fc95cc3508671a0c425a125f0e4c1e7120f1e2c0903b05b81
                                                                                                                    • Instruction ID: c656509d1e98d1c1f3efb6f432aaa7ba4176b812617eab3cb54d1e52472ee4bd
                                                                                                                    • Opcode Fuzzy Hash: 09918fbacfd3bd3fc95cc3508671a0c425a125f0e4c1e7120f1e2c0903b05b81
                                                                                                                    • Instruction Fuzzy Hash: 8121C4B5904249DFDB10CF9AD984ADEBFF5FB48320F14841AE918A3350D374A954CF65
                                                                                                                    Function 00E3B5C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 164 e3b5c0-e3b600 166 e3b602-e3b605 164->166 167 e3b608-e3b633 GetModuleHandleW 164->167 166->167 168 e3b635-e3b63b 167->168 169 e3b63c-e3b650 167->169 168->169
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 00E3B626
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2164038745.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_e30000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleModule
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4139908857-0
                                                                                                                    • Opcode ID: 145fe1e9091a2445c6462c7bf2653c1982796c861a8b058594d70d91eb1fb58d
                                                                                                                    • Instruction ID: d4fb5e0f1106817dcceb0eb7d4361c882abe10ef10c75d8edc1cf8a0dbf0b708
                                                                                                                    • Opcode Fuzzy Hash: 145fe1e9091a2445c6462c7bf2653c1982796c861a8b058594d70d91eb1fb58d
                                                                                                                    • Instruction Fuzzy Hash: B6110FB6C003498FDB20CF9AD844A9EFBF4AF88324F10945AD519B7211C3B9A545CFA1
                                                                                                                    Function 00B4D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163645674.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b4d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fc44db92f696bed0b89ffd9af4247ba56abffae2ce6c75d23996810d5bef3173
                                                                                                                    • Instruction ID: 8964154f81a1689f7d4da1e733ac1d3423473ba171827d1a1c26d952e9e3c501
                                                                                                                    • Opcode Fuzzy Hash: fc44db92f696bed0b89ffd9af4247ba56abffae2ce6c75d23996810d5bef3173
                                                                                                                    • Instruction Fuzzy Hash: 74213A76504204DFDB05DF14D9C0B26BFA5FB94324F20C5ADE9090B356C33AE956DBA2
                                                                                                                    Function 00B4D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163645674.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b4d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: bff6477e81874fda66bee5e65c621c2677a041633151dc75f020d429320e9647
                                                                                                                    • Instruction ID: 90d3d7513b509e5ce9d9a21184a870f43b73f0ceec578cb9e5a70aa52504a3d0
                                                                                                                    • Opcode Fuzzy Hash: bff6477e81874fda66bee5e65c621c2677a041633151dc75f020d429320e9647
                                                                                                                    • Instruction Fuzzy Hash: 64212572604240EFDB05DF14D9C0B2ABFA5FB98318F20C5ADE9090B256C736D956EAA1
                                                                                                                    Function 00B5D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163714801.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b5d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: a6afee45fbba670c9dd5b48b795c5d5e96d6d4218f78d46bf9eab93b09d38ee8
                                                                                                                    • Instruction ID: 692eadab7465f79b8810ac97daee7ecdb3d115405099b4c715543f825f8268f7
                                                                                                                    • Opcode Fuzzy Hash: a6afee45fbba670c9dd5b48b795c5d5e96d6d4218f78d46bf9eab93b09d38ee8
                                                                                                                    • Instruction Fuzzy Hash: 8321D075604204EFDB25DF14D9C0B26BBA5FB88315F20C6EDED094B292C777D84ACA61
                                                                                                                    Function 00B5D01C Relevance: .1, Instructions: 72COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163714801.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b5d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 46dab3c982c5c4f44246d51a3a1eeee750c8108d17309ab8a3e4ce16e1bafd74
                                                                                                                    • Instruction ID: 42c5296902fa53f49ff27cf7e5f19cf7717507c91e388444744c491be9bf74d4
                                                                                                                    • Opcode Fuzzy Hash: 46dab3c982c5c4f44246d51a3a1eeee750c8108d17309ab8a3e4ce16e1bafd74
                                                                                                                    • Instruction Fuzzy Hash: D1212575504240DFDB24DF14D5D0B26BBA1FB84315F28C6EDDD0A4B292C37AD80BCA61
                                                                                                                    Function 00B5D005 Relevance: .1, Instructions: 60COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163714801.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b5d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 47d543a8d7b3e628c83fa6346eb213e35b07ed2e6856d46777d609132b17146a
                                                                                                                    • Instruction ID: 0c339957e535836f1a0eae5d37150aae2d88f239784e4ada220d6df778e0b722
                                                                                                                    • Opcode Fuzzy Hash: 47d543a8d7b3e628c83fa6346eb213e35b07ed2e6856d46777d609132b17146a
                                                                                                                    • Instruction Fuzzy Hash: 3C2187755093C48FDB16CF20D594715BF71EB45314F28C6DAD8498B6A7C33AD80ACB62
                                                                                                                    Function 00B4D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163645674.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b4d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction ID: 667f82dd535a8cc80e75c1265ecf6cf2c363aef3e4754653e96345393d992848
                                                                                                                    • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction Fuzzy Hash: 39110376504280CFCB01CF10D5C0B16BFB1FB94318F24C6E9D8490B256C33AD956DBA1
                                                                                                                    Function 00B4D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163645674.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b4d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction ID: 5f5bf2a02a40892eadd4cf53bee52a9d7bfc0be9e8ef67009677179f966a1401
                                                                                                                    • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                    • Instruction Fuzzy Hash: F011B1B6504280DFCB15CF10D5C4B16BFB1FB94324F24C6A9D8490B756C33AE956DBA1
                                                                                                                    Function 00B5D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000C.00000002.2163714801.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_12_2_b5d000_DjsaCPLWOz.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
                                                                                                                    • Instruction ID: e97f4dd9754eddae360818c5bdefca4ecf11ac0c1d2ab7bd8ac262f9b6429d95
                                                                                                                    • Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
                                                                                                                    • Instruction Fuzzy Hash: AB117975504284DFCB15CF10D5C4B15BBA1FB84314F24C6E9DC494B6A6C37AD84ACB61

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:1.3%
                                                                                                                    Dynamic/Decrypted Code Coverage:2.7%
                                                                                                                    Signature Coverage:0%
                                                                                                                    Total number of Nodes:548
                                                                                                                    Total number of Limit Nodes:73
                                                                                                                    execution_graph 99659 1702ad0 LdrInitializeThunk 99660 41f0d0 99663 41b940 99660->99663 99664 41b966 99663->99664 99671 409d40 99664->99671 99666 41b972 99670 41b993 99666->99670 99679 40c1c0 99666->99679 99668 41b985 99715 41a680 99668->99715 99718 409c90 99671->99718 99673 409d4d 99674 409d54 99673->99674 99730 409c30 99673->99730 99674->99666 99680 40c1e5 99679->99680 100141 40b1c0 99680->100141 99682 40c23c 100145 40ae40 99682->100145 99684 40c4b3 99684->99668 99685 40c262 99685->99684 100154 4143a0 99685->100154 99687 40c2a7 99687->99684 100157 408a60 99687->100157 99689 40c2eb 99689->99684 100164 41a4d0 99689->100164 99693 40c341 99694 40c348 99693->99694 100176 419fe0 99693->100176 99695 41bd90 2 API calls 99694->99695 99697 40c355 99695->99697 99697->99668 99699 40c392 99700 41bd90 2 API calls 99699->99700 99701 40c399 99700->99701 99701->99668 99702 40c3a2 99703 40f4a0 3 API calls 99702->99703 99704 40c416 99703->99704 99704->99694 99705 40c421 99704->99705 99706 41bd90 2 API calls 99705->99706 99707 40c445 99706->99707 100181 41a030 99707->100181 99710 419fe0 2 API calls 99711 40c480 99710->99711 99711->99684 100186 419df0 99711->100186 99714 41a680 2 API calls 99714->99684 99716 41a69f ExitProcess 99715->99716 99717 41af30 LdrLoadDll 99715->99717 99717->99716 99719 409ca3 99718->99719 99770 418b90 LdrLoadDll 99718->99770 99750 418a40 99719->99750 99722 409cb6 99722->99673 99723 409cac 99723->99722 99753 41b280 99723->99753 99725 409cf3 99725->99722 99764 409ab0 99725->99764 99727 409d13 99771 409620 LdrLoadDll 99727->99771 99729 409d25 99729->99673 99731 409c40 99730->99731 100115 41b570 99731->100115 99734 41b570 LdrLoadDll 99735 409c5b 99734->99735 99736 41b570 LdrLoadDll 99735->99736 99737 409c71 99736->99737 99738 40f180 99737->99738 99739 40f199 99738->99739 100123 40b040 99739->100123 99741 40f1ac 100127 41a1b0 99741->100127 99744 409d65 99744->99666 99746 40f1d2 99747 40f1fd 99746->99747 100134 41a230 99746->100134 99749 41a460 2 API calls 99747->99749 99749->99744 99772 41a5d0 99750->99772 99754 41b299 99753->99754 99785 414a50 99754->99785 99756 41b2b1 99757 41b2ba 99756->99757 99824 41b0c0 99756->99824 99757->99725 99759 41b2ce 99759->99757 99842 419ed0 99759->99842 100093 407ea0 99764->100093 99766 409ad1 99766->99727 99767 409aca 99767->99766 100106 408160 99767->100106 99770->99719 99771->99729 99775 41af30 99772->99775 99774 418a55 99774->99723 99776 41af40 99775->99776 99778 41af62 99775->99778 99779 414e50 99776->99779 99778->99774 99780 414e6a 99779->99780 99781 414e5e 99779->99781 99780->99778 99781->99780 99784 4152d0 LdrLoadDll 99781->99784 99783 414fbc 99783->99778 99784->99783 99786 414d85 99785->99786 99787 414a64 99785->99787 99786->99756 99787->99786 99850 419c20 99787->99850 99790 414b90 99853 41a330 99790->99853 99791 414b73 99910 41a430 LdrLoadDll 99791->99910 99794 414b7d 99794->99756 99795 414bb7 99796 41bd90 2 API calls 99795->99796 99798 414bc3 99796->99798 99797 414d49 99800 41a460 2 API calls 99797->99800 99798->99794 99798->99797 99799 414d5f 99798->99799 99804 414c52 99798->99804 99919 414790 LdrLoadDll NtReadFile NtClose 99799->99919 99801 414d50 99800->99801 99801->99756 99803 414d72 99803->99756 99805 414cb9 99804->99805 99807 414c61 99804->99807 99805->99797 99806 414ccc 99805->99806 99912 41a2b0 99806->99912 99809 414c66 99807->99809 99810 414c7a 99807->99810 99911 414650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 99809->99911 99813 414c97 99810->99813 99814 414c7f 99810->99814 99813->99801 99868 414410 99813->99868 99856 4146f0 99814->99856 99816 414c70 99816->99756 99818 414d2c 99916 41a460 99818->99916 99819 414c8d 99819->99756 99822 414caf 99822->99756 99823 414d38 99823->99756 99825 41b0d1 99824->99825 99826 41b0e3 99825->99826 99938 41bd10 99825->99938 99826->99759 99828 41b104 99941 414070 99828->99941 99830 41b150 99830->99759 99831 41b127 99831->99830 99832 414070 3 API calls 99831->99832 99834 41b149 99832->99834 99834->99830 99966 415390 99834->99966 99835 41b1da 99836 41b1ea 99835->99836 100060 41aed0 LdrLoadDll 99835->100060 99976 41ad40 99836->99976 99839 41b218 100055 419e90 99839->100055 99843 419eec 99842->99843 99844 41af30 LdrLoadDll 99842->99844 100087 1702c0a 99843->100087 99844->99843 99845 419f07 99847 41bd90 99845->99847 99848 41b329 99847->99848 100090 41a640 99847->100090 99848->99725 99851 414b44 99850->99851 99852 41af30 LdrLoadDll 99850->99852 99851->99790 99851->99791 99851->99794 99852->99851 99854 41af30 LdrLoadDll 99853->99854 99855 41a34c NtCreateFile 99854->99855 99855->99795 99857 41470c 99856->99857 99858 41a2b0 LdrLoadDll 99857->99858 99859 41472d 99858->99859 99860 414734 99859->99860 99861 414748 99859->99861 99863 41a460 2 API calls 99860->99863 99862 41a460 2 API calls 99861->99862 99864 414751 99862->99864 99865 41473d 99863->99865 99920 41bfa0 LdrLoadDll RtlAllocateHeap 99864->99920 99865->99819 99867 41475c 99867->99819 99869 41445b 99868->99869 99870 41448e 99868->99870 99872 41a2b0 LdrLoadDll 99869->99872 99871 4145d9 99870->99871 99876 4144aa 99870->99876 99873 41a2b0 LdrLoadDll 99871->99873 99874 414476 99872->99874 99880 4145f4 99873->99880 99875 41a460 2 API calls 99874->99875 99877 41447f 99875->99877 99878 41a2b0 LdrLoadDll 99876->99878 99877->99822 99879 4144c5 99878->99879 99882 4144e1 99879->99882 99883 4144cc 99879->99883 99934 41a2f0 LdrLoadDll 99880->99934 99886 4144e6 99882->99886 99887 4144fc 99882->99887 99885 41a460 2 API calls 99883->99885 99884 41462e 99888 41a460 2 API calls 99884->99888 99889 4144d5 99885->99889 99890 41a460 2 API calls 99886->99890 99896 414501 99887->99896 99921 41bf60 99887->99921 99892 414639 99888->99892 99889->99822 99893 4144ef 99890->99893 99891 414513 99891->99822 99892->99822 99893->99822 99896->99891 99925 41a3e0 99896->99925 99897 41457e 99899 414585 99897->99899 99900 41459a 99897->99900 99898 414567 99898->99897 99933 41a270 LdrLoadDll 99898->99933 99902 41a460 2 API calls 99899->99902 99903 41a460 2 API calls 99900->99903 99902->99891 99904 4145a3 99903->99904 99905 4145cf 99904->99905 99928 41bb60 99904->99928 99905->99822 99907 4145ba 99908 41bd90 2 API calls 99907->99908 99909 4145c3 99908->99909 99909->99822 99910->99794 99911->99816 99913 414d14 99912->99913 99914 41af30 LdrLoadDll 99912->99914 99915 41a2f0 LdrLoadDll 99913->99915 99914->99913 99915->99818 99917 41a47c NtClose 99916->99917 99918 41af30 LdrLoadDll 99916->99918 99917->99823 99918->99917 99919->99803 99920->99867 99922 41bf6e 99921->99922 99935 41a600 99922->99935 99924 41bf78 99924->99896 99926 41a3fc NtReadFile 99925->99926 99927 41af30 LdrLoadDll 99925->99927 99926->99898 99927->99926 99929 41bb84 99928->99929 99930 41bb6d 99928->99930 99929->99907 99930->99929 99931 41bf60 2 API calls 99930->99931 99932 41bb9b 99931->99932 99932->99907 99933->99897 99934->99884 99936 41af30 LdrLoadDll 99935->99936 99937 41a61c RtlAllocateHeap 99936->99937 99937->99924 99939 41bd3d 99938->99939 100061 41a510 99938->100061 99939->99828 99942 414081 99941->99942 99943 414089 99941->99943 99942->99831 99965 41435c 99943->99965 100064 41cf00 99943->100064 99945 4140dd 99946 41cf00 2 API calls 99945->99946 99950 4140e8 99946->99950 99947 414136 99949 41cf00 2 API calls 99947->99949 99952 41414a 99949->99952 99950->99947 100069 41cfa0 99950->100069 99951 41cf00 2 API calls 99954 4141bd 99951->99954 99952->99951 99953 41cf00 2 API calls 99962 414205 99953->99962 99954->99953 99956 414334 100076 41cf60 LdrLoadDll RtlFreeHeap 99956->100076 99958 41433e 100077 41cf60 LdrLoadDll RtlFreeHeap 99958->100077 99960 414348 100078 41cf60 LdrLoadDll RtlFreeHeap 99960->100078 100075 41cf60 LdrLoadDll RtlFreeHeap 99962->100075 99963 414352 100079 41cf60 LdrLoadDll RtlFreeHeap 99963->100079 99965->99831 99967 4153a1 99966->99967 99968 414a50 8 API calls 99967->99968 99970 4153b7 99968->99970 99969 41540a 99969->99835 99970->99969 99971 4153f2 99970->99971 99972 415405 99970->99972 99973 41bd90 2 API calls 99971->99973 99974 41bd90 2 API calls 99972->99974 99975 4153f7 99973->99975 99974->99969 99975->99835 100080 41ac00 99976->100080 99979 41ac00 LdrLoadDll 99980 41ad5d 99979->99980 99981 41ac00 LdrLoadDll 99980->99981 99982 41ad66 99981->99982 99983 41ac00 LdrLoadDll 99982->99983 99984 41ad6f 99983->99984 99985 41ac00 LdrLoadDll 99984->99985 99986 41ad78 99985->99986 99987 41ac00 LdrLoadDll 99986->99987 99988 41ad81 99987->99988 99989 41ac00 LdrLoadDll 99988->99989 99990 41ad8d 99989->99990 99991 41ac00 LdrLoadDll 99990->99991 99992 41ad96 99991->99992 99993 41ac00 LdrLoadDll 99992->99993 99994 41ad9f 99993->99994 99995 41ac00 LdrLoadDll 99994->99995 99996 41ada8 99995->99996 99997 41ac00 LdrLoadDll 99996->99997 99998 41adb1 99997->99998 99999 41ac00 LdrLoadDll 99998->99999 100000 41adba 99999->100000 100001 41ac00 LdrLoadDll 100000->100001 100002 41adc6 100001->100002 100003 41ac00 LdrLoadDll 100002->100003 100004 41adcf 100003->100004 100005 41ac00 LdrLoadDll 100004->100005 100006 41add8 100005->100006 100007 41ac00 LdrLoadDll 100006->100007 100008 41ade1 100007->100008 100009 41ac00 LdrLoadDll 100008->100009 100010 41adea 100009->100010 100011 41ac00 LdrLoadDll 100010->100011 100012 41adf3 100011->100012 100013 41ac00 LdrLoadDll 100012->100013 100014 41adff 100013->100014 100015 41ac00 LdrLoadDll 100014->100015 100016 41ae08 100015->100016 100017 41ac00 LdrLoadDll 100016->100017 100018 41ae11 100017->100018 100019 41ac00 LdrLoadDll 100018->100019 100020 41ae1a 100019->100020 100021 41ac00 LdrLoadDll 100020->100021 100022 41ae23 100021->100022 100023 41ac00 LdrLoadDll 100022->100023 100024 41ae2c 100023->100024 100025 41ac00 LdrLoadDll 100024->100025 100026 41ae38 100025->100026 100027 41ac00 LdrLoadDll 100026->100027 100028 41ae41 100027->100028 100029 41ac00 LdrLoadDll 100028->100029 100030 41ae4a 100029->100030 100031 41ac00 LdrLoadDll 100030->100031 100032 41ae53 100031->100032 100033 41ac00 LdrLoadDll 100032->100033 100034 41ae5c 100033->100034 100035 41ac00 LdrLoadDll 100034->100035 100036 41ae65 100035->100036 100037 41ac00 LdrLoadDll 100036->100037 100038 41ae71 100037->100038 100039 41ac00 LdrLoadDll 100038->100039 100040 41ae7a 100039->100040 100041 41ac00 LdrLoadDll 100040->100041 100042 41ae83 100041->100042 100043 41ac00 LdrLoadDll 100042->100043 100044 41ae8c 100043->100044 100045 41ac00 LdrLoadDll 100044->100045 100046 41ae95 100045->100046 100047 41ac00 LdrLoadDll 100046->100047 100048 41ae9e 100047->100048 100049 41ac00 LdrLoadDll 100048->100049 100050 41aeaa 100049->100050 100051 41ac00 LdrLoadDll 100050->100051 100052 41aeb3 100051->100052 100053 41ac00 LdrLoadDll 100052->100053 100054 41aebc 100053->100054 100054->99839 100056 41af30 LdrLoadDll 100055->100056 100057 419eac 100056->100057 100058 419ec3 100057->100058 100086 1702df0 LdrInitializeThunk 100057->100086 100058->99759 100060->99836 100062 41a52c NtAllocateVirtualMemory 100061->100062 100063 41af30 LdrLoadDll 100061->100063 100062->99939 100063->100062 100065 41cf10 100064->100065 100066 41cf16 100064->100066 100065->99945 100067 41bf60 2 API calls 100066->100067 100068 41cf3c 100067->100068 100068->99945 100070 41cfc5 100069->100070 100074 41cffd 100069->100074 100071 41bf60 2 API calls 100070->100071 100072 41cfda 100071->100072 100073 41bd90 2 API calls 100072->100073 100073->100074 100074->99950 100075->99956 100076->99958 100077->99960 100078->99963 100079->99965 100081 41ac1b 100080->100081 100082 414e50 LdrLoadDll 100081->100082 100083 41ac3b 100082->100083 100084 414e50 LdrLoadDll 100083->100084 100085 41ace7 100083->100085 100084->100085 100085->99979 100086->100058 100088 1702c11 100087->100088 100089 1702c1f LdrInitializeThunk 100087->100089 100088->99845 100089->99845 100091 41af30 LdrLoadDll 100090->100091 100092 41a65c RtlFreeHeap 100091->100092 100092->99848 100094 407eb0 100093->100094 100095 407eab 100093->100095 100096 41bd10 2 API calls 100094->100096 100095->99767 100099 407ed5 100096->100099 100097 407f38 100097->99767 100098 419e90 2 API calls 100098->100099 100099->100097 100099->100098 100100 407f3e 100099->100100 100104 41bd10 2 API calls 100099->100104 100109 41a590 100099->100109 100102 407f64 100100->100102 100103 41a590 2 API calls 100100->100103 100102->99767 100105 407f55 100103->100105 100104->100099 100105->99767 100107 41a590 2 API calls 100106->100107 100108 40817e 100107->100108 100108->99727 100110 41a5ac 100109->100110 100111 41af30 LdrLoadDll 100109->100111 100114 1702c70 LdrInitializeThunk 100110->100114 100111->100110 100112 41a5c3 100112->100099 100114->100112 100116 41b593 100115->100116 100119 40acf0 100116->100119 100120 40ad14 100119->100120 100121 40ad50 LdrLoadDll 100120->100121 100122 409c4a 100120->100122 100121->100122 100122->99734 100124 40b063 100123->100124 100126 40b0e0 100124->100126 100139 419c60 LdrLoadDll 100124->100139 100126->99741 100128 41af30 LdrLoadDll 100127->100128 100129 40f1bb 100128->100129 100129->99744 100130 41a7a0 100129->100130 100131 41a7bf LookupPrivilegeValueW 100130->100131 100132 41af30 LdrLoadDll 100130->100132 100131->99746 100132->100131 100135 41a24c 100134->100135 100136 41af30 LdrLoadDll 100134->100136 100140 1702ea0 LdrInitializeThunk 100135->100140 100136->100135 100137 41a26b 100137->99747 100139->100126 100140->100137 100142 40b1f0 100141->100142 100143 40b040 LdrLoadDll 100142->100143 100144 40b204 100143->100144 100144->99682 100146 40ae51 100145->100146 100147 40ae4d 100145->100147 100148 40ae6a 100146->100148 100149 40ae9c 100146->100149 100147->99685 100191 419ca0 LdrLoadDll 100148->100191 100192 419ca0 LdrLoadDll 100149->100192 100151 40aead 100151->99685 100153 40ae8c 100153->99685 100155 40f4a0 3 API calls 100154->100155 100156 4143c6 100154->100156 100155->100156 100156->99687 100158 408a79 100157->100158 100193 4087a0 100157->100193 100160 408a9d 100158->100160 100161 4087a0 19 API calls 100158->100161 100160->99689 100162 408a8a 100161->100162 100162->100160 100211 40f710 10 API calls 100162->100211 100165 41af30 LdrLoadDll 100164->100165 100166 41a4ec 100165->100166 100330 1702e80 LdrInitializeThunk 100166->100330 100167 40c322 100169 40f4a0 100167->100169 100170 40f4bd 100169->100170 100331 419f90 100170->100331 100173 40f505 100173->99693 100174 419fe0 2 API calls 100175 40f52e 100174->100175 100175->99693 100177 419ffc 100176->100177 100178 41af30 LdrLoadDll 100176->100178 100337 1702d10 LdrInitializeThunk 100177->100337 100178->100177 100179 40c385 100179->99699 100179->99702 100182 41af30 LdrLoadDll 100181->100182 100183 41a04c 100182->100183 100338 1702d30 LdrInitializeThunk 100183->100338 100184 40c459 100184->99710 100187 41af30 LdrLoadDll 100186->100187 100188 419e0c 100187->100188 100339 1702fb0 LdrInitializeThunk 100188->100339 100189 40c4ac 100189->99714 100191->100153 100192->100151 100194 407ea0 4 API calls 100193->100194 100209 4087ba 100194->100209 100195 408a49 100195->100158 100196 408a3f 100197 408160 2 API calls 100196->100197 100197->100195 100200 419ed0 2 API calls 100200->100209 100202 41a460 LdrLoadDll NtClose 100202->100209 100205 40c4c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 100205->100209 100208 419df0 2 API calls 100208->100209 100209->100195 100209->100196 100209->100200 100209->100202 100209->100205 100209->100208 100212 419ce0 100209->100212 100215 4085d0 100209->100215 100227 40f5f0 LdrLoadDll NtClose 100209->100227 100228 419d60 LdrLoadDll 100209->100228 100229 419d90 LdrLoadDll 100209->100229 100230 419e20 LdrLoadDll 100209->100230 100231 4083a0 100209->100231 100247 405f60 LdrLoadDll 100209->100247 100211->100160 100213 419cfc 100212->100213 100214 41af30 LdrLoadDll 100212->100214 100213->100209 100214->100213 100216 4085e6 100215->100216 100248 419850 100216->100248 100218 4085ff 100219 408771 100218->100219 100269 4081a0 100218->100269 100219->100209 100221 4086e5 100221->100219 100222 4083a0 11 API calls 100221->100222 100223 408713 100222->100223 100223->100219 100224 419ed0 2 API calls 100223->100224 100225 408748 100224->100225 100225->100219 100226 41a4d0 2 API calls 100225->100226 100226->100219 100227->100209 100228->100209 100229->100209 100230->100209 100232 4083c9 100231->100232 100309 408310 100232->100309 100235 41a4d0 2 API calls 100236 4083dc 100235->100236 100236->100235 100237 408467 100236->100237 100239 408462 100236->100239 100317 40f670 100236->100317 100237->100209 100238 41a460 2 API calls 100240 40849a 100238->100240 100239->100238 100240->100237 100241 419ce0 LdrLoadDll 100240->100241 100242 4084ff 100241->100242 100242->100237 100321 419d20 100242->100321 100244 408563 100244->100237 100245 414a50 8 API calls 100244->100245 100246 4085b8 100245->100246 100246->100209 100247->100209 100249 41bf60 2 API calls 100248->100249 100250 419867 100249->100250 100276 409310 100250->100276 100252 419882 100253 4198c0 100252->100253 100254 4198a9 100252->100254 100257 41bd10 2 API calls 100253->100257 100255 41bd90 2 API calls 100254->100255 100256 4198b6 100255->100256 100256->100218 100258 4198fa 100257->100258 100259 41bd10 2 API calls 100258->100259 100260 419913 100259->100260 100266 419bb4 100260->100266 100282 41bd50 100260->100282 100263 419ba0 100264 41bd90 2 API calls 100263->100264 100265 419baa 100264->100265 100265->100218 100267 41bd90 2 API calls 100266->100267 100268 419c09 100267->100268 100268->100218 100270 40829f 100269->100270 100271 4081b5 100269->100271 100270->100221 100271->100270 100272 414a50 8 API calls 100271->100272 100273 408222 100272->100273 100274 41bd90 2 API calls 100273->100274 100275 408249 100273->100275 100274->100275 100275->100221 100277 409335 100276->100277 100278 40acf0 LdrLoadDll 100277->100278 100279 409368 100278->100279 100281 40938d 100279->100281 100285 40cf20 100279->100285 100281->100252 100303 41a550 100282->100303 100286 40cf4c 100285->100286 100287 41a1b0 LdrLoadDll 100286->100287 100288 40cf65 100287->100288 100289 40cf6c 100288->100289 100296 41a1f0 100288->100296 100289->100281 100293 40cfa7 100294 41a460 2 API calls 100293->100294 100295 40cfca 100294->100295 100295->100281 100297 41a20c 100296->100297 100298 41af30 LdrLoadDll 100296->100298 100299 40cf8f 100297->100299 100302 1702ca0 LdrInitializeThunk 100297->100302 100298->100297 100299->100289 100301 41a7e0 LdrLoadDll 100299->100301 100301->100293 100302->100299 100304 41af30 LdrLoadDll 100303->100304 100305 41a56c 100304->100305 100308 1702f90 LdrInitializeThunk 100305->100308 100306 419b99 100306->100263 100306->100266 100308->100306 100310 408328 100309->100310 100311 40acf0 LdrLoadDll 100310->100311 100312 408343 100311->100312 100313 414e50 LdrLoadDll 100312->100313 100314 408353 100313->100314 100315 40835c PostThreadMessageW 100314->100315 100316 408370 100314->100316 100315->100316 100316->100236 100318 40f683 100317->100318 100324 419e60 100318->100324 100322 419d3c 100321->100322 100323 41af30 LdrLoadDll 100321->100323 100322->100244 100323->100322 100325 419e7c 100324->100325 100326 41af30 LdrLoadDll 100324->100326 100329 1702dd0 LdrInitializeThunk 100325->100329 100326->100325 100327 40f6ae 100327->100236 100329->100327 100330->100167 100332 419fac 100331->100332 100333 41af30 LdrLoadDll 100331->100333 100336 1702f30 LdrInitializeThunk 100332->100336 100333->100332 100334 40f4fe 100334->100173 100334->100174 100336->100334 100337->100179 100338->100184 100339->100189

                                                                                                                    Executed Functions

                                                                                                                    Function 0041A3DD Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 0 41a3dd-41a429 call 41af30 NtReadFile
                                                                                                                    APIs
                                                                                                                    • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A425
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FileRead
                                                                                                                    • String ID: 1JA$rMA$rMA
                                                                                                                    • API String ID: 2738559852-782607585
                                                                                                                    • Opcode ID: d0fd2fa676037548bfee32348a691438495e76661c9f3d3cc333c064b374a7c0
                                                                                                                    • Instruction ID: d4360ac5b69843ba7f1b4e19baeb887bd84dc6bf54433842aafc9b36623450eb
                                                                                                                    • Opcode Fuzzy Hash: d0fd2fa676037548bfee32348a691438495e76661c9f3d3cc333c064b374a7c0
                                                                                                                    • Instruction Fuzzy Hash: 2FF0F4B2210108ABCB08DF89CC81EEB77A9EF8C314F118249BE1DA7241C630E811CBA0
                                                                                                                    Function 0041A3E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 3 41a3e0-41a3f6 4 41a3fc-41a429 NtReadFile 3->4 5 41a3f7 call 41af30 3->5 5->4
                                                                                                                    APIs
                                                                                                                    • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A425
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FileRead
                                                                                                                    • String ID: 1JA$rMA$rMA
                                                                                                                    • API String ID: 2738559852-782607585
                                                                                                                    • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                    • Instruction ID: c75c44bd16ed9a046d03b4490adc68ebadf214b0f3589fd2ba36fb57c0fad8bd
                                                                                                                    • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                    • Instruction Fuzzy Hash: 95F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                                                                                                    Function 0041A330 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 258 41a330-41a381 call 41af30 NtCreateFile
                                                                                                                    APIs
                                                                                                                    • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A37D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateFile
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 823142352-0
                                                                                                                    • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                    • Instruction ID: 7ed6e6cb708c972561b0f9910f559a39af1ab3cc862b6eef20835abd22e26781
                                                                                                                    • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                    • Instruction Fuzzy Hash: C4F0BDB2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E851CBA4
                                                                                                                    Function 0041A50A Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 264 41a50a-41a54d call 41af30 NtAllocateVirtualMemory
                                                                                                                    APIs
                                                                                                                    • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B104,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A549
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateMemoryVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2167126740-0
                                                                                                                    • Opcode ID: 8e98dd363e6cbb4194df273d667f016c0ebb9718585f1da8443e318f4019beac
                                                                                                                    • Instruction ID: 0435345156c0ab3a092ec18c928051dad1933715447059083d21fc7a375db11c
                                                                                                                    • Opcode Fuzzy Hash: 8e98dd363e6cbb4194df273d667f016c0ebb9718585f1da8443e318f4019beac
                                                                                                                    • Instruction Fuzzy Hash: 57F08CB1210208ABCB14DF89CC80EEB37ADEF88314F048109BE08A7241C630E811CBE0
                                                                                                                    Function 0041A510 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 268 41a510-41a526 269 41a52c-41a54d NtAllocateVirtualMemory 268->269 270 41a527 call 41af30 268->270 270->269
                                                                                                                    APIs
                                                                                                                    • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B104,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A549
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateMemoryVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2167126740-0
                                                                                                                    • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                    • Instruction ID: 8b47746d7073478515a2f8fd1fb94e42dcc9ffa91ac9ff965dae3841ed3a313c
                                                                                                                    • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                    • Instruction Fuzzy Hash: 9CF015B2210208ABCB14DF89CC81EEB77ADAF88754F118149BE0897241C630F811CBA4
                                                                                                                    Function 0041A45A Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A485
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: Close
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3535843008-0
                                                                                                                    • Opcode ID: 5d3b467a68f710aaff65291511d1bbdf67ebdd1e2d3a2d0e9b69b9b7b55cd054
                                                                                                                    • Instruction ID: d488d0bf4fa4e64719adedaae0a34d8314b85153388e6f82da1405f56c156318
                                                                                                                    • Opcode Fuzzy Hash: 5d3b467a68f710aaff65291511d1bbdf67ebdd1e2d3a2d0e9b69b9b7b55cd054
                                                                                                                    • Instruction Fuzzy Hash: 11E08C75250204BBD714EF94CC45ED77768EF48324F0440A9BA185B242D130F61186D0
                                                                                                                    Function 0041A460 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A485
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: Close
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3535843008-0
                                                                                                                    • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                    • Instruction ID: e9450f8bec15428cdd91297f97b7848412804bda5c7d31b3f0e5b01193c95e83
                                                                                                                    • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                    • Instruction Fuzzy Hash: 3CD01776211214ABD710EB99CC85EE77BACEF48764F15449ABA189B242C530FA1186E0
                                                                                                                    Function 01702B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 002f0276833cfa497716172d34573b5ac96c60c6ab7050e437dc94e1099b2bb8
                                                                                                                    • Instruction ID: 303c684bc625a8e30155136965f9a11d375cdd934296fd773830e69912d4ea8c
                                                                                                                    • Opcode Fuzzy Hash: 002f0276833cfa497716172d34573b5ac96c60c6ab7050e437dc94e1099b2bb8
                                                                                                                    • Instruction Fuzzy Hash: 14900262256400034305715C4414616900A97E1201B55C031E10145A0DC6258A916226
                                                                                                                    Function 01702BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: bcd4b59e7d85b53714d9891ec32aedb34d8285fc3b9febf5621354ccf65fa2c1
                                                                                                                    • Instruction ID: 2fbbb84bfc50d9a46586c02444bf8188db4f86628a23ad2ec7a5a94550fd3a86
                                                                                                                    • Opcode Fuzzy Hash: bcd4b59e7d85b53714d9891ec32aedb34d8285fc3b9febf5621354ccf65fa2c1
                                                                                                                    • Instruction Fuzzy Hash: 0E90023225540803D380715C440464A500597D2301F95C025A0025664DCB158B5977A2
                                                                                                                    Function 01702AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ffa83c17bf96cdcd8caf7f62c7651b07128547e2ff23503e54f6fca278db4d60
                                                                                                                    • Instruction ID: c7d58190b24ebb88390d059c1eb1c50c63ffa6bf811612284f03a48e73ae9161
                                                                                                                    • Opcode Fuzzy Hash: ffa83c17bf96cdcd8caf7f62c7651b07128547e2ff23503e54f6fca278db4d60
                                                                                                                    • Instruction Fuzzy Hash: D8900226265400030305B55C0704507504697D6351355C031F1015560CD7218A615222
                                                                                                                    Function 01702D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 52e162ce196de31e394ad03b25c8e6f429a6067b54396bd00c60acdbb0c09a61
                                                                                                                    • Instruction ID: 0996331cff4675991108ba82868de8e3640faacd9cb9ebeb1d44caa28efabcc1
                                                                                                                    • Opcode Fuzzy Hash: 52e162ce196de31e394ad03b25c8e6f429a6067b54396bd00c60acdbb0c09a61
                                                                                                                    • Instruction Fuzzy Hash: 3A90022235540003D340715C54186069005E7E2301F55D021E0414564CDA158A565323
                                                                                                                    Function 01702D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 50461956e34b5d64f3b1a0d4c3348e716fdea3174ce585bc0c0d7caa83276780
                                                                                                                    • Instruction ID: 94ace7b92fda22909b40290ea09b5009d15e823add42de2bd9e20087974c7f7d
                                                                                                                    • Opcode Fuzzy Hash: 50461956e34b5d64f3b1a0d4c3348e716fdea3174ce585bc0c0d7caa83276780
                                                                                                                    • Instruction Fuzzy Hash: 2A90022A26740003D380715C540860A500597D2202F95D425A0015568CCA158A695322
                                                                                                                    Function 01702DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 76697d5127d853aa67e1929212e28fc58df3fb53277eb54e78f8c7512ff9c705
                                                                                                                    • Instruction ID: 2eee14576784d90666d29e4471d0251e91a2671cb37d16f1c13eb5aa82aa2606
                                                                                                                    • Opcode Fuzzy Hash: 76697d5127d853aa67e1929212e28fc58df3fb53277eb54e78f8c7512ff9c705
                                                                                                                    • Instruction Fuzzy Hash: 2290023225540413D311715C4504707500997D1241F95C422A0424568DD7568B52A222
                                                                                                                    Function 01702DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 0387c95ea207988227339718d14c400a21196d5ce14f6c5012f08dccfa2190ae
                                                                                                                    • Instruction ID: d2644afa34436a83b076bf7659654514a26c333e4c2413d859d3386774335516
                                                                                                                    • Opcode Fuzzy Hash: 0387c95ea207988227339718d14c400a21196d5ce14f6c5012f08dccfa2190ae
                                                                                                                    • Instruction Fuzzy Hash: 83900222296441535745B15C44045079006A7E1241795C022A1414960CC6269A56D722
                                                                                                                    Function 01702C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: d07f7c2c80b48dcc8042bf82a2499aba5dc84a080d09d6c6c36b71f5ffa3445d
                                                                                                                    • Instruction ID: df347039c994c2c61539318e00d401e06eaa9a61d124cafbdb757c560c0751d2
                                                                                                                    • Opcode Fuzzy Hash: d07f7c2c80b48dcc8042bf82a2499aba5dc84a080d09d6c6c36b71f5ffa3445d
                                                                                                                    • Instruction Fuzzy Hash: DB90023225548803D310715C840474A500597D1301F59C421A4424668DC7958A917222
                                                                                                                    Function 01702CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: f2a5be804a715e59b6c0f965b1852ffbe6309683078da7c987110dc5b16ecbb5
                                                                                                                    • Instruction ID: f8233229b18ddb53a6241a73d91227a2800925c4079bd606384ec5927f2ba0a1
                                                                                                                    • Opcode Fuzzy Hash: f2a5be804a715e59b6c0f965b1852ffbe6309683078da7c987110dc5b16ecbb5
                                                                                                                    • Instruction Fuzzy Hash: 8390023225540403D300759C5408646500597E1301F55D021A5024565EC7658A916232
                                                                                                                    Function 01702F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 8e4a0db1f5412393872a63440c82c379f0868f3948d97c3a935a9ce3ae1dd8d5
                                                                                                                    • Instruction ID: c8c4bad9d5f03dbed9cb47b6b4518d2261869cdc911e8a6a66e4ac4caba6466a
                                                                                                                    • Opcode Fuzzy Hash: 8e4a0db1f5412393872a63440c82c379f0868f3948d97c3a935a9ce3ae1dd8d5
                                                                                                                    • Instruction Fuzzy Hash: 2F90026239540443D300715C4414B065005D7E2301F55C025E1064564DC719CE526227
                                                                                                                    Function 01702FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 86190d62e70556d19f477efa8a70cc2ebc4ec0bc0aee98ee7e9f6ead66dcc6aa
                                                                                                                    • Instruction ID: 51aaf0483add0b7bedf567272d20fc6436accb0e9b44f612f4d02abb207fc310
                                                                                                                    • Opcode Fuzzy Hash: 86190d62e70556d19f477efa8a70cc2ebc4ec0bc0aee98ee7e9f6ead66dcc6aa
                                                                                                                    • Instruction Fuzzy Hash: EF900222265C0043D300756C4C14B07500597D1303F55C125A0154564CCA158A615622
                                                                                                                    Function 01702FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: cf8df855816d4ae2e6373534b31680d859f7490a7feb4c3d31bb6283c5053579
                                                                                                                    • Instruction ID: 3759aba5b9981250a4e4783d85c982f8eb85835b193b31114e61efd0a747f5de
                                                                                                                    • Opcode Fuzzy Hash: cf8df855816d4ae2e6373534b31680d859f7490a7feb4c3d31bb6283c5053579
                                                                                                                    • Instruction Fuzzy Hash: 5A900222655400434340716C88449069005BBE2211755C131A0998560DC6598A655766
                                                                                                                    Function 01702F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 08fcc6c96870c8cd76dbaec2de142ec1af98ae2418995738c3ee95f0a43ff2c7
                                                                                                                    • Instruction ID: f3631c2945548e386a015880297d9384a6d28bed747a3f4c7cfd5031a312b7f2
                                                                                                                    • Opcode Fuzzy Hash: 08fcc6c96870c8cd76dbaec2de142ec1af98ae2418995738c3ee95f0a43ff2c7
                                                                                                                    • Instruction Fuzzy Hash: 0990023225580403D300715C481470B500597D1302F55C021A1164565DC7258A516672
                                                                                                                    Function 01702EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 8ee78f4230269b9d28fc7374dcdc055c8b5a895a66c072aa0c35f13112a7b038
                                                                                                                    • Instruction ID: b9f25b53c3a406ba4dc3f81f3d4cd6468b7fe7525cad29fc3a0893b470309144
                                                                                                                    • Opcode Fuzzy Hash: 8ee78f4230269b9d28fc7374dcdc055c8b5a895a66c072aa0c35f13112a7b038
                                                                                                                    • Instruction Fuzzy Hash: 5490027225540403D340715C4404746500597D1301F55C021A5064564EC7598FD56766
                                                                                                                    Function 01702E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ce70a7ff661a29ef1bb2029b0acfb67e10032779708aef15e5e5b9a702a2cc82
                                                                                                                    • Instruction ID: 1decb71bc1bdf632251ba2c54fb82f22cb2f51c71c1dbb8add2893da12c69c7e
                                                                                                                    • Opcode Fuzzy Hash: ce70a7ff661a29ef1bb2029b0acfb67e10032779708aef15e5e5b9a702a2cc82
                                                                                                                    • Instruction Fuzzy Hash: 2790022265540503D301715C4404616500A97D1241F95C032A1024565ECB258B92A232
                                                                                                                    Function 0041A745 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                    • String ID: .AP
                                                                                                                    • API String ID: 3899507212-3996626295
                                                                                                                    • Opcode ID: aabae8c4149cba7c7552cc2964eda48ac3dbb9147c169a43c49f200a9c8fa95b
                                                                                                                    • Instruction ID: a2026d221001ece8e07f97ecf387a6c3bd36ce84549689ac952d8f2f99152e1c
                                                                                                                    • Opcode Fuzzy Hash: aabae8c4149cba7c7552cc2964eda48ac3dbb9147c169a43c49f200a9c8fa95b
                                                                                                                    • Instruction Fuzzy Hash: AF0129B5210204AFCB04DF99DC81DEB77A9AF88314F018159FD4C97242C634E966CBB5
                                                                                                                    Function 0041A600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 15 41a600-41a631 call 41af30 RtlAllocateHeap
                                                                                                                    APIs
                                                                                                                    • RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A62D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateHeap
                                                                                                                    • String ID: 6EA
                                                                                                                    • API String ID: 1279760036-1400015478
                                                                                                                    • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                    • Instruction ID: 226561cf9c8a986873ffc081809f26ad69fcc4b20f94c9d7be20fabd3b8eb7db
                                                                                                                    • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                    • Instruction Fuzzy Hash: 24E012B1211208ABDB14EF99CC41EA777ACAF88664F118559BA085B242C630F911CAB0
                                                                                                                    Function 00408309 Relevance: 1.6, APIs: 1, Instructions: 56threadwindowCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 213 408309-40835a call 41be30 call 41c9d0 call 40acf0 call 414e50 222 40835c-40836e PostThreadMessageW 213->222 223 40838e-408392 213->223 224 408370-40838a call 40a480 222->224 225 40838d 222->225 224->225 225->223
                                                                                                                    APIs
                                                                                                                    • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePostThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1836367815-0
                                                                                                                    • Opcode ID: 693ff8fe3ab662aba22a0f4906f7d0ad7010bf78851cb405694a08299bb8f006
                                                                                                                    • Instruction ID: a107327e3af74cd298d00712a59031634e66c7b2234dd660ca556f942aebb97e
                                                                                                                    • Opcode Fuzzy Hash: 693ff8fe3ab662aba22a0f4906f7d0ad7010bf78851cb405694a08299bb8f006
                                                                                                                    • Instruction Fuzzy Hash: 1A01B571A9031876EB20A6959C03FFE7B689B40F54F04011EFF04BA1C1E6A9690646EA
                                                                                                                    Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 228 408310-40831f 229 408328-40835a call 41c9d0 call 40acf0 call 414e50 228->229 230 408323 call 41be30 228->230 237 40835c-40836e PostThreadMessageW 229->237 238 40838e-408392 229->238 230->229 239 408370-40838a call 40a480 237->239 240 40838d 237->240 239->240 240->238
                                                                                                                    APIs
                                                                                                                    • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePostThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1836367815-0
                                                                                                                    • Opcode ID: 1eae49b1dd1fdf1f4ed343fddf3187855c82dbc596373200d6923005f005e771
                                                                                                                    • Instruction ID: 43d593e10ad008c4695c17d6314bf6f3e92d4c432431edd93db89b762a987e15
                                                                                                                    • Opcode Fuzzy Hash: 1eae49b1dd1fdf1f4ed343fddf3187855c82dbc596373200d6923005f005e771
                                                                                                                    • Instruction Fuzzy Hash: E2018471A8032877E720A6959D43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA
                                                                                                                    Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 243 40acf0-40ad19 call 41cc20 246 40ad1b-40ad1e 243->246 247 40ad1f-40ad2d call 41d040 243->247 250 40ad3d-40ad4e call 41b470 247->250 251 40ad2f-40ad3a call 41d2c0 247->251 256 40ad50-40ad64 LdrLoadDll 250->256 257 40ad67-40ad6a 250->257 251->250 256->257
                                                                                                                    APIs
                                                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: Load
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2234796835-0
                                                                                                                    • Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                    • Instruction ID: 667dcf47c4413345b20473d406be44d3d8b7ebea9a3b2269cd40777f9644ce6e
                                                                                                                    • Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                    • Instruction Fuzzy Hash: 79015EB5D0020DBBDB10EBA1DC42FDEB3799F54308F0045AAA908A7281F638EB54CB95
                                                                                                                    Function 0041A632 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 261 41a632-41a656 262 41a65c-41a671 RtlFreeHeap 261->262 263 41a657 call 41af30 261->263 263->262
                                                                                                                    APIs
                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FreeHeap
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3298025750-0
                                                                                                                    • Opcode ID: e6ae964f8ec6dd29bfeb82a1bc8d2991c6bd60e971231ad2d863a1ef3c0c1beb
                                                                                                                    • Instruction ID: d6343332d30a81f5fd92b4ddee1758047473a252feee6e74f272bf2f292e948b
                                                                                                                    • Opcode Fuzzy Hash: e6ae964f8ec6dd29bfeb82a1bc8d2991c6bd60e971231ad2d863a1ef3c0c1beb
                                                                                                                    • Instruction Fuzzy Hash: 56E0EDB52102006BCB14DFB8CC08EE73BACAF88750F014249F90C5B245C131E914CAB0
                                                                                                                    Function 0041A7D5 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 271 41a7d5-41a7db 272 41a7d0-41a7d4 LookupPrivilegeValueW 271->272 273 41a7dd-41a810 call 41af30 271->273
                                                                                                                    APIs
                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3899507212-0
                                                                                                                    • Opcode ID: 7ef6ad37eb9ffca0e74339ab526ec4af0854bef4afc0e73091c9dce3c3af7b19
                                                                                                                    • Instruction ID: 67068b118a6f605efd830c3f62bb11fd949e07eaffad9b74eb94aea8f80a9ca6
                                                                                                                    • Opcode Fuzzy Hash: 7ef6ad37eb9ffca0e74339ab526ec4af0854bef4afc0e73091c9dce3c3af7b19
                                                                                                                    • Instruction Fuzzy Hash: 2EE06871109208ABDB00BB99AD89EE73B28DFC0360F04499FF95D5B242C830B529C3A2
                                                                                                                    Function 0041A640 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 278 41a640-41a671 call 41af30 RtlFreeHeap
                                                                                                                    APIs
                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FreeHeap
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3298025750-0
                                                                                                                    • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                    • Instruction ID: 3f65de21c9b51a2b7742007d51c6b1fad19b07b0b1b2c98d2bb582ee848745b4
                                                                                                                    • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                    • Instruction Fuzzy Hash: 1EE046B1210208ABDB18EF99CC49EE777ACEF88764F018559FE085B242C630F911CAF0
                                                                                                                    Function 0041A7A0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3899507212-0
                                                                                                                    • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                    • Instruction ID: a195d06a74d451d332e2306e76e7c3aa502b90bd3f16d73f11471c4c6d802808
                                                                                                                    • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                    • Instruction Fuzzy Hash: 2FE01AB12102086BDB10DF49CC85EE737ADAF88654F018155BA0857241C934E8118BF5
                                                                                                                    Function 0041A678 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6A8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: ExitProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 621844428-0
                                                                                                                    • Opcode ID: 095b8a33a3bcff6e6fe8c3ca26f24508802c06a1ee5bd363ee71582a72295282
                                                                                                                    • Instruction ID: ec8a23b5c1171f3dff4e51253b0b2f4fa135bcf20b2ca7c384c2fca830db324b
                                                                                                                    • Opcode Fuzzy Hash: 095b8a33a3bcff6e6fe8c3ca26f24508802c06a1ee5bd363ee71582a72295282
                                                                                                                    • Instruction Fuzzy Hash: A1E08671510104BBC720DFB8CC8AEDB7768DF09390F118158F9196B242D532A501CBA1
                                                                                                                    Function 0041A680 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6A8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2178459966.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_400000_MSBuild.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: ExitProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 621844428-0
                                                                                                                    • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                    • Instruction ID: 026b6f0270740822b369349059f6971daea101c61a9fac8a7aff4918670f7806
                                                                                                                    • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                    • Instruction Fuzzy Hash: C1D017726112187BD620EB99CC85FD777ACDF487A4F0180AABA1C6B242C531BA11CAE1
                                                                                                                    Function 01702C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 6eb89dcf897c22b7cd4b6cb7a7127af612bcb8998379ad6e66150812ca2be422
                                                                                                                    • Instruction ID: dfc15c05df4d4070d86287a06ab2f98d55d2f4987570a5b24f5a7e673a8a476c
                                                                                                                    • Opcode Fuzzy Hash: 6eb89dcf897c22b7cd4b6cb7a7127af612bcb8998379ad6e66150812ca2be422
                                                                                                                    • Instruction Fuzzy Hash: 45B09B739455C5C6DB12E764460C717B94077D1701F15C075D2030695F8738C1D1E276

                                                                                                                    Non-executed Functions

                                                                                                                    Function 01702890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ___swprintf_l
                                                                                                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                    • API String ID: 48624451-2108815105
                                                                                                                    • Opcode ID: 955f6f1da59346620ae9d447e845d6b79abd195be36d5ff6ff33e631b4e8c4fc
                                                                                                                    • Instruction ID: 6874d62ddd5ce998ebf621626c1bd5d31f1485d1a08a5b6ff9dbb5b86028968b
                                                                                                                    • Opcode Fuzzy Hash: 955f6f1da59346620ae9d447e845d6b79abd195be36d5ff6ff33e631b4e8c4fc
                                                                                                                    • Instruction Fuzzy Hash: 0251D6B6A00216BFCB12DBAC889497EFBF8BB482407148269F595D7686D734DE4087A0
                                                                                                                    Function 01772410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ___swprintf_l
                                                                                                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                    • API String ID: 48624451-2108815105
                                                                                                                    • Opcode ID: 19bd2b6a46e5a1fddc99faef9c3577b1a06abce78152c2b75e0dc13df9d5ada0
                                                                                                                    • Instruction ID: 150b02da3da82f2b82a0dd6b01c645f2d848e7ebf7b02fe43275c02282b14c90
                                                                                                                    • Opcode Fuzzy Hash: 19bd2b6a46e5a1fddc99faef9c3577b1a06abce78152c2b75e0dc13df9d5ada0
                                                                                                                    • Instruction Fuzzy Hash: AD51C475B00645AEDF30DE5CCC9097EFBB9AB44200F1488A9F5A6D7646EA74EE408760
                                                                                                                    Function 016F7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    • ExecuteOptions, xrefs: 017346A0
                                                                                                                    • Execute=1, xrefs: 01734713
                                                                                                                    • CLIENT(ntdll): Processing section info %ws..., xrefs: 01734787
                                                                                                                    • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 017346FC
                                                                                                                    • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01734742
                                                                                                                    • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01734655
                                                                                                                    • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01734725
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                                                                                    • API String ID: 0-484625025
                                                                                                                    • Opcode ID: 2e5850394bbbab5c25150e90dbd98dee192f7c674b622cdeca6a657acafb8bce
                                                                                                                    • Instruction ID: ac56f901d319606220db6d082155a99ca93998af69881b5b11a7a97336148deb
                                                                                                                    • Opcode Fuzzy Hash: 2e5850394bbbab5c25150e90dbd98dee192f7c674b622cdeca6a657acafb8bce
                                                                                                                    • Instruction Fuzzy Hash: D1510A31600229ABEF11ABA9DC89FBDB7A8EF59301F04009DD706A72D1E7719E458F50
                                                                                                                    Function 01796940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                    • Instruction ID: c29bcbe0718652c6e5ac80aa970863b7a729cd1a9d5bf21eb33232c2b4d57f8f
                                                                                                                    • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                    • Instruction Fuzzy Hash: 0A021571508342AFDB09CF18D494A6BFBE5FFC8700F148A2DB9995B264DB31E949CB42
                                                                                                                    Function 0170B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __aulldvrm
                                                                                                                    • String ID: +$-$0$0
                                                                                                                    • API String ID: 1302938615-699404926
                                                                                                                    • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                    • Instruction ID: c5f609524d5e498246a13f15ffc72ef49d589222d33b9f8983ad9fdca10618ba
                                                                                                                    • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                    • Instruction Fuzzy Hash: E181BF78E45349CEEF2A8E6CC8907BEFBF1AF85320F18455AD861A72D1C7309B408B51
                                                                                                                    Function 017720E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ___swprintf_l
                                                                                                                    • String ID: %%%u$[$]:%u
                                                                                                                    • API String ID: 48624451-2819853543
                                                                                                                    • Opcode ID: 19e8d5b0035e121cfdaebfa8aed0d65bafa506f3881f034882b0716a4b6419be
                                                                                                                    • Instruction ID: 473af2c7c57747b052bfdb9703f5bdc90c15e39f11b6412adcbea89fb2708da8
                                                                                                                    • Opcode Fuzzy Hash: 19e8d5b0035e121cfdaebfa8aed0d65bafa506f3881f034882b0716a4b6419be
                                                                                                                    • Instruction Fuzzy Hash: 3A21B27AA00219ABDB11DF79DC44AFEFBF9FF54640F040126EA55E3245E730DA018BA0
                                                                                                                    Function 016EF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 017302E7
                                                                                                                    • RTL: Re-Waiting, xrefs: 0173031E
                                                                                                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 017302BD
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                                                                                    • API String ID: 0-2474120054
                                                                                                                    • Opcode ID: c4a59b6437c5e4f2b1c2909e73c7e556da1c0ab23fcd6b9f0f7231fb3f13a26e
                                                                                                                    • Instruction ID: a852074abdf8ffe8f14eaaebff7a0e38b7772d0f34e8c9ad57c8e443e950b85a
                                                                                                                    • Opcode Fuzzy Hash: c4a59b6437c5e4f2b1c2909e73c7e556da1c0ab23fcd6b9f0f7231fb3f13a26e
                                                                                                                    • Instruction Fuzzy Hash: 98E1BE71609741DFEB25CF28C888B2ABBE0BB84314F140AADF5A58B3D2D775D945CB42
                                                                                                                    Function 016FBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    • RTL: Resource at %p, xrefs: 01737B8E
                                                                                                                    • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01737B7F
                                                                                                                    • RTL: Re-Waiting, xrefs: 01737BAC
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                    • API String ID: 0-871070163
                                                                                                                    • Opcode ID: 8fbab266f5b8db24f684fdefdfa4d1c88ec998851670641924f570898246d96f
                                                                                                                    • Instruction ID: 819643b69559d5590baea031d3a9404e2c489cbf2cd211e265e0f87c5df52929
                                                                                                                    • Opcode Fuzzy Hash: 8fbab266f5b8db24f684fdefdfa4d1c88ec998851670641924f570898246d96f
                                                                                                                    • Instruction Fuzzy Hash: 5041E0757057029FD725CE2DCC40B6AB7E5EF89720F000A2DFA5A9B781DB31E8058B91
                                                                                                                    Function 016FB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0173728C
                                                                                                                    Strings
                                                                                                                    • RTL: Resource at %p, xrefs: 017372A3
                                                                                                                    • RTL: Re-Waiting, xrefs: 017372C1
                                                                                                                    • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01737294
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                    • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                    • API String ID: 885266447-605551621
                                                                                                                    • Opcode ID: 50bc2dd5042359406d4b78c83f01758878650ace5c014d45087f56d28e08d959
                                                                                                                    • Instruction ID: ccf52d0a4e73937e22cdafc7c1b2da4588c7973885c981dc3e3b4b4b1cc261ce
                                                                                                                    • Opcode Fuzzy Hash: 50bc2dd5042359406d4b78c83f01758878650ace5c014d45087f56d28e08d959
                                                                                                                    • Instruction Fuzzy Hash: D0410072709202ABD725CE29CC41F6AF7B5FF94710F10061DFA55AB281DB31E8428BD1
                                                                                                                    Function 01772300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ___swprintf_l
                                                                                                                    • String ID: %%%u$]:%u
                                                                                                                    • API String ID: 48624451-3050659472
                                                                                                                    • Opcode ID: 933612243e7b11f7edb8dd297be237ec9f617b8f7a411d644c0d6d571654d073
                                                                                                                    • Instruction ID: 6d22ab17c36a3d28d673b65f9dd0d7160203964a9768f16a98efe98034aa5ae0
                                                                                                                    • Opcode Fuzzy Hash: 933612243e7b11f7edb8dd297be237ec9f617b8f7a411d644c0d6d571654d073
                                                                                                                    • Instruction Fuzzy Hash: 55319372A00219AFDF20DF2DCC44BEEF7F8EF44610F55455AE959E3245EB30AA448BA0
                                                                                                                    Function 01707D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __aulldvrm
                                                                                                                    • String ID: +$-
                                                                                                                    • API String ID: 1302938615-2137968064
                                                                                                                    • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                    • Instruction ID: 92b71c898f17da89726addf7c14ccb59ba85954e1ead106bc8604a7326433081
                                                                                                                    • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                    • Instruction Fuzzy Hash: 60919071E00316DAEB2ADF6DC881ABEFBE5AF44320F54451EE995A72C4D630BD818B11
                                                                                                                    Function 016C9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: $$@
                                                                                                                    • API String ID: 0-1194432280
                                                                                                                    • Opcode ID: 72c6f29c4ad3643ef488bf497312b91d94dec1e4d7810e389c0dc1ef28023bdd
                                                                                                                    • Instruction ID: 72ad9e140748aef742ada4f952e076c689b7f664231b5fb6b5a51e03885ddd43
                                                                                                                    • Opcode Fuzzy Hash: 72c6f29c4ad3643ef488bf497312b91d94dec1e4d7810e389c0dc1ef28023bdd
                                                                                                                    • Instruction Fuzzy Hash: 59812C72D002699BDB31CB54CC45BEEBBB4AF48714F0041DAEA19B7640D7709E85CFA4
                                                                                                                    Function 0174CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 0174CFBD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 0000000F.00000002.2179949521.0000000001690000.00000040.00001000.00020000.00000000.sdmp, Offset: 01690000, based on PE: true
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_15_2_1690000_MSBuild.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CallFilterFunc@8
                                                                                                                    • String ID: @$@4Cw@4Cw
                                                                                                                    • API String ID: 4062629308-3101775584
                                                                                                                    • Opcode ID: 2d30680e4276d39b890498a3c861c3f592b67a345c7ef0a43478a9d1b18693e3
                                                                                                                    • Instruction ID: ebbda91d662845bba2eb0bcb602a43569c3b6ffec08a4b13816e5b12aac5c4d9
                                                                                                                    • Opcode Fuzzy Hash: 2d30680e4276d39b890498a3c861c3f592b67a345c7ef0a43478a9d1b18693e3
                                                                                                                    • Instruction Fuzzy Hash: 56417DB2900215DFDB22DFA9C890AADFBB8FF64B50F00412EEA45DB264D7349941CB65

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:1.5%
                                                                                                                    Dynamic/Decrypted Code Coverage:6.8%
                                                                                                                    Signature Coverage:0%
                                                                                                                    Total number of Nodes:622
                                                                                                                    Total number of Limit Nodes:77
                                                                                                                    execution_graph 113818 4f22ad0 LdrInitializeThunk 113820 2e59050 113823 2e5908b 113820->113823 113831 2e5bd10 113820->113831 113822 2e5916c 113823->113822 113834 2e4acf0 113823->113834 113827 2e590f0 Sleep 113828 2e590dd 113827->113828 113828->113822 113828->113827 113843 2e58c70 LdrLoadDll 113828->113843 113844 2e58e80 LdrLoadDll 113828->113844 113832 2e5bd3d 113831->113832 113845 2e5a510 113831->113845 113832->113823 113835 2e4ad14 113834->113835 113836 2e4ad1b 113835->113836 113837 2e4ad50 LdrLoadDll 113835->113837 113838 2e54e50 113836->113838 113837->113836 113839 2e54e6a 113838->113839 113840 2e54e5e 113838->113840 113839->113828 113840->113839 113852 2e552d0 LdrLoadDll 113840->113852 113842 2e54fbc 113842->113828 113843->113828 113844->113828 113846 2e5a52c NtAllocateVirtualMemory 113845->113846 113848 2e5af30 113845->113848 113846->113832 113849 2e5af40 113848->113849 113851 2e5af62 113848->113851 113850 2e54e50 LdrLoadDll 113849->113850 113850->113851 113851->113846 113852->113842 113853 2e5f0ed 113856 2e5b9a0 113853->113856 113857 2e5b9c6 113856->113857 113864 2e49d40 113857->113864 113859 2e5b9d2 113860 2e5b9f6 113859->113860 113872 2e48f30 113859->113872 113910 2e5a680 113860->113910 113913 2e49c90 113864->113913 113866 2e49d4d 113867 2e49d54 113866->113867 113925 2e49c30 113866->113925 113867->113859 113873 2e48f57 113872->113873 114324 2e4b1c0 113873->114324 113875 2e48f69 114328 2e4af10 113875->114328 113877 2e48f86 113885 2e48f8d 113877->113885 114399 2e4ae40 LdrLoadDll 113877->114399 113879 2e490f2 113879->113860 113881 2e48ffc 114344 2e4f410 113881->114344 113883 2e49006 113883->113879 113884 2e5bf60 2 API calls 113883->113884 113886 2e4902a 113884->113886 113885->113879 114332 2e4f380 113885->114332 113887 2e5bf60 2 API calls 113886->113887 113888 2e4903b 113887->113888 113889 2e5bf60 2 API calls 113888->113889 113890 2e4904c 113889->113890 114356 2e4ca90 113890->114356 113892 2e49059 113893 2e54a50 8 API calls 113892->113893 113894 2e49066 113893->113894 113895 2e54a50 8 API calls 113894->113895 113896 2e49077 113895->113896 113897 2e49084 113896->113897 113898 2e490a5 113896->113898 114366 2e4d620 113897->114366 113900 2e54a50 8 API calls 113898->113900 113905 2e490c1 113900->113905 113903 2e48d00 23 API calls 113903->113879 113904 2e49092 114382 2e48d00 113904->114382 113909 2e490e9 113905->113909 114400 2e4d6c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 113905->114400 113909->113903 113911 2e5af30 LdrLoadDll 113910->113911 113912 2e5a69f 113911->113912 113914 2e49ca3 113913->113914 113965 2e58b90 LdrLoadDll 113913->113965 113945 2e58a40 113914->113945 113917 2e49cb6 113917->113866 113918 2e49cac 113918->113917 113948 2e5b280 113918->113948 113920 2e49cf3 113920->113917 113959 2e49ab0 113920->113959 113922 2e49d13 113966 2e49620 LdrLoadDll 113922->113966 113924 2e49d25 113924->113866 113926 2e49c40 113925->113926 114300 2e5b570 113926->114300 113929 2e5b570 LdrLoadDll 113930 2e49c5b 113929->113930 113931 2e5b570 LdrLoadDll 113930->113931 113932 2e49c71 113931->113932 113933 2e4f180 113932->113933 113934 2e4f199 113933->113934 114304 2e4b040 113934->114304 113936 2e4f1ac 114308 2e5a1b0 113936->114308 113940 2e4f1d2 113943 2e4f1fd 113940->113943 114315 2e5a230 113940->114315 113942 2e5a460 2 API calls 113944 2e49d65 113942->113944 113943->113942 113944->113859 113967 2e5a5d0 113945->113967 113949 2e5b299 113948->113949 113970 2e54a50 113949->113970 113951 2e5b2b1 113952 2e5b2ba 113951->113952 114009 2e5b0c0 113951->114009 113952->113920 113954 2e5b2ce 113954->113952 114027 2e59ed0 113954->114027 114278 2e47ea0 113959->114278 113961 2e49ad1 113961->113922 113962 2e49aca 113962->113961 114291 2e48160 113962->114291 113965->113914 113966->113924 113968 2e5af30 LdrLoadDll 113967->113968 113969 2e58a55 113968->113969 113969->113918 113971 2e54d85 113970->113971 113981 2e54a64 113970->113981 113971->113951 113974 2e54b90 114038 2e5a330 113974->114038 113975 2e54b73 114095 2e5a430 LdrLoadDll 113975->114095 113978 2e54bb7 113980 2e5bd90 2 API calls 113978->113980 113979 2e54b7d 113979->113951 113982 2e54bc3 113980->113982 113981->113971 114035 2e59c20 113981->114035 113982->113979 113983 2e54d49 113982->113983 113984 2e54d5f 113982->113984 113989 2e54c52 113982->113989 113985 2e5a460 2 API calls 113983->113985 114104 2e54790 LdrLoadDll NtReadFile NtClose 113984->114104 113987 2e54d50 113985->113987 113987->113951 113988 2e54d72 113988->113951 113990 2e54cb9 113989->113990 113992 2e54c61 113989->113992 113990->113983 113991 2e54ccc 113990->113991 114097 2e5a2b0 113991->114097 113994 2e54c66 113992->113994 113995 2e54c7a 113992->113995 114096 2e54650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 113994->114096 113998 2e54c97 113995->113998 113999 2e54c7f 113995->113999 113998->113987 114053 2e54410 113998->114053 114041 2e546f0 113999->114041 114001 2e54c70 114001->113951 114004 2e54d2c 114101 2e5a460 114004->114101 114005 2e54c8d 114005->113951 114006 2e54caf 114006->113951 114008 2e54d38 114008->113951 114010 2e5b0d1 114009->114010 114011 2e5b0e3 114010->114011 114012 2e5bd10 2 API calls 114010->114012 114011->113954 114013 2e5b104 114012->114013 114123 2e54070 114013->114123 114015 2e5b150 114015->113954 114016 2e5b127 114016->114015 114017 2e54070 3 API calls 114016->114017 114020 2e5b149 114017->114020 114019 2e5b1da 114021 2e5b1ea 114019->114021 114249 2e5aed0 LdrLoadDll 114019->114249 114020->114015 114155 2e55390 114020->114155 114165 2e5ad40 114021->114165 114024 2e5b218 114244 2e59e90 114024->114244 114028 2e59eec 114027->114028 114029 2e5af30 LdrLoadDll 114027->114029 114272 4f22c0a 114028->114272 114029->114028 114030 2e59f07 114032 2e5bd90 114030->114032 114033 2e5b329 114032->114033 114275 2e5a640 114032->114275 114033->113920 114036 2e5af30 LdrLoadDll 114035->114036 114037 2e54b44 114036->114037 114037->113974 114037->113975 114037->113979 114039 2e5af30 LdrLoadDll 114038->114039 114040 2e5a34c NtCreateFile 114039->114040 114040->113978 114042 2e5470c 114041->114042 114043 2e5a2b0 LdrLoadDll 114042->114043 114044 2e5472d 114043->114044 114045 2e54734 114044->114045 114046 2e54748 114044->114046 114047 2e5a460 2 API calls 114045->114047 114048 2e5a460 2 API calls 114046->114048 114049 2e5473d 114047->114049 114050 2e54751 114048->114050 114049->114005 114105 2e5bfa0 LdrLoadDll RtlAllocateHeap 114050->114105 114052 2e5475c 114052->114005 114054 2e5448e 114053->114054 114055 2e5445b 114053->114055 114057 2e545d9 114054->114057 114061 2e544aa 114054->114061 114056 2e5a2b0 LdrLoadDll 114055->114056 114058 2e54476 114056->114058 114059 2e5a2b0 LdrLoadDll 114057->114059 114060 2e5a460 2 API calls 114058->114060 114065 2e545f4 114059->114065 114062 2e5447f 114060->114062 114063 2e5a2b0 LdrLoadDll 114061->114063 114062->114006 114064 2e544c5 114063->114064 114067 2e544e1 114064->114067 114068 2e544cc 114064->114068 114119 2e5a2f0 LdrLoadDll 114065->114119 114069 2e544e6 114067->114069 114070 2e544fc 114067->114070 114072 2e5a460 2 API calls 114068->114072 114074 2e5a460 2 API calls 114069->114074 114081 2e54501 114070->114081 114106 2e5bf60 114070->114106 114071 2e5462e 114075 2e5a460 2 API calls 114071->114075 114073 2e544d5 114072->114073 114073->114006 114077 2e544ef 114074->114077 114076 2e54639 114075->114076 114076->114006 114077->114006 114080 2e54567 114082 2e5457e 114080->114082 114118 2e5a270 LdrLoadDll 114080->114118 114088 2e54513 114081->114088 114110 2e5a3e0 114081->114110 114084 2e54585 114082->114084 114085 2e5459a 114082->114085 114086 2e5a460 2 API calls 114084->114086 114087 2e5a460 2 API calls 114085->114087 114086->114088 114089 2e545a3 114087->114089 114088->114006 114090 2e545cf 114089->114090 114113 2e5bb60 114089->114113 114090->114006 114092 2e545ba 114093 2e5bd90 2 API calls 114092->114093 114094 2e545c3 114093->114094 114094->114006 114095->113979 114096->114001 114098 2e5af30 LdrLoadDll 114097->114098 114099 2e54d14 114097->114099 114098->114099 114100 2e5a2f0 LdrLoadDll 114099->114100 114100->114004 114102 2e5af30 LdrLoadDll 114101->114102 114103 2e5a47c NtClose 114102->114103 114103->114008 114104->113988 114105->114052 114107 2e5bf6e 114106->114107 114120 2e5a600 114107->114120 114109 2e5bf78 114109->114081 114111 2e5af30 LdrLoadDll 114110->114111 114112 2e5a3fc NtReadFile 114111->114112 114112->114080 114114 2e5bb84 114113->114114 114115 2e5bb6d 114113->114115 114114->114092 114115->114114 114116 2e5bf60 2 API calls 114115->114116 114117 2e5bb9b 114116->114117 114117->114092 114118->114082 114119->114071 114121 2e5af30 LdrLoadDll 114120->114121 114122 2e5a61c RtlAllocateHeap 114121->114122 114122->114109 114124 2e54081 114123->114124 114125 2e54089 114123->114125 114124->114016 114154 2e5435c 114125->114154 114250 2e5cf00 114125->114250 114127 2e540dd 114128 2e5cf00 2 API calls 114127->114128 114131 2e540e8 114128->114131 114129 2e54136 114132 2e5cf00 2 API calls 114129->114132 114131->114129 114258 2e5cfa0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 114131->114258 114259 2e5d030 114131->114259 114135 2e5414a 114132->114135 114134 2e541a7 114136 2e5cf00 2 API calls 114134->114136 114135->114134 114137 2e5d030 3 API calls 114135->114137 114138 2e541bd 114136->114138 114137->114135 114139 2e541fa 114138->114139 114141 2e5d030 3 API calls 114138->114141 114140 2e5cf00 2 API calls 114139->114140 114142 2e54205 114140->114142 114141->114138 114143 2e5d030 3 API calls 114142->114143 114149 2e5423f 114142->114149 114143->114142 114146 2e5cf60 2 API calls 114147 2e5433e 114146->114147 114148 2e5cf60 2 API calls 114147->114148 114150 2e54348 114148->114150 114255 2e5cf60 114149->114255 114151 2e5cf60 2 API calls 114150->114151 114152 2e54352 114151->114152 114153 2e5cf60 2 API calls 114152->114153 114153->114154 114154->114016 114156 2e553a1 114155->114156 114157 2e54a50 8 API calls 114156->114157 114159 2e553b7 114157->114159 114158 2e5540a 114158->114019 114159->114158 114160 2e55405 114159->114160 114161 2e553f2 114159->114161 114163 2e5bd90 2 API calls 114160->114163 114162 2e5bd90 2 API calls 114161->114162 114164 2e553f7 114162->114164 114163->114158 114164->114019 114265 2e5ac00 114165->114265 114168 2e5ac00 LdrLoadDll 114169 2e5ad5d 114168->114169 114170 2e5ac00 LdrLoadDll 114169->114170 114171 2e5ad66 114170->114171 114172 2e5ac00 LdrLoadDll 114171->114172 114173 2e5ad6f 114172->114173 114174 2e5ac00 LdrLoadDll 114173->114174 114175 2e5ad78 114174->114175 114176 2e5ac00 LdrLoadDll 114175->114176 114177 2e5ad81 114176->114177 114178 2e5ac00 LdrLoadDll 114177->114178 114179 2e5ad8d 114178->114179 114180 2e5ac00 LdrLoadDll 114179->114180 114181 2e5ad96 114180->114181 114182 2e5ac00 LdrLoadDll 114181->114182 114183 2e5ad9f 114182->114183 114184 2e5ac00 LdrLoadDll 114183->114184 114185 2e5ada8 114184->114185 114186 2e5ac00 LdrLoadDll 114185->114186 114187 2e5adb1 114186->114187 114188 2e5ac00 LdrLoadDll 114187->114188 114189 2e5adba 114188->114189 114190 2e5ac00 LdrLoadDll 114189->114190 114191 2e5adc6 114190->114191 114192 2e5ac00 LdrLoadDll 114191->114192 114193 2e5adcf 114192->114193 114194 2e5ac00 LdrLoadDll 114193->114194 114195 2e5add8 114194->114195 114196 2e5ac00 LdrLoadDll 114195->114196 114197 2e5ade1 114196->114197 114198 2e5ac00 LdrLoadDll 114197->114198 114199 2e5adea 114198->114199 114200 2e5ac00 LdrLoadDll 114199->114200 114201 2e5adf3 114200->114201 114202 2e5ac00 LdrLoadDll 114201->114202 114203 2e5adff 114202->114203 114204 2e5ac00 LdrLoadDll 114203->114204 114205 2e5ae08 114204->114205 114206 2e5ac00 LdrLoadDll 114205->114206 114207 2e5ae11 114206->114207 114208 2e5ac00 LdrLoadDll 114207->114208 114209 2e5ae1a 114208->114209 114210 2e5ac00 LdrLoadDll 114209->114210 114211 2e5ae23 114210->114211 114212 2e5ac00 LdrLoadDll 114211->114212 114213 2e5ae2c 114212->114213 114214 2e5ac00 LdrLoadDll 114213->114214 114215 2e5ae38 114214->114215 114216 2e5ac00 LdrLoadDll 114215->114216 114217 2e5ae41 114216->114217 114218 2e5ac00 LdrLoadDll 114217->114218 114219 2e5ae4a 114218->114219 114220 2e5ac00 LdrLoadDll 114219->114220 114221 2e5ae53 114220->114221 114222 2e5ac00 LdrLoadDll 114221->114222 114223 2e5ae5c 114222->114223 114224 2e5ac00 LdrLoadDll 114223->114224 114225 2e5ae65 114224->114225 114226 2e5ac00 LdrLoadDll 114225->114226 114227 2e5ae71 114226->114227 114228 2e5ac00 LdrLoadDll 114227->114228 114229 2e5ae7a 114228->114229 114230 2e5ac00 LdrLoadDll 114229->114230 114231 2e5ae83 114230->114231 114232 2e5ac00 LdrLoadDll 114231->114232 114233 2e5ae8c 114232->114233 114234 2e5ac00 LdrLoadDll 114233->114234 114235 2e5ae95 114234->114235 114236 2e5ac00 LdrLoadDll 114235->114236 114237 2e5ae9e 114236->114237 114238 2e5ac00 LdrLoadDll 114237->114238 114239 2e5aeaa 114238->114239 114240 2e5ac00 LdrLoadDll 114239->114240 114241 2e5aeb3 114240->114241 114242 2e5ac00 LdrLoadDll 114241->114242 114243 2e5aebc 114242->114243 114243->114024 114245 2e5af30 LdrLoadDll 114244->114245 114246 2e59eac 114245->114246 114247 2e59ec3 114246->114247 114271 4f22df0 LdrInitializeThunk 114246->114271 114247->113954 114249->114021 114251 2e5cf16 114250->114251 114252 2e5cf10 114250->114252 114253 2e5bf60 2 API calls 114251->114253 114252->114127 114254 2e5cf3c 114253->114254 114254->114127 114256 2e5bd90 2 API calls 114255->114256 114257 2e54334 114256->114257 114257->114146 114258->114131 114260 2e5cfa0 114259->114260 114261 2e5cffd 114260->114261 114262 2e5bf60 2 API calls 114260->114262 114261->114131 114263 2e5cfda 114262->114263 114264 2e5bd90 2 API calls 114263->114264 114264->114261 114266 2e5ac1b 114265->114266 114267 2e54e50 LdrLoadDll 114266->114267 114268 2e5ac3b 114267->114268 114269 2e54e50 LdrLoadDll 114268->114269 114270 2e5ace7 114268->114270 114269->114270 114270->114168 114271->114247 114273 4f22c11 114272->114273 114274 4f22c1f LdrInitializeThunk 114272->114274 114273->114030 114274->114030 114276 2e5af30 LdrLoadDll 114275->114276 114277 2e5a65c RtlFreeHeap 114276->114277 114277->114033 114279 2e47eb0 114278->114279 114280 2e47eab 114278->114280 114281 2e5bd10 2 API calls 114279->114281 114280->113962 114287 2e47ed5 114281->114287 114282 2e47f38 114282->113962 114283 2e59e90 2 API calls 114283->114287 114284 2e47f3e 114286 2e47f64 114284->114286 114288 2e5a590 2 API calls 114284->114288 114286->113962 114287->114282 114287->114283 114287->114284 114289 2e5bd10 2 API calls 114287->114289 114294 2e5a590 114287->114294 114290 2e47f55 114288->114290 114289->114287 114290->113962 114292 2e5a590 2 API calls 114291->114292 114293 2e4817e 114292->114293 114293->113922 114295 2e5a5ac 114294->114295 114296 2e5af30 LdrLoadDll 114294->114296 114299 4f22c70 LdrInitializeThunk 114295->114299 114296->114295 114297 2e5a5c3 114297->114287 114299->114297 114301 2e5b593 114300->114301 114302 2e4acf0 LdrLoadDll 114301->114302 114303 2e49c4a 114302->114303 114303->113929 114305 2e4b063 114304->114305 114307 2e4b0e0 114305->114307 114322 2e59c60 LdrLoadDll 114305->114322 114307->113936 114309 2e5af30 LdrLoadDll 114308->114309 114310 2e4f1bb 114309->114310 114310->113944 114311 2e5a7a0 114310->114311 114312 2e5af30 LdrLoadDll 114311->114312 114313 2e5a7bf LookupPrivilegeValueW 114312->114313 114313->113940 114316 2e5a24c 114315->114316 114317 2e5af30 LdrLoadDll 114315->114317 114323 4f22ea0 LdrInitializeThunk 114316->114323 114317->114316 114318 2e5a26b 114318->113943 114319 2e5af30 LdrLoadDll 114318->114319 114320 2e5a28c 114319->114320 114320->113943 114322->114307 114323->114318 114325 2e4b1f0 114324->114325 114326 2e4b040 LdrLoadDll 114325->114326 114327 2e4b204 114326->114327 114327->113875 114329 2e4af34 114328->114329 114401 2e59c60 LdrLoadDll 114329->114401 114331 2e4af6e 114331->113877 114333 2e4f3ac 114332->114333 114334 2e4b1c0 LdrLoadDll 114333->114334 114335 2e4f3be 114334->114335 114402 2e4f290 114335->114402 114338 2e4f3f1 114341 2e4f402 114338->114341 114343 2e5a460 2 API calls 114338->114343 114339 2e4f3d9 114340 2e4f3e4 114339->114340 114342 2e5a460 2 API calls 114339->114342 114340->113881 114341->113881 114342->114340 114343->114341 114345 2e4f43c 114344->114345 114421 2e4b2b0 114345->114421 114347 2e4f44e 114348 2e4f290 3 API calls 114347->114348 114349 2e4f45f 114348->114349 114350 2e4f469 114349->114350 114353 2e4f481 114349->114353 114351 2e4f474 114350->114351 114354 2e5a460 2 API calls 114350->114354 114351->113883 114352 2e4f492 114352->113883 114353->114352 114355 2e5a460 2 API calls 114353->114355 114354->114351 114355->114352 114357 2e4caa6 114356->114357 114358 2e4cab0 114356->114358 114357->113892 114359 2e4af10 LdrLoadDll 114358->114359 114360 2e4cb4e 114359->114360 114361 2e4cb74 114360->114361 114362 2e4b040 LdrLoadDll 114360->114362 114361->113892 114363 2e4cb90 114362->114363 114364 2e54a50 8 API calls 114363->114364 114365 2e4cbe5 114364->114365 114365->113892 114367 2e4d646 114366->114367 114368 2e4b040 LdrLoadDll 114367->114368 114369 2e4d65a 114368->114369 114425 2e4d310 114369->114425 114371 2e4908b 114372 2e4cc00 114371->114372 114373 2e4cc26 114372->114373 114374 2e4b040 LdrLoadDll 114373->114374 114375 2e4cca9 114373->114375 114374->114375 114376 2e4b040 LdrLoadDll 114375->114376 114377 2e4cd16 114376->114377 114378 2e4af10 LdrLoadDll 114377->114378 114379 2e4cd7f 114378->114379 114380 2e4b040 LdrLoadDll 114379->114380 114381 2e4ce2f 114380->114381 114381->113904 114454 2e4f6d0 114382->114454 114384 2e48f25 114384->113860 114385 2e48d14 114385->114384 114459 2e543a0 114385->114459 114387 2e48d70 114387->114384 114462 2e48ab0 114387->114462 114390 2e5cf00 2 API calls 114391 2e48db2 114390->114391 114392 2e5d030 3 API calls 114391->114392 114396 2e48dc7 114392->114396 114393 2e47ea0 4 API calls 114393->114396 114396->114384 114396->114393 114397 2e4c7b0 18 API calls 114396->114397 114398 2e48160 2 API calls 114396->114398 114467 2e4f670 114396->114467 114471 2e4f080 21 API calls 114396->114471 114397->114396 114398->114396 114399->113885 114400->113909 114401->114331 114403 2e4f2aa 114402->114403 114411 2e4f360 114402->114411 114404 2e4b040 LdrLoadDll 114403->114404 114405 2e4f2cc 114404->114405 114412 2e59f10 114405->114412 114407 2e4f30e 114415 2e59f50 114407->114415 114410 2e5a460 2 API calls 114410->114411 114411->114338 114411->114339 114413 2e5af30 LdrLoadDll 114412->114413 114414 2e59f2c 114413->114414 114414->114407 114416 2e5af30 LdrLoadDll 114415->114416 114417 2e59f6c 114416->114417 114420 4f235c0 LdrInitializeThunk 114417->114420 114418 2e4f354 114418->114410 114420->114418 114422 2e4b2d7 114421->114422 114423 2e4b040 LdrLoadDll 114422->114423 114424 2e4b313 114423->114424 114424->114347 114426 2e4d327 114425->114426 114434 2e4f710 114426->114434 114430 2e4d39b 114431 2e4d3a2 114430->114431 114445 2e5a270 LdrLoadDll 114430->114445 114431->114371 114433 2e4d3b5 114433->114371 114435 2e4f735 114434->114435 114446 2e481a0 114435->114446 114437 2e4d36f 114442 2e5a6b0 114437->114442 114438 2e54a50 8 API calls 114440 2e4f759 114438->114440 114440->114437 114440->114438 114441 2e5bd90 2 API calls 114440->114441 114453 2e4f550 LdrLoadDll CreateProcessInternalW LdrInitializeThunk 114440->114453 114441->114440 114443 2e5a6cf CreateProcessInternalW 114442->114443 114444 2e5af30 LdrLoadDll 114442->114444 114443->114430 114444->114443 114445->114433 114447 2e4829f 114446->114447 114448 2e481b5 114446->114448 114447->114440 114448->114447 114449 2e54a50 8 API calls 114448->114449 114450 2e48222 114449->114450 114451 2e5bd90 2 API calls 114450->114451 114452 2e48249 114450->114452 114451->114452 114452->114440 114453->114440 114455 2e54e50 LdrLoadDll 114454->114455 114456 2e4f6ef 114455->114456 114457 2e4f6f6 SetErrorMode 114456->114457 114458 2e4f6fd 114456->114458 114457->114458 114458->114385 114472 2e4f4a0 114459->114472 114461 2e543c6 114461->114387 114463 2e5bd10 2 API calls 114462->114463 114466 2e48ad5 114462->114466 114463->114466 114464 2e48cea 114464->114390 114466->114464 114491 2e59850 114466->114491 114468 2e4f683 114467->114468 114539 2e59e60 114468->114539 114471->114396 114473 2e4f4bd 114472->114473 114479 2e59f90 114473->114479 114476 2e4f505 114476->114461 114480 2e59fac 114479->114480 114481 2e5af30 LdrLoadDll 114479->114481 114489 4f22f30 LdrInitializeThunk 114480->114489 114481->114480 114482 2e4f4fe 114482->114476 114484 2e59fe0 114482->114484 114485 2e5af30 LdrLoadDll 114484->114485 114486 2e59ffc 114485->114486 114490 4f22d10 LdrInitializeThunk 114486->114490 114487 2e4f52e 114487->114461 114489->114482 114490->114487 114492 2e5bf60 2 API calls 114491->114492 114493 2e59867 114492->114493 114512 2e49310 114493->114512 114495 2e59882 114496 2e598c0 114495->114496 114497 2e598a9 114495->114497 114499 2e5bd10 2 API calls 114496->114499 114498 2e5bd90 2 API calls 114497->114498 114500 2e598b6 114498->114500 114501 2e598fa 114499->114501 114500->114464 114502 2e5bd10 2 API calls 114501->114502 114503 2e59913 114502->114503 114509 2e59bb4 114503->114509 114518 2e5bd50 LdrLoadDll 114503->114518 114505 2e59b99 114506 2e59ba0 114505->114506 114505->114509 114507 2e5bd90 2 API calls 114506->114507 114508 2e59baa 114507->114508 114508->114464 114510 2e5bd90 2 API calls 114509->114510 114511 2e59c09 114510->114511 114511->114464 114513 2e49335 114512->114513 114514 2e4acf0 LdrLoadDll 114513->114514 114515 2e49368 114514->114515 114517 2e4938d 114515->114517 114519 2e4cf20 114515->114519 114517->114495 114518->114505 114520 2e4cf4c 114519->114520 114521 2e5a1b0 LdrLoadDll 114520->114521 114522 2e4cf65 114521->114522 114523 2e4cf6c 114522->114523 114530 2e5a1f0 114522->114530 114523->114517 114527 2e4cfa7 114528 2e5a460 2 API calls 114527->114528 114529 2e4cfca 114528->114529 114529->114517 114531 2e5a20c 114530->114531 114532 2e5af30 LdrLoadDll 114530->114532 114538 4f22ca0 LdrInitializeThunk 114531->114538 114532->114531 114533 2e4cf8f 114533->114523 114535 2e5a7e0 114533->114535 114536 2e5af30 LdrLoadDll 114535->114536 114537 2e5a7ff 114536->114537 114537->114527 114538->114533 114540 2e5af30 LdrLoadDll 114539->114540 114541 2e59e7c 114540->114541 114544 4f22dd0 LdrInitializeThunk 114541->114544 114542 2e4f6ae 114542->114396 114544->114542 114545 4cfcb84 114548 4cfa042 114545->114548 114547 4cfcba5 114550 4cfa06b 114548->114550 114549 4cfa56c 114549->114547 114550->114549 114551 4cfa182 NtQueryInformationProcess 114550->114551 114553 4cfa1ba 114551->114553 114552 4cfa1ef 114552->114547 114553->114552 114554 4cfa2db 114553->114554 114555 4cfa290 114553->114555 114556 4cfa2fc NtSuspendThread 114554->114556 114577 4cf9de2 NtCreateSection NtMapViewOfSection NtClose 114555->114577 114557 4cfa30d 114556->114557 114560 4cfa331 114556->114560 114557->114547 114559 4cfa2cf 114559->114547 114563 4cfa412 114560->114563 114568 4cf9bb2 114560->114568 114562 4cfa531 114564 4cfa552 NtResumeThread 114562->114564 114563->114562 114565 4cfa4a6 NtSetContextThread 114563->114565 114564->114549 114567 4cfa4bd 114565->114567 114566 4cfa51c NtQueueApcThread 114566->114562 114567->114562 114567->114566 114569 4cf9bf7 114568->114569 114570 4cf9c66 NtCreateSection 114569->114570 114571 4cf9d4e 114570->114571 114572 4cf9ca0 114570->114572 114571->114563 114573 4cf9cc1 NtMapViewOfSection 114572->114573 114573->114571 114574 4cf9d0c 114573->114574 114574->114571 114575 4cf9d88 114574->114575 114576 4cf9dc5 NtClose 114575->114576 114576->114563 114577->114559

                                                                                                                    Executed Functions

                                                                                                                    Function 04CFA036 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 481nativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • NtQueryInformationProcess.NTDLL ref: 04CFA19F
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560155445.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4cf0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InformationProcessQuery
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 1778838933-4108050209
                                                                                                                    • Opcode ID: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
                                                                                                                    • Instruction ID: d80ca956325ff3bba7d8b0edcaa0fb4470275bd1824a9a6f2019ec047719d445
                                                                                                                    • Opcode Fuzzy Hash: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
                                                                                                                    • Instruction Fuzzy Hash: 88F12E70918A8C8FDBA5EF68CC94AEEB7E1FB98304F40462AD54ED7250DF34A641DB41
                                                                                                                    Function 04CF9BAF Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 227nativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 207 4cf9baf-4cf9bfe call 4cf9102 210 4cf9c0c-4cf9c9a call 4cfb942 * 2 NtCreateSection 207->210 211 4cf9c00 207->211 217 4cf9d5a-4cf9d68 210->217 218 4cf9ca0-4cf9d0a call 4cfb942 NtMapViewOfSection 210->218 212 4cf9c02-4cf9c0a 211->212 212->210 212->212 221 4cf9d0c-4cf9d4c 218->221 222 4cf9d52 218->222 224 4cf9d4e-4cf9d4f 221->224 225 4cf9d69-4cf9d6b 221->225 222->217 224->222 226 4cf9d6d-4cf9d72 225->226 227 4cf9d88-4cf9ddc call 4cfcd62 NtClose 225->227 228 4cf9d74-4cf9d86 call 4cf9172 226->228 228->227
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560155445.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4cf0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Section$CloseCreateView
                                                                                                                    • String ID: @$@
                                                                                                                    • API String ID: 1133238012-149943524
                                                                                                                    • Opcode ID: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
                                                                                                                    • Instruction ID: 69199a469419571fcdbb8bebc221ba799c3ca4a37a1cf015ab8ea19341db3c61
                                                                                                                    • Opcode Fuzzy Hash: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
                                                                                                                    • Instruction Fuzzy Hash: 55619370118B088FCB58EF58D8856AABBE1FF98314F50062EE58AC3651DF35E541CB86
                                                                                                                    Function 04CF9BB2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171nativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 266 4cf9bb2-4cf9bef 267 4cf9bf7-4cf9bfe 266->267 268 4cf9bf2 call 4cf9102 266->268 269 4cf9c0c-4cf9c9a call 4cfb942 * 2 NtCreateSection 267->269 270 4cf9c00 267->270 268->267 276 4cf9d5a-4cf9d68 269->276 277 4cf9ca0-4cf9d0a call 4cfb942 NtMapViewOfSection 269->277 271 4cf9c02-4cf9c0a 270->271 271->269 271->271 280 4cf9d0c-4cf9d4c 277->280 281 4cf9d52 277->281 283 4cf9d4e-4cf9d4f 280->283 284 4cf9d69-4cf9d6b 280->284 281->276 283->281 285 4cf9d6d-4cf9d72 284->285 286 4cf9d88-4cf9ddc call 4cfcd62 NtClose 284->286 287 4cf9d74-4cf9d86 call 4cf9172 285->287 287->286
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560155445.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4cf0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Section$CreateView
                                                                                                                    • String ID: @$@
                                                                                                                    • API String ID: 1585966358-149943524
                                                                                                                    • Opcode ID: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
                                                                                                                    • Instruction ID: 2832530d1384cad0327c2092ecb5a5d151f0e9e358465fb8bb0cee8966cf0f1f
                                                                                                                    • Opcode Fuzzy Hash: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
                                                                                                                    • Instruction Fuzzy Hash: 935171B05187088FDB58DF18D8956AABBE1FF88314F50062EE58EC3651DF35E541CB86
                                                                                                                    Function 04CFA042 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • NtQueryInformationProcess.NTDLL ref: 04CFA19F
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560155445.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4cf0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InformationProcessQuery
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 1778838933-4108050209
                                                                                                                    • Opcode ID: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                                                                                    • Instruction ID: cb268865580e8131d91c6a7de95a000fbdccf0830401f1b7e2f43e54c8b3624c
                                                                                                                    • Opcode Fuzzy Hash: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                                                                                    • Instruction Fuzzy Hash: 62512B70914A8C8FDBA9EF68C8946EEB7F5FB98304F40462AD54AD7210DF34A645CB41
                                                                                                                    Function 02E5A330 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 542 2e5a330-2e5a381 call 2e5af30 NtCreateFile
                                                                                                                    APIs
                                                                                                                    • NtCreateFile.NTDLL(00000060,00000000,.z`,02E54BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,02E54BB7,007A002E,00000000,00000060,00000000,00000000), ref: 02E5A37D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateFile
                                                                                                                    • String ID: .z`
                                                                                                                    • API String ID: 823142352-1441809116
                                                                                                                    • Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                                                                                    • Instruction ID: ea5fda1b586e3d089f46e80813c551783d80f8b1669a0d1ee8df30ba11dbd9fb
                                                                                                                    • Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                                                                                    • Instruction Fuzzy Hash: FBF0BDB2211208ABCB08CF89DC84EEB77ADAF8C754F158248BA0D97240C630E8118BA4
                                                                                                                    Function 02E5A3E0 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • NtReadFile.NTDLL(02E54D72,5EB65239,FFFFFFFF,02E54A31,?,?,02E54D72,?,02E54A31,FFFFFFFF,5EB65239,02E54D72,?,00000000), ref: 02E5A425
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FileRead
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2738559852-0
                                                                                                                    • Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                                                                                    • Instruction ID: 8a3dc977432e3aac76c1c0ec58852bca17aaa33df26b298048fd2c3c37f510d6
                                                                                                                    • Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                                                                                    • Instruction Fuzzy Hash: E7F0B7B2210208AFCB14DF89DC80EEB77ADEF8C754F158259BE1D97241D630E811CBA0
                                                                                                                    Function 02E5A3DD Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • NtReadFile.NTDLL(02E54D72,5EB65239,FFFFFFFF,02E54A31,?,?,02E54D72,?,02E54A31,FFFFFFFF,5EB65239,02E54D72,?,00000000), ref: 02E5A425
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FileRead
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2738559852-0
                                                                                                                    • Opcode ID: a224246e0399fbad29a278f0e2d9c2779ae9543c9c7cc2a80d4121a5026a6bf2
                                                                                                                    • Instruction ID: cad69f1fd8823aa8b38a77c93a3762e01a3f6ba967424b77be1813476d50a294
                                                                                                                    • Opcode Fuzzy Hash: a224246e0399fbad29a278f0e2d9c2779ae9543c9c7cc2a80d4121a5026a6bf2
                                                                                                                    • Instruction Fuzzy Hash: E5F0F4B2210108ABCB08DF89CC80EEB77A9EF8C314F118249BE1DA7241C630E811CBA0
                                                                                                                    Function 04F22CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: e1c960474bcabf933361a8db627fbc3cfef92ba1d80a551f732b0756e67154a9
                                                                                                                    • Instruction ID: dbc6f628f158223df1c89d1bd413b83c2cb56b578e4f0fc97897a1a9e709376b
                                                                                                                    • Opcode Fuzzy Hash: e1c960474bcabf933361a8db627fbc3cfef92ba1d80a551f732b0756e67154a9
                                                                                                                    • Instruction Fuzzy Hash: BE90023124140412F5007598940864610558BE0346F55D011B5029555EC669D9927132
                                                                                                                    Function 04F22C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 92cea595b1c51b9e82fe3a3a4b61ad18098c59e234003eb844049a7737fcd6d3
                                                                                                                    • Instruction ID: c8b7bf0e7c328ecd1fe6e5023faa64b7382da20852b38d109cefaca686f7bb21
                                                                                                                    • Opcode Fuzzy Hash: 92cea595b1c51b9e82fe3a3a4b61ad18098c59e234003eb844049a7737fcd6d3
                                                                                                                    • Instruction Fuzzy Hash: AE90023124148812F5107158C40474A10558BD0346F59C411B4429658D8699D9927122
                                                                                                                    Function 04F22C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 109df8a375671e1c65b91e967a6d0f6b127dcd869fccabcc9dc10d99be5c5104
                                                                                                                    • Instruction ID: e00a7207b9f0fd2f638f920a5e949342cbe0767718ad48c2875bb2e57445d1c9
                                                                                                                    • Opcode Fuzzy Hash: 109df8a375671e1c65b91e967a6d0f6b127dcd869fccabcc9dc10d99be5c5104
                                                                                                                    • Instruction Fuzzy Hash: 8C90023124140852F50071588404B4610558BE0346F55C016B0129654D8619D9527522
                                                                                                                    Function 04F22DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 990378ebb730e3d2854793507301c7ae7fb1661702c05983f33d70d7da3c1531
                                                                                                                    • Instruction ID: 78eceaa28f98471798399215fc7ee2f69d53c9f55b0231cef37e35459ad700e5
                                                                                                                    • Opcode Fuzzy Hash: 990378ebb730e3d2854793507301c7ae7fb1661702c05983f33d70d7da3c1531
                                                                                                                    • Instruction Fuzzy Hash: 0590023124140423F5117158850470710598BD0286F95C412B0429558D965ADA53B122
                                                                                                                    Function 04F22DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: fa10fc85c2df4bcf4e7a3a9a023cd626ced43ebaad95270ab28dd73158a50d6e
                                                                                                                    • Instruction ID: e9c6126373a4d92aa9c036ea2405d6800bbacb90a2ac2dfe3f3a2909b2cb686c
                                                                                                                    • Opcode Fuzzy Hash: fa10fc85c2df4bcf4e7a3a9a023cd626ced43ebaad95270ab28dd73158a50d6e
                                                                                                                    • Instruction Fuzzy Hash: 6B900221282441627945B158840450750569BE0286795C012B1419950C852AE957E622
                                                                                                                    Function 04F22D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 16a8dda8411d7261c987763573daab97e3ae8e86d79af5a2f1edc8b3928e6f34
                                                                                                                    • Instruction ID: abbf120e3040f6ef1dfcb09fcc7b5e557165e0a6c5a6b2519f02f5d44be1d3cf
                                                                                                                    • Opcode Fuzzy Hash: 16a8dda8411d7261c987763573daab97e3ae8e86d79af5a2f1edc8b3928e6f34
                                                                                                                    • Instruction Fuzzy Hash: 1590022925340012F5807158940860A10558BD1247F95D415B001A558CC919D96A6322
                                                                                                                    Function 04F22EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ab098a42d9d3b56d3762e0107583793388efea36bb6e450a0fa88527e2dd0ac5
                                                                                                                    • Instruction ID: cd9d56584022a0d2e2929f5a6b772c37b47f6056273f34cd884eebe05db75d4e
                                                                                                                    • Opcode Fuzzy Hash: ab098a42d9d3b56d3762e0107583793388efea36bb6e450a0fa88527e2dd0ac5
                                                                                                                    • Instruction Fuzzy Hash: FD90027124140412F5407158840474610558BD0346F55C011B5069554E865DDED67666
                                                                                                                    Function 04F22FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 231fb5d00f99b54626af036fcb81e4de8ccc25a4c398531eeee04a6536f1a1dd
                                                                                                                    • Instruction ID: c68336dfe4599f7b43153e6dba2ac36779c67bd072d66d0b47fa4525b1d91be3
                                                                                                                    • Opcode Fuzzy Hash: 231fb5d00f99b54626af036fcb81e4de8ccc25a4c398531eeee04a6536f1a1dd
                                                                                                                    • Instruction Fuzzy Hash: 2F900221251C0052F60075688C14B0710558BD0347F55C115B0159554CC919D9626522
                                                                                                                    Function 04F22F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: 2b2be09aa16edc1bd3de0a9832d1867fc118b2e59611456261aab0a5f47343d1
                                                                                                                    • Instruction ID: 4d738063b8f77accb03fc89dbb7f5137f3ce1e51fd816d212ada32ebdc577107
                                                                                                                    • Opcode Fuzzy Hash: 2b2be09aa16edc1bd3de0a9832d1867fc118b2e59611456261aab0a5f47343d1
                                                                                                                    • Instruction Fuzzy Hash: BD90026138140452F50071588414B061055CBE1346F55C015F1069554D861DDD537127
                                                                                                                    Function 04F22AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: e1e499ca112d3428e815cbb10886d333b3a9a14dec3810b60c5caeacb481cc3e
                                                                                                                    • Instruction ID: f8d8891bebc153ffa3ec5631067582671a7d1a376ed259ca903e06792b5d44bf
                                                                                                                    • Opcode Fuzzy Hash: e1e499ca112d3428e815cbb10886d333b3a9a14dec3810b60c5caeacb481cc3e
                                                                                                                    • Instruction Fuzzy Hash: 09900225251400132505B558470450710968BD5396355C021F101A550CD625D9626122
                                                                                                                    Function 04F22BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: f4d161a2df758ae851ffd6f0b3be0c3b528754ed08d1a781647aed8318ef5762
                                                                                                                    • Instruction ID: 66adf5dca583a732d9a65b5228f4384820be47abbc707ee33ad32158a2216806
                                                                                                                    • Opcode Fuzzy Hash: f4d161a2df758ae851ffd6f0b3be0c3b528754ed08d1a781647aed8318ef5762
                                                                                                                    • Instruction Fuzzy Hash: 8390023124140812F5807158840464A10558BD1346F95C015B002A654DCA19DB5A77A2
                                                                                                                    Function 04F22BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: f734e18e0a294a5d21a20f7e16e8b92c89f09b1c29d9106d73fee700588b34d5
                                                                                                                    • Instruction ID: c73eea2dab8a006b3eb689ae08242be40353172941a3b9b7b52fd50581aa7c62
                                                                                                                    • Opcode Fuzzy Hash: f734e18e0a294a5d21a20f7e16e8b92c89f09b1c29d9106d73fee700588b34d5
                                                                                                                    • Instruction Fuzzy Hash: 5290023124544852F54071588404A4610658BD034AF55C011B0069694D9629DE56B662
                                                                                                                    Function 04F22B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ef8117a8b481012c13aba33e9fc43f7adf731ab4b95fcdd86727ad53733b4b05
                                                                                                                    • Instruction ID: 37adfbe3f8771f40399c538b53c3a7ef6d7755d507c06779ec50dca4e8a6aba6
                                                                                                                    • Opcode Fuzzy Hash: ef8117a8b481012c13aba33e9fc43f7adf731ab4b95fcdd86727ad53733b4b05
                                                                                                                    • Instruction Fuzzy Hash: EA90026124240013650571588414616505A8BE0246B55C021F1019590DC529D9927126
                                                                                                                    Function 04F235C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: ee38b9740af4c686206092a0bda2a53c25ab409ab2202ace0fa6affee76c4825
                                                                                                                    • Instruction ID: 3df367d8a53baf5fc8824674e2d5768585ff07479f821c611df22f53449f122e
                                                                                                                    • Opcode Fuzzy Hash: ee38b9740af4c686206092a0bda2a53c25ab409ab2202ace0fa6affee76c4825
                                                                                                                    • Instruction Fuzzy Hash: D990023164550412F5007158851470620558BD0246F65C411B0429568D8799DA5275A3
                                                                                                                    Function 02E59050 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 399 2e59050-2e5907f 400 2e5908b-2e59092 399->400 401 2e59086 call 2e5bd10 399->401 402 2e5916c-2e59172 400->402 403 2e59098-2e590e8 call 2e5bde0 call 2e4acf0 call 2e54e50 400->403 401->400 410 2e590f0-2e59101 Sleep 403->410 411 2e59166-2e5916a 410->411 412 2e59103-2e59109 410->412 411->402 411->410 413 2e59133-2e59153 412->413 414 2e5910b-2e59131 call 2e58c70 412->414 415 2e59159-2e5915c 413->415 416 2e59154 call 2e58e80 413->416 414->415 415->411 416->415
                                                                                                                    APIs
                                                                                                                    • Sleep.KERNELBASE(000007D0), ref: 02E590F8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: Sleep
                                                                                                                    • String ID: net.dll$wininet.dll
                                                                                                                    • API String ID: 3472027048-1269752229
                                                                                                                    • Opcode ID: 07fb741d0de705a7bee4e1f72086dc2eacc46a567c641b428c38a657a8f17114
                                                                                                                    • Instruction ID: b1cc1d82423eea47a9b358c04969b96f0c6789f4861509b0e42b9a3fe64911cd
                                                                                                                    • Opcode Fuzzy Hash: 07fb741d0de705a7bee4e1f72086dc2eacc46a567c641b428c38a657a8f17114
                                                                                                                    • Instruction Fuzzy Hash: 1D3170B2540754ABC724DF64C885FABB7B9EB48B04F10C51DFA2A9B245DB30A650CBA4
                                                                                                                    Function 02E59046 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 83sleepCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 419 2e59046-2e59092 call 2e5bd10 422 2e5916c-2e59172 419->422 423 2e59098-2e590e8 call 2e5bde0 call 2e4acf0 call 2e54e50 419->423 430 2e590f0-2e59101 Sleep 423->430 431 2e59166-2e5916a 430->431 432 2e59103-2e59109 430->432 431->422 431->430 433 2e59133-2e59153 432->433 434 2e5910b-2e59131 call 2e58c70 432->434 435 2e59159-2e5915c 433->435 436 2e59154 call 2e58e80 433->436 434->435 435->431 436->435
                                                                                                                    APIs
                                                                                                                    • Sleep.KERNELBASE(000007D0), ref: 02E590F8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: Sleep
                                                                                                                    • String ID: net.dll$wininet.dll
                                                                                                                    • API String ID: 3472027048-1269752229
                                                                                                                    • Opcode ID: 5113bc41125a1a5837c43e88f4ba38f501976ba5b2f5d07f2690e48e17d044da
                                                                                                                    • Instruction ID: 6a8490705ef1913a48bc2b817763d092bfb436f6a15649ab3f9eb717e2324879
                                                                                                                    • Opcode Fuzzy Hash: 5113bc41125a1a5837c43e88f4ba38f501976ba5b2f5d07f2690e48e17d044da
                                                                                                                    • Instruction Fuzzy Hash: 3421E6B1580250ABC724DF68CC85BA7BBB4FB48704F10C11DFA295B246D770A550CFE5
                                                                                                                    Function 02E5A632 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31memoryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 545 2e5a632-2e5a656 546 2e5a65c-2e5a671 RtlFreeHeap 545->546 547 2e5a657 call 2e5af30 545->547 547->546
                                                                                                                    APIs
                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02E43AF8), ref: 02E5A66D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FreeHeap
                                                                                                                    • String ID: .z`
                                                                                                                    • API String ID: 3298025750-1441809116
                                                                                                                    • Opcode ID: e1bc9c8ea46bd1c4a48b20246eff63545e4208ddee84185bf788ab582bf352c5
                                                                                                                    • Instruction ID: 3513142b26854ef10a496b4988934f78f8aaa623fbba020d6741c41c2844b678
                                                                                                                    • Opcode Fuzzy Hash: e1bc9c8ea46bd1c4a48b20246eff63545e4208ddee84185bf788ab582bf352c5
                                                                                                                    • Instruction Fuzzy Hash: 82E06DB62142046BCB14DFB9CC48EA77BACAF89750F018259F94C5B255C131E914CAB0
                                                                                                                    Function 02E5A640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 548 2e5a640-2e5a671 call 2e5af30 RtlFreeHeap
                                                                                                                    APIs
                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02E43AF8), ref: 02E5A66D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: FreeHeap
                                                                                                                    • String ID: .z`
                                                                                                                    • API String ID: 3298025750-1441809116
                                                                                                                    • Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                                                                                    • Instruction ID: bf74bad01d5d51ee512c8e567fb4ecca5d82a9af15411366db01fa17c70bd71b
                                                                                                                    • Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                                                                                    • Instruction Fuzzy Hash: 47E04FB12102146BDB14DF59CC44EA777ADEF88750F018555FD0857341C630F910CAF0
                                                                                                                    Function 02E48309 Relevance: 3.1, APIs: 2, Instructions: 56threadwindowCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02E4836A
                                                                                                                    • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02E4838B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePostThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1836367815-0
                                                                                                                    • Opcode ID: ce1467f263ab9eb7afed26fbdad85e8423216cc79405db0c39d3edb70e5e23d1
                                                                                                                    • Instruction ID: f56cee57f1c4948548b34dd67db42c2a81f298fe1db2e0189df5ab2c0d9e5823
                                                                                                                    • Opcode Fuzzy Hash: ce1467f263ab9eb7afed26fbdad85e8423216cc79405db0c39d3edb70e5e23d1
                                                                                                                    • Instruction Fuzzy Hash: 82018831AD132877EB21AA949C02FFE776D5B41F54F148119FF04BA1C0EAA46A0647E5
                                                                                                                    Function 02E48310 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 566 2e48310-2e4831f 567 2e48328-2e4835a call 2e5c9d0 call 2e4acf0 call 2e54e50 566->567 568 2e48323 call 2e5be30 566->568 575 2e4835c-2e4836e PostThreadMessageW 567->575 576 2e4838e-2e48392 567->576 568->567 577 2e48370-2e4838b call 2e4a480 PostThreadMessageW 575->577 578 2e4838d 575->578 577->578 578->576
                                                                                                                    APIs
                                                                                                                    • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02E4836A
                                                                                                                    • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02E4838B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePostThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1836367815-0
                                                                                                                    • Opcode ID: 11db2db6729fad1b2fe29d12422f9571aab132b5507ffda246947416a0e543a6
                                                                                                                    • Instruction ID: 479fda1f1ed5008a532f3291a202fe869cec5a6b93ad5fb0c4e21f68e47984cc
                                                                                                                    • Opcode Fuzzy Hash: 11db2db6729fad1b2fe29d12422f9571aab132b5507ffda246947416a0e543a6
                                                                                                                    • Instruction Fuzzy Hash: 9E01A731ED022877E721AA949C02FFE776D5B40F54F048119FF04BA1C1EA94790546F5
                                                                                                                    Function 02E5A6AD Relevance: 1.5, APIs: 1, Instructions: 43processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 02E5A704
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateInternalProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2186235152-0
                                                                                                                    • Opcode ID: f8bb1373f04a202a702c49e87df1bc79baa7d8cc049af3e0bf0b135264cde46b
                                                                                                                    • Instruction ID: 8d591e0f47d35187dd7ae817140a106633b954fc9274d0ffaa4b77ba024dc914
                                                                                                                    • Opcode Fuzzy Hash: f8bb1373f04a202a702c49e87df1bc79baa7d8cc049af3e0bf0b135264cde46b
                                                                                                                    • Instruction Fuzzy Hash: 1301B6B2214108BFCB54DF89DC80EEB37ADAF8C754F158258FA0D97245C630E851CBA0
                                                                                                                    Function 02E5A6B0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 02E5A704
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateInternalProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2186235152-0
                                                                                                                    • Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                                                                                    • Instruction ID: 3d721354acb1e782628d914113d1a88483e1eea729c771941e950b4cdbede414
                                                                                                                    • Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                                                                                    • Instruction Fuzzy Hash: 5B01B2B2210108BFCB54DF89DC80EEB77ADAF8C754F158258FA0D97240C630E851CBA4
                                                                                                                    Function 02E59180 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,02E4F050,?,?,00000000), ref: 02E591BC
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2422867632-0
                                                                                                                    • Opcode ID: f6a1478ee43e0a36ff2a3fc66a0d3c9d2aa5fd5cf4bdfca84ef241fbfec6805c
                                                                                                                    • Instruction ID: a358289c185795f4d445bfd0ab1f1e5f2cfc40e7ba37d91b678d62b04be19c74
                                                                                                                    • Opcode Fuzzy Hash: f6a1478ee43e0a36ff2a3fc66a0d3c9d2aa5fd5cf4bdfca84ef241fbfec6805c
                                                                                                                    • Instruction Fuzzy Hash: 7AE06D773902243AE3206599AC02FE7B29C8B81B24F554026FA0DEA2C1D995F40146E4
                                                                                                                    Function 02E59176 Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,02E4F050,?,?,00000000), ref: 02E591BC
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2422867632-0
                                                                                                                    • Opcode ID: 61e286dc3fc6dfd0221d112ef2d4ab8b76374ee9ec85905d7d7e65fb0c23c22d
                                                                                                                    • Instruction ID: ae10c40f8470f78779529442b8c483cc986747360b14daba7e74d986953148c0
                                                                                                                    • Opcode Fuzzy Hash: 61e286dc3fc6dfd0221d112ef2d4ab8b76374ee9ec85905d7d7e65fb0c23c22d
                                                                                                                    • Instruction Fuzzy Hash: FAE022B73902207AE33169589C02FE7A28C8B81B14F25402AFA4DAB2C0C9A1F80106A8
                                                                                                                    Function 02E5A600 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • RtlAllocateHeap.NTDLL(02E54536,?,02E54CAF,02E54CAF,?,02E54536,?,?,?,?,?,00000000,00000000,?), ref: 02E5A62D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateHeap
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1279760036-0
                                                                                                                    • Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                                                                                    • Instruction ID: 7ce16cc6abdcc36b23a6d5af4721d1bc2a8902bddb5dbc556d866b87f8094947
                                                                                                                    • Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                                                                                    • Instruction Fuzzy Hash: 8AE012B2220218ABDB14EF99CC40EA777ADAF88654F118559BE085B241C630F9118AB0
                                                                                                                    Function 02E4F6D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetErrorMode.KERNELBASE(00008003,?,02E48D14,?), ref: 02E4F6FB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4558936526.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E40000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_2e40000_cscript.jbxd
                                                                                                                    Yara matches
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorMode
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2340568224-0
                                                                                                                    • Opcode ID: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
                                                                                                                    • Instruction ID: 54ef4b89ede57b32917c97d1aeafa8e94e346c7a41607fbc17399b705e504318
                                                                                                                    • Opcode Fuzzy Hash: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
                                                                                                                    • Instruction Fuzzy Hash: 16D05E616903082AE610AEA49C02F6632895B44A04F494064F9499A2C3DD50E0004565
                                                                                                                    Function 04F22C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000010.00000002.4560393908.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: true
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.0000000004FDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    • Associated: 00000010.00000002.4560393908.000000000504E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_16_2_4eb0000_cscript.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InitializeThunk
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2994545307-0
                                                                                                                    • Opcode ID: fe25500e672104c4f89e79771619c0e9c4bda62e87f173512adda3749ea3d75c
                                                                                                                    • Instruction ID: 0cda67ad9e575be01e2142da2b9ac42da4765ce99700f9a20a1a290358b90879
                                                                                                                    • Opcode Fuzzy Hash: fe25500e672104c4f89e79771619c0e9c4bda62e87f173512adda3749ea3d75c
                                                                                                                    • Instruction Fuzzy Hash: E5B09B71D415D5D5FF11F760470871779506BD0755F16C061E2034641E473CD1D2F176