Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
906982022050120220531MES_S Quote.exe

Overview

General Information

Sample name:906982022050120220531MES_S Quote.exe
Analysis ID:1519323
MD5:97517a596568472e97648096551266ce
SHA1:b59e636deb429abd8213ca4edc14c44106ca8fab
SHA256:b991841036289e1775750f4e841f0b2af835779fd1b9bcd2ccdfd8b579727bbf
Tags:exeFormbookuser-cocaman
Infos:

Detection

FormBook
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 906982022050120220531MES_S Quote.exe (PID: 6640 cmdline: "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe" MD5: 97517A596568472E97648096551266CE)
    • powershell.exe (PID: 4432 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2c060:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x1430f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2f7e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x17a92:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      Process Memory Space: 906982022050120220531MES_S Quote.exe PID: 6640JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        5.2.906982022050120220531MES_S Quote.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          5.2.906982022050120220531MES_S Quote.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e9e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16c92:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f7e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17a92:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", ParentImage: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe, ParentProcessId: 6640, ParentProcessName: 906982022050120220531MES_S Quote.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", ProcessId: 4432, ProcessName: powershell.exe
            Sigma detected: Powershell Defender Exclusion
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", ParentImage: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe, ParentProcessId: 6640, ParentProcessName: 906982022050120220531MES_S Quote.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", ProcessId: 4432, ProcessName: powershell.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", ParentImage: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe, ParentProcessId: 6640, ParentProcessName: 906982022050120220531MES_S Quote.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe", ProcessId: 4432, ProcessName: powershell.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: 906982022050120220531MES_S Quote.exeReversingLabs: Detection: 34%
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: 906982022050120220531MES_S Quote.exeJoe Sandbox ML: detected
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: jjmV.pdb source: 906982022050120220531MES_S Quote.exe
            Source: Binary string: wntdll.pdbUGP source: 906982022050120220531MES_S Quote.exe, 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: jjmV.pdbSHA256 source: 906982022050120220531MES_S Quote.exe
            Source: Binary string: wntdll.pdb source: 906982022050120220531MES_S Quote.exe, 906982022050120220531MES_S Quote.exe, 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp
            Source: 906982022050120220531MES_S Quote.exe, 00000000.00000002.2040724555.0000000003047000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0042CAF3 NtClose,5_2_0042CAF3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2B60 NtClose,LdrInitializeThunk,5_2_00FA2B60
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_00FA2C70
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_00FA2DF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA35C0 NtCreateMutant,LdrInitializeThunk,5_2_00FA35C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA4340 NtSetContextThread,5_2_00FA4340
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA4650 NtSuspendThread,5_2_00FA4650
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2AF0 NtWriteFile,5_2_00FA2AF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2AD0 NtReadFile,5_2_00FA2AD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2AB0 NtWaitForSingleObject,5_2_00FA2AB0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2BF0 NtAllocateVirtualMemory,5_2_00FA2BF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2BE0 NtQueryValueKey,5_2_00FA2BE0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2BA0 NtEnumerateValueKey,5_2_00FA2BA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2B80 NtQueryInformationFile,5_2_00FA2B80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2CF0 NtOpenProcess,5_2_00FA2CF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2CC0 NtQueryVirtualMemory,5_2_00FA2CC0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2CA0 NtQueryInformationToken,5_2_00FA2CA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2C60 NtCreateKey,5_2_00FA2C60
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2C00 NtQueryInformationProcess,5_2_00FA2C00
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2DD0 NtDelayExecution,5_2_00FA2DD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2DB0 NtEnumerateKey,5_2_00FA2DB0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2D30 NtUnmapViewOfSection,5_2_00FA2D30
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2D10 NtMapViewOfSection,5_2_00FA2D10
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2D00 NtSetInformationFile,5_2_00FA2D00
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2EE0 NtQueueApcThread,5_2_00FA2EE0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2EA0 NtAdjustPrivilegesToken,5_2_00FA2EA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2E80 NtReadVirtualMemory,5_2_00FA2E80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2E30 NtWriteVirtualMemory,5_2_00FA2E30
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2FE0 NtCreateFile,5_2_00FA2FE0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2FB0 NtResumeThread,5_2_00FA2FB0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2FA0 NtQuerySection,5_2_00FA2FA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2F90 NtProtectVirtualMemory,5_2_00FA2F90
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2F60 NtCreateProcessEx,5_2_00FA2F60
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2F30 NtCreateSection,5_2_00FA2F30
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA3090 NtSetValueKey,5_2_00FA3090
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA3010 NtOpenDirectoryObject,5_2_00FA3010
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA39B0 NtGetContextThread,5_2_00FA39B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA3D70 NtOpenThread,5_2_00FA3D70
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA3D10 NtOpenProcessToken,5_2_00FA3D10
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_02DADE4C0_2_02DADE4C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_054C73680_2_054C7368
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_054C00400_2_054C0040
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_054C00060_2_054C0006
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_054C73580_2_054C7358
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_0AE807380_2_0AE80738
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 0_2_0AE833B00_2_0AE833B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004028005_2_00402800
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004010C05_2_004010C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0042F0D35_2_0042F0D3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004012105_2_00401210
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004034F55_2_004034F5
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004104A35_2_004104A3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004035005_2_00403500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004025D45_2_004025D4
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004025DC5_2_004025DC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004025E05_2_004025E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00416E035_2_00416E03
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004106C35_2_004106C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0040E7435_2_0040E743
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00402FCF5_2_00402FCF
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00402FD05_2_00402FD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004027F35_2_004027F3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100A1185_2_0100A118
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010241A25_2_010241A2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010301AA5_2_010301AA
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010281CC5_2_010281CC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010020005_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF81585_2_00FF8158
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F601005_2_00F60100
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF02C05_2_00FF02C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102A3525_2_0102A352
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010303E65_2_010303E6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E3F05_2_00F7E3F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010102745_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010305915_2_01030591
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010144205_2_01014420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010224465_2_01022446
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F705355_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101E4F65_2_0101E4F6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8C6E05_2_00F8C6E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6C7C05_2_00F6C7C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F707705_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F947505_2_00F94750
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E8F05_2_00F9E8F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F568B85_2_00F568B8
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0103A9A65_2_0103A9A6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F728405_2_00F72840
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7A8405_2_00F7A840
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A05_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F869625_2_00F86962
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102AB405_2_0102AB40
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA805_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01026BD75_2_01026BD7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60CF25_2_00F60CF2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100CD1F5_2_0100CD1F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70C005_2_00F70C00
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6ADE05_2_00F6ADE0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F88DBF5_2_00F88DBF
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010CB55_2_01010CB5
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7AD005_2_00F7AD00
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01012F305_2_01012F30
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82E905_2_00F82E90
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70E595_2_00F70E59
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7CFE05_2_00F7CFE0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102EE265_2_0102EE26
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F62FC85_2_00F62FC8
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEEFA05_2_00FEEFA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102CE935_2_0102CE93
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE4F405_2_00FE4F40
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F90F305_2_00F90F30
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB2F285_2_00FB2F28
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102EEDB5_2_0102EEDB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F770C05_2_00F770C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0103B16B5_2_0103B16B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7B1B05_2_00F7B1B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5F1725_2_00F5F172
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA516C5_2_00FA516C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101F0CC5_2_0101F0CC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102F0E05_2_0102F0E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010270E95_2_010270E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102132D5_2_0102132D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8B2C05_2_00F8B2C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F752A05_2_00F752A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB739A5_2_00FB739A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5D34C5_2_00F5D34C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010112ED5_2_010112ED
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010275715_2_01027571
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F614605_2_00F61460
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100D5B05_2_0100D5B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010395C35_2_010395C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102F43F5_2_0102F43F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102F7B05_2_0102F7B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB56305_2_00FB5630
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010216CC5_2_010216CC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010059105_2_01005910
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F738E05_2_00F738E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDD8005_2_00FDD800
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F799505_2_00F79950
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8B9505_2_00F8B950
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB5AA05_2_00FB5AA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102FB765_2_0102FB76
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE3A6C5_2_00FE3A6C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FADBF95_2_00FADBF9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE5BF05_2_00FE5BF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01027A465_2_01027A46
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102FA495_2_0102FA49
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8FB805_2_00F8FB80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01011AA35_2_01011AA3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100DAAC5_2_0100DAAC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101DAC65_2_0101DAC6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01021D5A5_2_01021D5A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01027D735_2_01027D73
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE9C325_2_00FE9C32
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8FDC05_2_00F8FDC0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F73D405_2_00F73D40
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102FCF25_2_0102FCF2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102FF095_2_0102FF09
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F79EB05_2_00F79EB0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102FFB15_2_0102FFB1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F33FD25_2_00F33FD2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F33FD55_2_00F33FD5
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F71F925_2_00F71F92
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: String function: 00FB7E54 appears 111 times
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: String function: 00F5B970 appears 280 times
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: String function: 00FA5130 appears 58 times
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: String function: 00FEF290 appears 105 times
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: String function: 00FDEA12 appears 86 times
            Source: 906982022050120220531MES_S Quote.exe, 00000000.00000000.2028049130.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamejjmV.exeD vs 906982022050120220531MES_S Quote.exe
            Source: 906982022050120220531MES_S Quote.exe, 00000000.00000002.2039584831.000000000107E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 906982022050120220531MES_S Quote.exe
            Source: 906982022050120220531MES_S Quote.exe, 00000000.00000002.2065983439.0000000007510000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs 906982022050120220531MES_S Quote.exe
            Source: 906982022050120220531MES_S Quote.exe, 00000005.00000002.2300193411.000000000105D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 906982022050120220531MES_S Quote.exe
            Source: 906982022050120220531MES_S Quote.exeBinary or memory string: OriginalFilenamejjmV.exeD vs 906982022050120220531MES_S Quote.exe
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, bXaHtglU9GelNmTyIN.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, bXaHtglU9GelNmTyIN.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, kNx15R37GKnWQBMmYJ.csSecurity API names: _0020.SetAccessControl
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, kNx15R37GKnWQBMmYJ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, kNx15R37GKnWQBMmYJ.csSecurity API names: _0020.AddAccessRule
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, bXaHtglU9GelNmTyIN.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, bXaHtglU9GelNmTyIN.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, kNx15R37GKnWQBMmYJ.csSecurity API names: _0020.SetAccessControl
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, kNx15R37GKnWQBMmYJ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, kNx15R37GKnWQBMmYJ.csSecurity API names: _0020.AddAccessRule
            Source: classification engineClassification label: mal96.troj.evad.winEXE@6/6@0/0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\906982022050120220531MES_S Quote.exe.logJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6256:120:WilError_03
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4cowmdch.xfy.ps1Jump to behavior
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 906982022050120220531MES_S Quote.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: 906982022050120220531MES_S Quote.exeReversingLabs: Detection: 34%
            Source: unknownProcess created: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: jjmV.pdb source: 906982022050120220531MES_S Quote.exe
            Source: Binary string: wntdll.pdbUGP source: 906982022050120220531MES_S Quote.exe, 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: jjmV.pdbSHA256 source: 906982022050120220531MES_S Quote.exe
            Source: Binary string: wntdll.pdb source: 906982022050120220531MES_S Quote.exe, 906982022050120220531MES_S Quote.exe, 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            .NET source code contains potential unpacker
            Source: 906982022050120220531MES_S Quote.exe, Form1.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, kNx15R37GKnWQBMmYJ.cs.Net Code: uKEscrOKZ9 System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.307d9b4.1.raw.unpack, JK.cs.Net Code: ve System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.7ea0000.6.raw.unpack, JK.cs.Net Code: ve System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.307439c.0.raw.unpack, JK.cs.Net Code: ve System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.302e94c.3.raw.unpack, JK.cs.Net Code: ve System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, kNx15R37GKnWQBMmYJ.cs.Net Code: uKEscrOKZ9 System.Reflection.Assembly.Load(byte[])
            Source: 0.2.906982022050120220531MES_S Quote.exe.3025334.2.raw.unpack, JK.cs.Net Code: ve System.Reflection.Assembly.Load(byte[])
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: 0xBC60C711 [Mon Feb 24 09:17:05 2070 UTC]
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_004150A8 push ss; iretd 5_2_004150B9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00414143 push ebp; iretd 5_2_00414189
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00406377 push es; ret 5_2_00406381
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0041FBDB push ebp; ret 5_2_0041FBDC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00411D04 pushad ; retf 5_2_00411D2D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00403780 push eax; ret 5_2_00403782
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F3225F pushad ; ret 5_2_00F327F9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F327FA pushad ; ret 5_2_00F327F9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F3283D push eax; iretd 5_2_00F32858
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F609AD push ecx; mov dword ptr [esp], ecx5_2_00F609B6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F31366 push eax; iretd 5_2_00F31369
            Source: 906982022050120220531MES_S Quote.exeStatic PE information: section name: .text entropy: 7.877466323422058
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, Ij4aIEYEmF4AIQUJCH.csHigh entropy of concatenated method names: 'ToString', 'eRixoLZAJa', 'lZEx7uMG1X', 'ab7xwLFxa1', 'j9txRyyjQV', 'C1NxddgY1h', 'telxHLidns', 'CQnxXG9Kfm', 'KBXx50ywMH', 'WsIxCCecpt'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, KraSQDSR60meKs1GWc.csHigh entropy of concatenated method names: 'fhwKThp4C1', 'dfBK77TDJ6', 'VtCKwQUQfE', 'JgBKR27X9v', 'dsTKOIi1pW', 'NpgKdi8dZg', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, CLcbWcb9mZDK3d8A9K.csHigh entropy of concatenated method names: 'Tv7mAHUNoh', 'fZ5maFhKQS', 'ynxfwoEDFW', 'im3fRIRblb', 'x8xfd32qFv', 'K9tfHgIyju', 'GyTfXnrO2l', 'V6xf5xWZ0R', 'LgYfCCWNP4', 'vqkfUtZuM8'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, xFFYTkJhlLtsvdmgp3.csHigh entropy of concatenated method names: 'Dispose', 'tubPSdASYE', 'AZS07CRikD', 'Jtlhh1PVkB', 'zgQPqS4Gdl', 'jEqPzuoXks', 'ProcessDialogKey', 'gcH0IraSQD', 'I600PmeKs1', 'PWc008dyDv'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, kNx15R37GKnWQBMmYJ.csHigh entropy of concatenated method names: 'lg9t6JZlks', 'v1rtZO2Dva', 'P1itJGEjB0', 'OmRtfAE4DF', 'TrUtm4XVqf', 'pkft4l9fV7', 'C5FtpaN4tb', 'BPSt3FKAYZ', 'OBstEY9rpf', 'lCvtDQktll'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, KJIAiYPtf1ba0qVwldP.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TSXgOBHO4I', 'L2ZgNUq5Ij', 'Py5gY6fcYJ', 'cHvgF4lJXR', 'BN4gMUWFwC', 'xgbgkvqqQZ', 'NPCgBn5cLs'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, bXaHtglU9GelNmTyIN.csHigh entropy of concatenated method names: 'kdsJOcqSyH', 'XGgJNOnZ9p', 'sWFJYx81We', 'IwSJFhCPkx', 'y7NJMnq7gW', 'rICJke8q7h', 'RlPJB5lYxd', 'tf5JnNlBx6', 'Qn1JSMd5KI', 'a6eJq5vyoU'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, qdyDvRqZZlZjspRefR.csHigh entropy of concatenated method names: 'twPyPkX4eJ', 'QcVytoZTyP', 'KuAys9Ty0N', 'v2FyZ2dLJ5', 'ooZyJavicj', 'dZGymo0DJl', 'tHty4spBks', 'NtiKBr0Z19', 'yeQKngcPVl', 'bOEKSd7qHq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, IaBq5ZOtAYED4sI0HK.csHigh entropy of concatenated method names: 'T7nhUKbQ2u', 'EHdhGDSV0J', 'g2PhO2agSx', 'BhKhN1XlHI', 'qolh7QjQf5', 'ALWhw1iXjA', 'rCThR1XCKZ', 'VSlhdM6B75', 'h9lhHBg5oD', 'PTohXotyen'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, UDA7BRXA9rqXRh4oXl.csHigh entropy of concatenated method names: 'u7upZU8EmC', 'bEhpf1Bw2u', 'ETKp4Rw42N', 'JkT4qVxBLK', 'SF64zJ9PyG', 'YlfpIqLpeo', 'NcOpPSCm7j', 'QWDp0ceayZ', 'OKSptPeqsI', 'cUQpsOpt2A'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, HLDjHrWof68a51id4R.csHigh entropy of concatenated method names: 'DNIvl2BaCK', 'rvqv14xjid', 'kjKvTy1ENO', 'YHKv7m1nlQ', 'acjvRCHtGV', 'aB2vdPhgpb', 'pPEvXgx9Qh', 'GJFv5eCBeb', 'osbvUqMcbb', 'NQjvo1W4T4'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, LFE5PYk8druYBAT3rf.csHigh entropy of concatenated method names: 'KLU8ngXGjr', 'b3N8qZ1Zmq', 'eIZKIsFdFD', 'vqGKPWIC1F', 'LtA8oKlCYF', 'Iyw8GBUXkC', 'IHk8WPo9xm', 'T5H8OZLpmu', 'kk48NfY7Q2', 'fgW8YGSrdF'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, UsGg1fCNjTiN2pYhrS.csHigh entropy of concatenated method names: 'H3hp9GpW8t', 'lAApL5LspS', 'WwZpcoC3lk', 'llMpra5tEX', 'avmpAkdJDv', 'pIQputPBDY', 'gOopa5fnNN', 'k8qplUrXHc', 'BxWp1qxVLT', 'Wkwpbfi7vi'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, zU10lsTfLuy2B41iOG.csHigh entropy of concatenated method names: 'zUC46bSYHa', 'Xxw4JVPXIe', 'FbD4mhMpbG', 'P9U4p0BVI5', 'EjS43o5cHQ', 'kpymMiyxB0', 'xpwmkcNuwR', 'Ps7mBtIphn', 'sKfmnKvLHq', 'rxXmSTWjhq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, K9cFSe0WTUoLHYOFmO.csHigh entropy of concatenated method names: 'FF3cW8Dbf', 'h0jrD0Ymi', 'tdeuV7xNx', 'aBWaJDZrj', 'ucS1ly3Sh', 'MxIbXR6J0', 'A8gOYIcP8hxpU53Igg', 'd7gEhYv6r2iljhKMIh', 'hPV07F2Si5CtfVmXb6', 'OAIKsxe9n'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, gXOJuezNLUvPMepUd1.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NBPyvDf6V9', 'Rp7yhWSiAp', 'Uhfyx5ZQKE', 'oEvy8ZG5Us', 'dXdyKCtHRl', 'u36yyxdoOH', 'xcAyg14XsS'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, tQS4GdnlpEquoXksfc.csHigh entropy of concatenated method names: 'MDHKZwAgJ3', 'xhRKJdkUVR', 'vJFKf5RFTr', 'PsFKmddTvc', 'DSaK4EcuQY', 'WUEKpZYkwl', 'tuuK3a6nsA', 'MLyKEeNYkx', 'Tj6KD1dW9B', 'VsbKe7kV7w'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, kXFPqtPIXBI7o1ErNZv.csHigh entropy of concatenated method names: 'EPMy91AYtK', 'RhvyL20TfQ', 'gZbycocStx', 'J2HyrNAT8l', 'LW1yAWVYWJ', 'fRIyu6bLgZ', 'wlLyaiVdMc', 'Towyl8SXTh', 'CdBy1YA6lB', 'NvOybVvXv4'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, F5UdfJsd9dngsvYPVi.csHigh entropy of concatenated method names: 'lR0PpXaHtg', 'N9GP3elNmT', 'm1ZPDPGYaO', 'etFPegaLcb', 'J8APh9KcU1', 'blsPxfLuy2', 'fuIWqRX597yXrassy1', 'wY57Tsd9BWXDQV1s2K', 'VtkPPNFclE', 'nkEPt40uV5'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7510000.5.raw.unpack, sROX9D11ZPGYaOstFg.csHigh entropy of concatenated method names: 'FDxfryaleB', 'D02fuhd2iV', 'DHlfleqhUF', 'Btlf1mtJks', 'WqZfhYC4qR', 'dAufx24siB', 'srUf8oAWvv', 'kxmfKmhob8', 'EDxfymaHN6', 'p0JfgbhMIL'
            Source: 0.2.906982022050120220531MES_S Quote.exe.307d9b4.1.raw.unpack, JK.csHigh entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.7ea0000.6.raw.unpack, JK.csHigh entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.307439c.0.raw.unpack, JK.csHigh entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.302e94c.3.raw.unpack, JK.csHigh entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, Ij4aIEYEmF4AIQUJCH.csHigh entropy of concatenated method names: 'ToString', 'eRixoLZAJa', 'lZEx7uMG1X', 'ab7xwLFxa1', 'j9txRyyjQV', 'C1NxddgY1h', 'telxHLidns', 'CQnxXG9Kfm', 'KBXx50ywMH', 'WsIxCCecpt'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, KraSQDSR60meKs1GWc.csHigh entropy of concatenated method names: 'fhwKThp4C1', 'dfBK77TDJ6', 'VtCKwQUQfE', 'JgBKR27X9v', 'dsTKOIi1pW', 'NpgKdi8dZg', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, CLcbWcb9mZDK3d8A9K.csHigh entropy of concatenated method names: 'Tv7mAHUNoh', 'fZ5maFhKQS', 'ynxfwoEDFW', 'im3fRIRblb', 'x8xfd32qFv', 'K9tfHgIyju', 'GyTfXnrO2l', 'V6xf5xWZ0R', 'LgYfCCWNP4', 'vqkfUtZuM8'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, xFFYTkJhlLtsvdmgp3.csHigh entropy of concatenated method names: 'Dispose', 'tubPSdASYE', 'AZS07CRikD', 'Jtlhh1PVkB', 'zgQPqS4Gdl', 'jEqPzuoXks', 'ProcessDialogKey', 'gcH0IraSQD', 'I600PmeKs1', 'PWc008dyDv'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, kNx15R37GKnWQBMmYJ.csHigh entropy of concatenated method names: 'lg9t6JZlks', 'v1rtZO2Dva', 'P1itJGEjB0', 'OmRtfAE4DF', 'TrUtm4XVqf', 'pkft4l9fV7', 'C5FtpaN4tb', 'BPSt3FKAYZ', 'OBstEY9rpf', 'lCvtDQktll'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, KJIAiYPtf1ba0qVwldP.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TSXgOBHO4I', 'L2ZgNUq5Ij', 'Py5gY6fcYJ', 'cHvgF4lJXR', 'BN4gMUWFwC', 'xgbgkvqqQZ', 'NPCgBn5cLs'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, bXaHtglU9GelNmTyIN.csHigh entropy of concatenated method names: 'kdsJOcqSyH', 'XGgJNOnZ9p', 'sWFJYx81We', 'IwSJFhCPkx', 'y7NJMnq7gW', 'rICJke8q7h', 'RlPJB5lYxd', 'tf5JnNlBx6', 'Qn1JSMd5KI', 'a6eJq5vyoU'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, qdyDvRqZZlZjspRefR.csHigh entropy of concatenated method names: 'twPyPkX4eJ', 'QcVytoZTyP', 'KuAys9Ty0N', 'v2FyZ2dLJ5', 'ooZyJavicj', 'dZGymo0DJl', 'tHty4spBks', 'NtiKBr0Z19', 'yeQKngcPVl', 'bOEKSd7qHq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, IaBq5ZOtAYED4sI0HK.csHigh entropy of concatenated method names: 'T7nhUKbQ2u', 'EHdhGDSV0J', 'g2PhO2agSx', 'BhKhN1XlHI', 'qolh7QjQf5', 'ALWhw1iXjA', 'rCThR1XCKZ', 'VSlhdM6B75', 'h9lhHBg5oD', 'PTohXotyen'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, UDA7BRXA9rqXRh4oXl.csHigh entropy of concatenated method names: 'u7upZU8EmC', 'bEhpf1Bw2u', 'ETKp4Rw42N', 'JkT4qVxBLK', 'SF64zJ9PyG', 'YlfpIqLpeo', 'NcOpPSCm7j', 'QWDp0ceayZ', 'OKSptPeqsI', 'cUQpsOpt2A'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, HLDjHrWof68a51id4R.csHigh entropy of concatenated method names: 'DNIvl2BaCK', 'rvqv14xjid', 'kjKvTy1ENO', 'YHKv7m1nlQ', 'acjvRCHtGV', 'aB2vdPhgpb', 'pPEvXgx9Qh', 'GJFv5eCBeb', 'osbvUqMcbb', 'NQjvo1W4T4'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, LFE5PYk8druYBAT3rf.csHigh entropy of concatenated method names: 'KLU8ngXGjr', 'b3N8qZ1Zmq', 'eIZKIsFdFD', 'vqGKPWIC1F', 'LtA8oKlCYF', 'Iyw8GBUXkC', 'IHk8WPo9xm', 'T5H8OZLpmu', 'kk48NfY7Q2', 'fgW8YGSrdF'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, UsGg1fCNjTiN2pYhrS.csHigh entropy of concatenated method names: 'H3hp9GpW8t', 'lAApL5LspS', 'WwZpcoC3lk', 'llMpra5tEX', 'avmpAkdJDv', 'pIQputPBDY', 'gOopa5fnNN', 'k8qplUrXHc', 'BxWp1qxVLT', 'Wkwpbfi7vi'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, zU10lsTfLuy2B41iOG.csHigh entropy of concatenated method names: 'zUC46bSYHa', 'Xxw4JVPXIe', 'FbD4mhMpbG', 'P9U4p0BVI5', 'EjS43o5cHQ', 'kpymMiyxB0', 'xpwmkcNuwR', 'Ps7mBtIphn', 'sKfmnKvLHq', 'rxXmSTWjhq'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, K9cFSe0WTUoLHYOFmO.csHigh entropy of concatenated method names: 'FF3cW8Dbf', 'h0jrD0Ymi', 'tdeuV7xNx', 'aBWaJDZrj', 'ucS1ly3Sh', 'MxIbXR6J0', 'A8gOYIcP8hxpU53Igg', 'd7gEhYv6r2iljhKMIh', 'hPV07F2Si5CtfVmXb6', 'OAIKsxe9n'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, gXOJuezNLUvPMepUd1.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NBPyvDf6V9', 'Rp7yhWSiAp', 'Uhfyx5ZQKE', 'oEvy8ZG5Us', 'dXdyKCtHRl', 'u36yyxdoOH', 'xcAyg14XsS'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, tQS4GdnlpEquoXksfc.csHigh entropy of concatenated method names: 'MDHKZwAgJ3', 'xhRKJdkUVR', 'vJFKf5RFTr', 'PsFKmddTvc', 'DSaK4EcuQY', 'WUEKpZYkwl', 'tuuK3a6nsA', 'MLyKEeNYkx', 'Tj6KD1dW9B', 'VsbKe7kV7w'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, kXFPqtPIXBI7o1ErNZv.csHigh entropy of concatenated method names: 'EPMy91AYtK', 'RhvyL20TfQ', 'gZbycocStx', 'J2HyrNAT8l', 'LW1yAWVYWJ', 'fRIyu6bLgZ', 'wlLyaiVdMc', 'Towyl8SXTh', 'CdBy1YA6lB', 'NvOybVvXv4'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, F5UdfJsd9dngsvYPVi.csHigh entropy of concatenated method names: 'lR0PpXaHtg', 'N9GP3elNmT', 'm1ZPDPGYaO', 'etFPegaLcb', 'J8APh9KcU1', 'blsPxfLuy2', 'fuIWqRX597yXrassy1', 'wY57Tsd9BWXDQV1s2K', 'VtkPPNFclE', 'nkEPt40uV5'
            Source: 0.2.906982022050120220531MES_S Quote.exe.42b9e30.4.raw.unpack, sROX9D11ZPGYaOstFg.csHigh entropy of concatenated method names: 'FDxfryaleB', 'D02fuhd2iV', 'DHlfleqhUF', 'Btlf1mtJks', 'WqZfhYC4qR', 'dAufx24siB', 'srUf8oAWvv', 'kxmfKmhob8', 'EDxfymaHN6', 'p0JfgbhMIL'
            Source: 0.2.906982022050120220531MES_S Quote.exe.3025334.2.raw.unpack, JK.csHigh entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: 906982022050120220531MES_S Quote.exe PID: 6640, type: MEMORYSTR
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: 1590000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: 2FF0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: 2DF0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: 8100000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: 9100000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: 92C0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: A2C0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA096E rdtsc 5_2_00FA096E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5165Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1859Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeAPI coverage: 0.6 %
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe TID: 6600Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7296Thread sleep time: -2767011611056431s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7276Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe TID: 4836Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: 906982022050120220531MES_S Quote.exe, 00000000.00000002.2039584831.00000000010B3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
            Source: 906982022050120220531MES_S Quote.exe, 00000000.00000002.2039584831.00000000010B3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\@
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA096E rdtsc 5_2_00FA096E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00417DB3 LdrLoadDll,5_2_00417DB3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5C0F0 mov eax, dword ptr fs:[00000030h]5_2_00F5C0F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA20F0 mov ecx, dword ptr fs:[00000030h]5_2_00FA20F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov eax, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov ecx, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov eax, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov eax, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov ecx, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov eax, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov eax, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov ecx, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov eax, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E10E mov ecx, dword ptr fs:[00000030h]5_2_0100E10E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5A0E3 mov ecx, dword ptr fs:[00000030h]5_2_00F5A0E3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01020115 mov eax, dword ptr fs:[00000030h]5_2_01020115
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100A118 mov ecx, dword ptr fs:[00000030h]5_2_0100A118
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100A118 mov eax, dword ptr fs:[00000030h]5_2_0100A118
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100A118 mov eax, dword ptr fs:[00000030h]5_2_0100A118
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100A118 mov eax, dword ptr fs:[00000030h]5_2_0100A118
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE60E0 mov eax, dword ptr fs:[00000030h]5_2_00FE60E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F680E9 mov eax, dword ptr fs:[00000030h]5_2_00F680E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE20DE mov eax, dword ptr fs:[00000030h]5_2_00FE20DE
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F580A0 mov eax, dword ptr fs:[00000030h]5_2_00F580A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF80A8 mov eax, dword ptr fs:[00000030h]5_2_00FF80A8
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034164 mov eax, dword ptr fs:[00000030h]5_2_01034164
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034164 mov eax, dword ptr fs:[00000030h]5_2_01034164
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6208A mov eax, dword ptr fs:[00000030h]5_2_00F6208A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01004180 mov eax, dword ptr fs:[00000030h]5_2_01004180
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01004180 mov eax, dword ptr fs:[00000030h]5_2_01004180
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101C188 mov eax, dword ptr fs:[00000030h]5_2_0101C188
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101C188 mov eax, dword ptr fs:[00000030h]5_2_0101C188
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8C073 mov eax, dword ptr fs:[00000030h]5_2_00F8C073
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F62050 mov eax, dword ptr fs:[00000030h]5_2_00F62050
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6050 mov eax, dword ptr fs:[00000030h]5_2_00FE6050
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010261C3 mov eax, dword ptr fs:[00000030h]5_2_010261C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010261C3 mov eax, dword ptr fs:[00000030h]5_2_010261C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF6030 mov eax, dword ptr fs:[00000030h]5_2_00FF6030
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5A020 mov eax, dword ptr fs:[00000030h]5_2_00F5A020
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5C020 mov eax, dword ptr fs:[00000030h]5_2_00F5C020
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E016 mov eax, dword ptr fs:[00000030h]5_2_00F7E016
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E016 mov eax, dword ptr fs:[00000030h]5_2_00F7E016
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E016 mov eax, dword ptr fs:[00000030h]5_2_00F7E016
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E016 mov eax, dword ptr fs:[00000030h]5_2_00F7E016
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010361E5 mov eax, dword ptr fs:[00000030h]5_2_010361E5
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE4000 mov ecx, dword ptr fs:[00000030h]5_2_00FE4000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01002000 mov eax, dword ptr fs:[00000030h]5_2_01002000
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F901F8 mov eax, dword ptr fs:[00000030h]5_2_00F901F8
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE1D0 mov eax, dword ptr fs:[00000030h]5_2_00FDE1D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE1D0 mov eax, dword ptr fs:[00000030h]5_2_00FDE1D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE1D0 mov ecx, dword ptr fs:[00000030h]5_2_00FDE1D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE1D0 mov eax, dword ptr fs:[00000030h]5_2_00FDE1D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE1D0 mov eax, dword ptr fs:[00000030h]5_2_00FDE1D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE019F mov eax, dword ptr fs:[00000030h]5_2_00FE019F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE019F mov eax, dword ptr fs:[00000030h]5_2_00FE019F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE019F mov eax, dword ptr fs:[00000030h]5_2_00FE019F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE019F mov eax, dword ptr fs:[00000030h]5_2_00FE019F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5A197 mov eax, dword ptr fs:[00000030h]5_2_00F5A197
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5A197 mov eax, dword ptr fs:[00000030h]5_2_00F5A197
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5A197 mov eax, dword ptr fs:[00000030h]5_2_00F5A197
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA0185 mov eax, dword ptr fs:[00000030h]5_2_00FA0185
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66154 mov eax, dword ptr fs:[00000030h]5_2_00F66154
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66154 mov eax, dword ptr fs:[00000030h]5_2_00F66154
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5C156 mov eax, dword ptr fs:[00000030h]5_2_00F5C156
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF8158 mov eax, dword ptr fs:[00000030h]5_2_00FF8158
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010260B8 mov eax, dword ptr fs:[00000030h]5_2_010260B8
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010260B8 mov ecx, dword ptr fs:[00000030h]5_2_010260B8
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF4144 mov eax, dword ptr fs:[00000030h]5_2_00FF4144
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF4144 mov eax, dword ptr fs:[00000030h]5_2_00FF4144
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF4144 mov ecx, dword ptr fs:[00000030h]5_2_00FF4144
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF4144 mov eax, dword ptr fs:[00000030h]5_2_00FF4144
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF4144 mov eax, dword ptr fs:[00000030h]5_2_00FF4144
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F90124 mov eax, dword ptr fs:[00000030h]5_2_00F90124
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F702E1 mov eax, dword ptr fs:[00000030h]5_2_00F702E1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F702E1 mov eax, dword ptr fs:[00000030h]5_2_00F702E1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F702E1 mov eax, dword ptr fs:[00000030h]5_2_00F702E1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01038324 mov eax, dword ptr fs:[00000030h]5_2_01038324
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01038324 mov ecx, dword ptr fs:[00000030h]5_2_01038324
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01038324 mov eax, dword ptr fs:[00000030h]5_2_01038324
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01038324 mov eax, dword ptr fs:[00000030h]5_2_01038324
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A2C3 mov eax, dword ptr fs:[00000030h]5_2_00F6A2C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A2C3 mov eax, dword ptr fs:[00000030h]5_2_00F6A2C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A2C3 mov eax, dword ptr fs:[00000030h]5_2_00F6A2C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A2C3 mov eax, dword ptr fs:[00000030h]5_2_00F6A2C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A2C3 mov eax, dword ptr fs:[00000030h]5_2_00F6A2C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0103634F mov eax, dword ptr fs:[00000030h]5_2_0103634F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102A352 mov eax, dword ptr fs:[00000030h]5_2_0102A352
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01008350 mov ecx, dword ptr fs:[00000030h]5_2_01008350
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F702A0 mov eax, dword ptr fs:[00000030h]5_2_00F702A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F702A0 mov eax, dword ptr fs:[00000030h]5_2_00F702A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF62A0 mov eax, dword ptr fs:[00000030h]5_2_00FF62A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF62A0 mov ecx, dword ptr fs:[00000030h]5_2_00FF62A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF62A0 mov eax, dword ptr fs:[00000030h]5_2_00FF62A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF62A0 mov eax, dword ptr fs:[00000030h]5_2_00FF62A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF62A0 mov eax, dword ptr fs:[00000030h]5_2_00FF62A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF62A0 mov eax, dword ptr fs:[00000030h]5_2_00FF62A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100437C mov eax, dword ptr fs:[00000030h]5_2_0100437C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE0283 mov eax, dword ptr fs:[00000030h]5_2_00FE0283
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE0283 mov eax, dword ptr fs:[00000030h]5_2_00FE0283
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE0283 mov eax, dword ptr fs:[00000030h]5_2_00FE0283
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E284 mov eax, dword ptr fs:[00000030h]5_2_00F9E284
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E284 mov eax, dword ptr fs:[00000030h]5_2_00F9E284
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64260 mov eax, dword ptr fs:[00000030h]5_2_00F64260
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64260 mov eax, dword ptr fs:[00000030h]5_2_00F64260
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64260 mov eax, dword ptr fs:[00000030h]5_2_00F64260
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5826B mov eax, dword ptr fs:[00000030h]5_2_00F5826B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5A250 mov eax, dword ptr fs:[00000030h]5_2_00F5A250
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66259 mov eax, dword ptr fs:[00000030h]5_2_00F66259
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE8243 mov eax, dword ptr fs:[00000030h]5_2_00FE8243
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE8243 mov ecx, dword ptr fs:[00000030h]5_2_00FE8243
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101C3CD mov eax, dword ptr fs:[00000030h]5_2_0101C3CD
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5823B mov eax, dword ptr fs:[00000030h]5_2_00F5823B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010043D4 mov eax, dword ptr fs:[00000030h]5_2_010043D4
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010043D4 mov eax, dword ptr fs:[00000030h]5_2_010043D4
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E3DB mov eax, dword ptr fs:[00000030h]5_2_0100E3DB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E3DB mov eax, dword ptr fs:[00000030h]5_2_0100E3DB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E3DB mov ecx, dword ptr fs:[00000030h]5_2_0100E3DB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100E3DB mov eax, dword ptr fs:[00000030h]5_2_0100E3DB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F963FF mov eax, dword ptr fs:[00000030h]5_2_00F963FF
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E3F0 mov eax, dword ptr fs:[00000030h]5_2_00F7E3F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E3F0 mov eax, dword ptr fs:[00000030h]5_2_00F7E3F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E3F0 mov eax, dword ptr fs:[00000030h]5_2_00F7E3F0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F703E9 mov eax, dword ptr fs:[00000030h]5_2_00F703E9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F683C0 mov eax, dword ptr fs:[00000030h]5_2_00F683C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F683C0 mov eax, dword ptr fs:[00000030h]5_2_00F683C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F683C0 mov eax, dword ptr fs:[00000030h]5_2_00F683C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F683C0 mov eax, dword ptr fs:[00000030h]5_2_00F683C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A3C0 mov eax, dword ptr fs:[00000030h]5_2_00F6A3C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A3C0 mov eax, dword ptr fs:[00000030h]5_2_00F6A3C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A3C0 mov eax, dword ptr fs:[00000030h]5_2_00F6A3C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A3C0 mov eax, dword ptr fs:[00000030h]5_2_00F6A3C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A3C0 mov eax, dword ptr fs:[00000030h]5_2_00F6A3C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A3C0 mov eax, dword ptr fs:[00000030h]5_2_00F6A3C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE63C0 mov eax, dword ptr fs:[00000030h]5_2_00FE63C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101A250 mov eax, dword ptr fs:[00000030h]5_2_0101A250
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101A250 mov eax, dword ptr fs:[00000030h]5_2_0101A250
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0103625D mov eax, dword ptr fs:[00000030h]5_2_0103625D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F58397 mov eax, dword ptr fs:[00000030h]5_2_00F58397
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F58397 mov eax, dword ptr fs:[00000030h]5_2_00F58397
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F58397 mov eax, dword ptr fs:[00000030h]5_2_00F58397
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01010274 mov eax, dword ptr fs:[00000030h]5_2_01010274
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8438F mov eax, dword ptr fs:[00000030h]5_2_00F8438F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8438F mov eax, dword ptr fs:[00000030h]5_2_00F8438F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5E388 mov eax, dword ptr fs:[00000030h]5_2_00F5E388
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5E388 mov eax, dword ptr fs:[00000030h]5_2_00F5E388
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5E388 mov eax, dword ptr fs:[00000030h]5_2_00F5E388
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE035C mov eax, dword ptr fs:[00000030h]5_2_00FE035C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE035C mov eax, dword ptr fs:[00000030h]5_2_00FE035C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE035C mov eax, dword ptr fs:[00000030h]5_2_00FE035C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE035C mov ecx, dword ptr fs:[00000030h]5_2_00FE035C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE035C mov eax, dword ptr fs:[00000030h]5_2_00FE035C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE035C mov eax, dword ptr fs:[00000030h]5_2_00FE035C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE2349 mov eax, dword ptr fs:[00000030h]5_2_00FE2349
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010362D6 mov eax, dword ptr fs:[00000030h]5_2_010362D6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5C310 mov ecx, dword ptr fs:[00000030h]5_2_00F5C310
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F80310 mov ecx, dword ptr fs:[00000030h]5_2_00F80310
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A30B mov eax, dword ptr fs:[00000030h]5_2_00F9A30B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A30B mov eax, dword ptr fs:[00000030h]5_2_00F9A30B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A30B mov eax, dword ptr fs:[00000030h]5_2_00F9A30B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034500 mov eax, dword ptr fs:[00000030h]5_2_01034500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F604E5 mov ecx, dword ptr fs:[00000030h]5_2_00F604E5
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F944B0 mov ecx, dword ptr fs:[00000030h]5_2_00F944B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEA4B0 mov eax, dword ptr fs:[00000030h]5_2_00FEA4B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F664AB mov eax, dword ptr fs:[00000030h]5_2_00F664AB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8A470 mov eax, dword ptr fs:[00000030h]5_2_00F8A470
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8A470 mov eax, dword ptr fs:[00000030h]5_2_00F8A470
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8A470 mov eax, dword ptr fs:[00000030h]5_2_00F8A470
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEC460 mov ecx, dword ptr fs:[00000030h]5_2_00FEC460
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8245A mov eax, dword ptr fs:[00000030h]5_2_00F8245A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5645D mov eax, dword ptr fs:[00000030h]5_2_00F5645D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E443 mov eax, dword ptr fs:[00000030h]5_2_00F9E443
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A430 mov eax, dword ptr fs:[00000030h]5_2_00F9A430
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5C427 mov eax, dword ptr fs:[00000030h]5_2_00F5C427
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5E420 mov eax, dword ptr fs:[00000030h]5_2_00F5E420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5E420 mov eax, dword ptr fs:[00000030h]5_2_00F5E420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5E420 mov eax, dword ptr fs:[00000030h]5_2_00F5E420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE6420 mov eax, dword ptr fs:[00000030h]5_2_00FE6420
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F98402 mov eax, dword ptr fs:[00000030h]5_2_00F98402
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F98402 mov eax, dword ptr fs:[00000030h]5_2_00F98402
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F98402 mov eax, dword ptr fs:[00000030h]5_2_00F98402
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C5ED mov eax, dword ptr fs:[00000030h]5_2_00F9C5ED
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C5ED mov eax, dword ptr fs:[00000030h]5_2_00F9C5ED
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F625E0 mov eax, dword ptr fs:[00000030h]5_2_00F625E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E5E7 mov eax, dword ptr fs:[00000030h]5_2_00F8E5E7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F665D0 mov eax, dword ptr fs:[00000030h]5_2_00F665D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A5D0 mov eax, dword ptr fs:[00000030h]5_2_00F9A5D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A5D0 mov eax, dword ptr fs:[00000030h]5_2_00F9A5D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E5CF mov eax, dword ptr fs:[00000030h]5_2_00F9E5CF
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E5CF mov eax, dword ptr fs:[00000030h]5_2_00F9E5CF
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F845B1 mov eax, dword ptr fs:[00000030h]5_2_00F845B1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F845B1 mov eax, dword ptr fs:[00000030h]5_2_00F845B1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101A456 mov eax, dword ptr fs:[00000030h]5_2_0101A456
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE05A7 mov eax, dword ptr fs:[00000030h]5_2_00FE05A7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE05A7 mov eax, dword ptr fs:[00000030h]5_2_00FE05A7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE05A7 mov eax, dword ptr fs:[00000030h]5_2_00FE05A7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9E59C mov eax, dword ptr fs:[00000030h]5_2_00F9E59C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F94588 mov eax, dword ptr fs:[00000030h]5_2_00F94588
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F62582 mov eax, dword ptr fs:[00000030h]5_2_00F62582
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F62582 mov ecx, dword ptr fs:[00000030h]5_2_00F62582
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9656A mov eax, dword ptr fs:[00000030h]5_2_00F9656A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9656A mov eax, dword ptr fs:[00000030h]5_2_00F9656A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9656A mov eax, dword ptr fs:[00000030h]5_2_00F9656A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0101A49A mov eax, dword ptr fs:[00000030h]5_2_0101A49A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68550 mov eax, dword ptr fs:[00000030h]5_2_00F68550
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68550 mov eax, dword ptr fs:[00000030h]5_2_00F68550
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70535 mov eax, dword ptr fs:[00000030h]5_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70535 mov eax, dword ptr fs:[00000030h]5_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70535 mov eax, dword ptr fs:[00000030h]5_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70535 mov eax, dword ptr fs:[00000030h]5_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70535 mov eax, dword ptr fs:[00000030h]5_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70535 mov eax, dword ptr fs:[00000030h]5_2_00F70535
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E53E mov eax, dword ptr fs:[00000030h]5_2_00F8E53E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E53E mov eax, dword ptr fs:[00000030h]5_2_00F8E53E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E53E mov eax, dword ptr fs:[00000030h]5_2_00F8E53E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E53E mov eax, dword ptr fs:[00000030h]5_2_00F8E53E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E53E mov eax, dword ptr fs:[00000030h]5_2_00F8E53E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF6500 mov eax, dword ptr fs:[00000030h]5_2_00FF6500
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE6F2 mov eax, dword ptr fs:[00000030h]5_2_00FDE6F2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE6F2 mov eax, dword ptr fs:[00000030h]5_2_00FDE6F2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE6F2 mov eax, dword ptr fs:[00000030h]5_2_00FDE6F2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE6F2 mov eax, dword ptr fs:[00000030h]5_2_00FDE6F2
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE06F1 mov eax, dword ptr fs:[00000030h]5_2_00FE06F1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE06F1 mov eax, dword ptr fs:[00000030h]5_2_00FE06F1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A6C7 mov ebx, dword ptr fs:[00000030h]5_2_00F9A6C7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A6C7 mov eax, dword ptr fs:[00000030h]5_2_00F9A6C7
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F966B0 mov eax, dword ptr fs:[00000030h]5_2_00F966B0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C6A6 mov eax, dword ptr fs:[00000030h]5_2_00F9C6A6
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64690 mov eax, dword ptr fs:[00000030h]5_2_00F64690
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64690 mov eax, dword ptr fs:[00000030h]5_2_00F64690
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F92674 mov eax, dword ptr fs:[00000030h]5_2_00F92674
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100678E mov eax, dword ptr fs:[00000030h]5_2_0100678E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A660 mov eax, dword ptr fs:[00000030h]5_2_00F9A660
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A660 mov eax, dword ptr fs:[00000030h]5_2_00F9A660
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010147A0 mov eax, dword ptr fs:[00000030h]5_2_010147A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7C640 mov eax, dword ptr fs:[00000030h]5_2_00F7C640
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7E627 mov eax, dword ptr fs:[00000030h]5_2_00F7E627
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F96620 mov eax, dword ptr fs:[00000030h]5_2_00F96620
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F98620 mov eax, dword ptr fs:[00000030h]5_2_00F98620
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6262C mov eax, dword ptr fs:[00000030h]5_2_00F6262C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2619 mov eax, dword ptr fs:[00000030h]5_2_00FA2619
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE609 mov eax, dword ptr fs:[00000030h]5_2_00FDE609
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F7260B mov eax, dword ptr fs:[00000030h]5_2_00F7260B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F647FB mov eax, dword ptr fs:[00000030h]5_2_00F647FB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F647FB mov eax, dword ptr fs:[00000030h]5_2_00F647FB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F827ED mov eax, dword ptr fs:[00000030h]5_2_00F827ED
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F827ED mov eax, dword ptr fs:[00000030h]5_2_00F827ED
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F827ED mov eax, dword ptr fs:[00000030h]5_2_00F827ED
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEE7E1 mov eax, dword ptr fs:[00000030h]5_2_00FEE7E1
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6C7C0 mov eax, dword ptr fs:[00000030h]5_2_00F6C7C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE07C3 mov eax, dword ptr fs:[00000030h]5_2_00FE07C3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F607AF mov eax, dword ptr fs:[00000030h]5_2_00F607AF
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102866E mov eax, dword ptr fs:[00000030h]5_2_0102866E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102866E mov eax, dword ptr fs:[00000030h]5_2_0102866E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68770 mov eax, dword ptr fs:[00000030h]5_2_00F68770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70770 mov eax, dword ptr fs:[00000030h]5_2_00F70770
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEE75D mov eax, dword ptr fs:[00000030h]5_2_00FEE75D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60750 mov eax, dword ptr fs:[00000030h]5_2_00F60750
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2750 mov eax, dword ptr fs:[00000030h]5_2_00FA2750
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA2750 mov eax, dword ptr fs:[00000030h]5_2_00FA2750
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE4755 mov eax, dword ptr fs:[00000030h]5_2_00FE4755
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9674D mov esi, dword ptr fs:[00000030h]5_2_00F9674D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9674D mov eax, dword ptr fs:[00000030h]5_2_00F9674D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9674D mov eax, dword ptr fs:[00000030h]5_2_00F9674D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9273C mov eax, dword ptr fs:[00000030h]5_2_00F9273C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9273C mov ecx, dword ptr fs:[00000030h]5_2_00F9273C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9273C mov eax, dword ptr fs:[00000030h]5_2_00F9273C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDC730 mov eax, dword ptr fs:[00000030h]5_2_00FDC730
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C720 mov eax, dword ptr fs:[00000030h]5_2_00F9C720
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C720 mov eax, dword ptr fs:[00000030h]5_2_00F9C720
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60710 mov eax, dword ptr fs:[00000030h]5_2_00F60710
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F90710 mov eax, dword ptr fs:[00000030h]5_2_00F90710
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C700 mov eax, dword ptr fs:[00000030h]5_2_00F9C700
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C8F9 mov eax, dword ptr fs:[00000030h]5_2_00F9C8F9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9C8F9 mov eax, dword ptr fs:[00000030h]5_2_00F9C8F9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8E8C0 mov eax, dword ptr fs:[00000030h]5_2_00F8E8C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034940 mov eax, dword ptr fs:[00000030h]5_2_01034940
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEC89D mov eax, dword ptr fs:[00000030h]5_2_00FEC89D
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60887 mov eax, dword ptr fs:[00000030h]5_2_00F60887
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01004978 mov eax, dword ptr fs:[00000030h]5_2_01004978
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01004978 mov eax, dword ptr fs:[00000030h]5_2_01004978
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEE872 mov eax, dword ptr fs:[00000030h]5_2_00FEE872
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEE872 mov eax, dword ptr fs:[00000030h]5_2_00FEE872
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF6870 mov eax, dword ptr fs:[00000030h]5_2_00FF6870
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF6870 mov eax, dword ptr fs:[00000030h]5_2_00FF6870
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F90854 mov eax, dword ptr fs:[00000030h]5_2_00F90854
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64859 mov eax, dword ptr fs:[00000030h]5_2_00F64859
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F64859 mov eax, dword ptr fs:[00000030h]5_2_00F64859
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F72840 mov ecx, dword ptr fs:[00000030h]5_2_00F72840
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9A830 mov eax, dword ptr fs:[00000030h]5_2_00F9A830
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82835 mov eax, dword ptr fs:[00000030h]5_2_00F82835
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82835 mov eax, dword ptr fs:[00000030h]5_2_00F82835
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82835 mov eax, dword ptr fs:[00000030h]5_2_00F82835
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82835 mov ecx, dword ptr fs:[00000030h]5_2_00F82835
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82835 mov eax, dword ptr fs:[00000030h]5_2_00F82835
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F82835 mov eax, dword ptr fs:[00000030h]5_2_00F82835
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102A9D3 mov eax, dword ptr fs:[00000030h]5_2_0102A9D3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEC810 mov eax, dword ptr fs:[00000030h]5_2_00FEC810
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F929F9 mov eax, dword ptr fs:[00000030h]5_2_00F929F9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F929F9 mov eax, dword ptr fs:[00000030h]5_2_00F929F9
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEE9E0 mov eax, dword ptr fs:[00000030h]5_2_00FEE9E0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A9D0 mov eax, dword ptr fs:[00000030h]5_2_00F6A9D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A9D0 mov eax, dword ptr fs:[00000030h]5_2_00F6A9D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A9D0 mov eax, dword ptr fs:[00000030h]5_2_00F6A9D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A9D0 mov eax, dword ptr fs:[00000030h]5_2_00F6A9D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A9D0 mov eax, dword ptr fs:[00000030h]5_2_00F6A9D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6A9D0 mov eax, dword ptr fs:[00000030h]5_2_00F6A9D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F949D0 mov eax, dword ptr fs:[00000030h]5_2_00F949D0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100483A mov eax, dword ptr fs:[00000030h]5_2_0100483A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100483A mov eax, dword ptr fs:[00000030h]5_2_0100483A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF69C0 mov eax, dword ptr fs:[00000030h]5_2_00FF69C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE89B3 mov esi, dword ptr fs:[00000030h]5_2_00FE89B3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE89B3 mov eax, dword ptr fs:[00000030h]5_2_00FE89B3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE89B3 mov eax, dword ptr fs:[00000030h]5_2_00FE89B3
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F729A0 mov eax, dword ptr fs:[00000030h]5_2_00F729A0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F609AD mov eax, dword ptr fs:[00000030h]5_2_00F609AD
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F609AD mov eax, dword ptr fs:[00000030h]5_2_00F609AD
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEC97C mov eax, dword ptr fs:[00000030h]5_2_00FEC97C
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA096E mov eax, dword ptr fs:[00000030h]5_2_00FA096E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA096E mov edx, dword ptr fs:[00000030h]5_2_00FA096E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FA096E mov eax, dword ptr fs:[00000030h]5_2_00FA096E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F86962 mov eax, dword ptr fs:[00000030h]5_2_00F86962
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F86962 mov eax, dword ptr fs:[00000030h]5_2_00F86962
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F86962 mov eax, dword ptr fs:[00000030h]5_2_00F86962
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE0946 mov eax, dword ptr fs:[00000030h]5_2_00FE0946
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_010308C0 mov eax, dword ptr fs:[00000030h]5_2_010308C0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FE892A mov eax, dword ptr fs:[00000030h]5_2_00FE892A
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF892B mov eax, dword ptr fs:[00000030h]5_2_00FF892B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102A8E4 mov eax, dword ptr fs:[00000030h]5_2_0102A8E4
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FEC912 mov eax, dword ptr fs:[00000030h]5_2_00FEC912
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F58918 mov eax, dword ptr fs:[00000030h]5_2_00F58918
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F58918 mov eax, dword ptr fs:[00000030h]5_2_00F58918
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE908 mov eax, dword ptr fs:[00000030h]5_2_00FDE908
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDE908 mov eax, dword ptr fs:[00000030h]5_2_00FDE908
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034B00 mov eax, dword ptr fs:[00000030h]5_2_01034B00
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9AAEE mov eax, dword ptr fs:[00000030h]5_2_00F9AAEE
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9AAEE mov eax, dword ptr fs:[00000030h]5_2_00F9AAEE
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60AD0 mov eax, dword ptr fs:[00000030h]5_2_00F60AD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F94AD0 mov eax, dword ptr fs:[00000030h]5_2_00F94AD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F94AD0 mov eax, dword ptr fs:[00000030h]5_2_00F94AD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01028B28 mov eax, dword ptr fs:[00000030h]5_2_01028B28
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01028B28 mov eax, dword ptr fs:[00000030h]5_2_01028B28
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB6ACC mov eax, dword ptr fs:[00000030h]5_2_00FB6ACC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB6ACC mov eax, dword ptr fs:[00000030h]5_2_00FB6ACC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB6ACC mov eax, dword ptr fs:[00000030h]5_2_00FB6ACC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0102AB40 mov eax, dword ptr fs:[00000030h]5_2_0102AB40
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01008B42 mov eax, dword ptr fs:[00000030h]5_2_01008B42
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01014B4B mov eax, dword ptr fs:[00000030h]5_2_01014B4B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01014B4B mov eax, dword ptr fs:[00000030h]5_2_01014B4B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100EB50 mov eax, dword ptr fs:[00000030h]5_2_0100EB50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01032B57 mov eax, dword ptr fs:[00000030h]5_2_01032B57
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01032B57 mov eax, dword ptr fs:[00000030h]5_2_01032B57
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01032B57 mov eax, dword ptr fs:[00000030h]5_2_01032B57
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01032B57 mov eax, dword ptr fs:[00000030h]5_2_01032B57
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68AA0 mov eax, dword ptr fs:[00000030h]5_2_00F68AA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68AA0 mov eax, dword ptr fs:[00000030h]5_2_00F68AA0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FB6AA4 mov eax, dword ptr fs:[00000030h]5_2_00FB6AA4
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F98A90 mov edx, dword ptr fs:[00000030h]5_2_00F98A90
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F6EA80 mov eax, dword ptr fs:[00000030h]5_2_00F6EA80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDCA72 mov eax, dword ptr fs:[00000030h]5_2_00FDCA72
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FDCA72 mov eax, dword ptr fs:[00000030h]5_2_00FDCA72
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9CA6F mov eax, dword ptr fs:[00000030h]5_2_00F9CA6F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9CA6F mov eax, dword ptr fs:[00000030h]5_2_00F9CA6F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9CA6F mov eax, dword ptr fs:[00000030h]5_2_00F9CA6F
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F66A50 mov eax, dword ptr fs:[00000030h]5_2_00F66A50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70A5B mov eax, dword ptr fs:[00000030h]5_2_00F70A5B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70A5B mov eax, dword ptr fs:[00000030h]5_2_00F70A5B
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01014BB0 mov eax, dword ptr fs:[00000030h]5_2_01014BB0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01014BB0 mov eax, dword ptr fs:[00000030h]5_2_01014BB0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9CA38 mov eax, dword ptr fs:[00000030h]5_2_00F9CA38
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F84A35 mov eax, dword ptr fs:[00000030h]5_2_00F84A35
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F84A35 mov eax, dword ptr fs:[00000030h]5_2_00F84A35
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100EBD0 mov eax, dword ptr fs:[00000030h]5_2_0100EBD0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8EA2E mov eax, dword ptr fs:[00000030h]5_2_00F8EA2E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F9CA24 mov eax, dword ptr fs:[00000030h]5_2_00F9CA24
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FECA11 mov eax, dword ptr fs:[00000030h]5_2_00FECA11
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F8EBFC mov eax, dword ptr fs:[00000030h]5_2_00F8EBFC
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68BF0 mov eax, dword ptr fs:[00000030h]5_2_00F68BF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68BF0 mov eax, dword ptr fs:[00000030h]5_2_00F68BF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F68BF0 mov eax, dword ptr fs:[00000030h]5_2_00F68BF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FECBF0 mov eax, dword ptr fs:[00000030h]5_2_00FECBF0
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F80BCB mov eax, dword ptr fs:[00000030h]5_2_00F80BCB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F80BCB mov eax, dword ptr fs:[00000030h]5_2_00F80BCB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F80BCB mov eax, dword ptr fs:[00000030h]5_2_00F80BCB
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60BCD mov eax, dword ptr fs:[00000030h]5_2_00F60BCD
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60BCD mov eax, dword ptr fs:[00000030h]5_2_00F60BCD
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F60BCD mov eax, dword ptr fs:[00000030h]5_2_00F60BCD
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70BBE mov eax, dword ptr fs:[00000030h]5_2_00F70BBE
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F70BBE mov eax, dword ptr fs:[00000030h]5_2_00F70BBE
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_0100EA60 mov eax, dword ptr fs:[00000030h]5_2_0100EA60
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_01034A80 mov eax, dword ptr fs:[00000030h]5_2_01034A80
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F5CB7E mov eax, dword ptr fs:[00000030h]5_2_00F5CB7E
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00F58B50 mov eax, dword ptr fs:[00000030h]5_2_00F58B50
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF6B40 mov eax, dword ptr fs:[00000030h]5_2_00FF6B40
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeCode function: 5_2_00FF6B40 mov eax, dword ptr fs:[00000030h]5_2_00FF6B40
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeProcess created: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"Jump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeQueries volume information: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\906982022050120220531MES_S Quote.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.906982022050120220531MES_S Quote.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
            DLL Side-Loading            		11
            Process Injection            		1
            Masquerading            		OS Credential Dumping21
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
            DLL Side-Loading            		11
            Disable or Modify Tools            		LSASS Memory1
            Process Discovery            		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)41
            Virtualization/Sandbox Evasion            		Security Account Manager41
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets1
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
            Obfuscated Files or Information            		Cached Domain Credentials12
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
            Software Packing            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Timestomp            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            DLL Side-Loading            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            906982022050120220531MES_S Quote.exe34%ReversingLabsWin32.Trojan.Leonem
            906982022050120220531MES_S Quote.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name906982022050120220531MES_S Quote.exe, 00000000.00000002.2040724555.0000000003047000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown

            World Map of Contacted IPs

            ⊘No contacted IP infos

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1519323
            Start date and time:2024-09-26 11:18:06 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 6m 26s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:8
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:906982022050120220531MES_S Quote.exe
            Detection:MAL
            Classification:mal96.troj.evad.winEXE@6/6@0/0
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:
            • Successful, ratio: 96%
            • Number of executed functions: 28
            • Number of non-executed functions: 268
            Cookbook Comments:
            • Found application associated with file extension: .exe

            Warnings

            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtCreateKey calls found.
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtProtectVirtualMemory calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.
            • VT rate limit hit for: 906982022050120220531MES_S Quote.exe

            Simulations

            Behavior and APIs

            TimeTypeDescription
            05:18:58API Interceptor4x Sleep call for process: 906982022050120220531MES_S Quote.exe modified
            05:19:01API Interceptor11x Sleep call for process: powershell.exe modified

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\906982022050120220531MES_S Quote.exe.log

            Download File
            Process:C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):1216
            Entropy (8bit):5.34331486778365
            Encrypted:false
            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
            MD5:1330C80CAAC9A0FB172F202485E9B1E8
            SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
            SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
            SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
            Malicious:true
            Reputation:high, very likely benign file
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:data
            Category:dropped
            Size (bytes):1172
            Entropy (8bit):5.357042452875322
            Encrypted:false
            SSDEEP:24:3CytZWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:yyjWSU4y4RQmFoUeWmfmZ9tK8NDE
            MD5:475D428E7231D005EEA5DB556DBED03F
            SHA1:3D603ED4280E0017D1BEB124D68183F8283B5C22
            SHA-256:1314488A930843A7E1A003F2E7C1D883DB44ADEC26AC1CA096FE8DC1B4B180F5
            SHA-512:7181BDCE6DA8DA8AFD3A973BB2B0BA470468EFF32FFB338DB2662FEFA1A7848ACD87C319706B95401EA18DC873CA098DC722EA6F8B2FD04F1AABD2AEBEA97CF9
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4cowmdch.xfy.ps1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Reputation:high, very likely benign file
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4w5xxvlp.bul.ps1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Reputation:high, very likely benign file
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fg3pbeg0.wm5.psm1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nnk0ukal.3ls.psm1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            Static File Info

            General

            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Entropy (8bit):7.87048972891118
            TrID:
            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
            • Win32 Executable (generic) a (10002005/4) 49.78%
            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
            • Generic Win/DOS Executable (2004/3) 0.01%
            • DOS Executable Generic (2002/1) 0.01%
            File name:906982022050120220531MES_S Quote.exe
            File size:694'784 bytes
            MD5:97517a596568472e97648096551266ce
            SHA1:b59e636deb429abd8213ca4edc14c44106ca8fab
            SHA256:b991841036289e1775750f4e841f0b2af835779fd1b9bcd2ccdfd8b579727bbf
            SHA512:e010f99183ce673703294fb070074a4fc3674428917191fb9bf215f975d6a069ef685219f83bcc8b9c9aa25ad51715b383f995af34eee6270f39945ca3b5741f
            SSDEEP:12288:RmdtTJJaG0MdjF1YHcIjwKKhLmaDX3IKbXNd9FO7ZrAG3m5altjT95z4nEAwbgEb:R+d+vQAEXjO7ZrAL5anPrMnEAGK3
            TLSH:38E402452219EA23D4A79FF81611E2B003B95FDAF615D243DFE71DEB7C2A7041480BA7
            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`...............0.................. ........@.. ....................................@................................

            File Icon

            Icon Hash:00928e8e8686b000

            Static PE Info

            General

            Entrypoint:0x4aae2e
            Entrypoint Section:.text
            Digitally signed:false
            Imagebase:0x400000
            Subsystem:windows gui
            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Time Stamp:0xBC60C711 [Mon Feb 24 09:17:05 2070 UTC]
            TLS Callbacks:
            CLR (.Net) Version:
            OS Version Major:4
            OS Version Minor:0
            File Version Major:4
            File Version Minor:0
            Subsystem Version Major:4
            Subsystem Version Minor:0
            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

            Entrypoint Preview

            Instruction
            jmp dword ptr [00402000h]
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al

            Data Directories

            NameVirtual AddressVirtual Size Is in Section
            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IMPORT0xaadd90x4f.text
            IMAGE_DIRECTORY_ENTRY_RESOURCE0xac0000x5bc.rsrc
            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
            IMAGE_DIRECTORY_ENTRY_BASERELOC0xae0000xc.reloc
            IMAGE_DIRECTORY_ENTRY_DEBUG0xa97700x70.text
            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

            Sections

            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
            .text0x20000xa8e340xa9000720a3b07bd6df76c56dbc71f7306e90eFalse0.9397723858173077data7.877466323422058IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            .rsrc0xac0000x5bc0x600bb8e4dd36e9d4ef40a0f7bcde8e0e6afFalse0.421875data4.113512771668418IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
            .reloc0xae0000xc0x20049f56ce660b4a4bc524beffddacea774False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

            Resources

            NameRVASizeTypeLanguageCountryZLIB Complexity
            RT_VERSION0xac0900x32cdata0.4273399014778325
            RT_MANIFEST0xac3cc0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

            Imports

            DLLImport
            mscoree.dll_CorExeMain

            Network Behavior

            ⊘No network behavior found

            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            High Level Behavior Distribution

            Click to dive into process behavior distribution

            Behavior

            Click to jump to process

            System Behavior

            General

            Target ID:0
            Start time:05:18:58
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Imagebase:0xb80000
            File size:694'784 bytes
            MD5 hash:97517A596568472E97648096551266CE
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:3
            Start time:05:18:59
            Start date:26/09/2024
            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            Wow64 process (32bit):true
            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Imagebase:0xe0000
            File size:433'152 bytes
            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:4
            Start time:05:18:59
            Start date:26/09/2024
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff6d64d0000
            File size:862'208 bytes
            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:5
            Start time:05:18:59
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\Desktop\906982022050120220531MES_S Quote.exe"
            Imagebase:0x400000
            File size:694'784 bytes
            MD5 hash:97517A596568472E97648096551266CE
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2299717834.0000000000940000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
            Reputation:low
            Has exited:true

            Disassembly

            Reset < >

              Execution Graph

              Execution Coverage:7.8%
              Dynamic/Decrypted Code Coverage:100%
              Signature Coverage:4.7%
              Total number of Nodes:149
              Total number of Limit Nodes:9
              execution_graph 29891 ae815c8 29892 ae81753 29891->29892 29893 ae815ee 29891->29893 29893->29892 29896 ae81848 PostMessageW 29893->29896 29898 ae81840 29893->29898 29897 ae818b4 29896->29897 29897->29893 29899 ae81848 PostMessageW 29898->29899 29900 ae818b4 29899->29900 29900->29893 29983 2da4668 29984 2da467a 29983->29984 29985 2da4686 29984->29985 29989 2da4779 29984->29989 29994 2da3e34 29985->29994 29987 2da46a5 29990 2da479d 29989->29990 29998 2da4888 29990->29998 30002 2da4879 29990->30002 29995 2da3e3f 29994->29995 30010 2da5cb8 29995->30010 29997 2da709e 29997->29987 30000 2da48af 29998->30000 29999 2da498c 29999->29999 30000->29999 30006 2da44b4 30000->30006 30003 2da48af 30002->30003 30004 2da44b4 CreateActCtxA 30003->30004 30005 2da498c 30003->30005 30004->30005 30007 2da5918 CreateActCtxA 30006->30007 30009 2da59db 30007->30009 30011 2da5cc3 30010->30011 30014 2da5cf8 30011->30014 30013 2da718d 30013->29997 30015 2da5d03 30014->30015 30018 2da5d28 30015->30018 30017 2da7262 30017->30013 30019 2da5d33 30018->30019 30020 2da5d58 GetModuleHandleW 30019->30020 30021 2da7365 30020->30021 30021->30017 30022 12fd01c 30023 12fd034 30022->30023 30024 12fd08e 30023->30024 30027 54c2c08 30023->30027 30035 54c1434 30023->30035 30028 54c2c45 30027->30028 30029 54c2c79 30028->30029 30031 54c2c69 30028->30031 30051 54c155c 30029->30051 30043 54c2da0 30031->30043 30047 54c2d91 30031->30047 30032 54c2c77 30036 54c143f 30035->30036 30037 54c2c79 30036->30037 30039 54c2c69 30036->30039 30038 54c155c CallWindowProcW 30037->30038 30040 54c2c77 30038->30040 30041 54c2da0 CallWindowProcW 30039->30041 30042 54c2d91 CallWindowProcW 30039->30042 30041->30040 30042->30040 30045 54c2db4 30043->30045 30044 54c2e40 30044->30032 30055 54c2e58 30045->30055 30049 54c2db4 30047->30049 30048 54c2e40 30048->30032 30050 54c2e58 CallWindowProcW 30049->30050 30050->30048 30052 54c1567 30051->30052 30053 54c435a CallWindowProcW 30052->30053 30054 54c4309 30052->30054 30053->30054 30054->30032 30056 54c2e69 30055->30056 30058 54c4292 30055->30058 30056->30044 30059 54c155c CallWindowProcW 30058->30059 30060 54c42aa 30059->30060 30060->30056 29901 54c7368 29902 54c7395 29901->29902 29909 54c70e8 29902->29909 29905 54c70e8 GetModuleHandleW 29906 54c7429 29905->29906 29907 54c70e8 GetModuleHandleW 29906->29907 29908 54c74bf 29907->29908 29910 54c70f3 29909->29910 29913 54c7298 29910->29913 29912 54c73f7 29912->29905 29914 54c72a3 29913->29914 29915 54c9642 29914->29915 29919 2da5d58 29914->29919 29926 2da5db7 29914->29926 29934 2da8609 29914->29934 29915->29912 29920 2da5d63 29919->29920 29922 2da88cb 29920->29922 29941 2daab71 29920->29941 29921 2da8909 29921->29915 29922->29921 29945 2dacc70 29922->29945 29950 2dacc61 29922->29950 29928 2da5d63 29926->29928 29927 2da5dee 29928->29926 29928->29927 29930 2da88cb 29928->29930 29933 2daab71 GetModuleHandleW 29928->29933 29929 2da8909 29929->29915 29930->29929 29931 2dacc70 GetModuleHandleW 29930->29931 29932 2dacc61 GetModuleHandleW 29930->29932 29931->29929 29932->29929 29933->29930 29935 2da8618 29934->29935 29937 2da88cb 29935->29937 29940 2daab71 GetModuleHandleW 29935->29940 29936 2da8909 29936->29915 29937->29936 29938 2dacc70 GetModuleHandleW 29937->29938 29939 2dacc61 GetModuleHandleW 29937->29939 29938->29936 29939->29936 29940->29937 29955 2daafb0 29941->29955 29958 2daafa1 29941->29958 29942 2daab86 29942->29922 29946 2dacc91 29945->29946 29947 2daccb5 29946->29947 29967 2dad218 29946->29967 29971 2dad228 29946->29971 29947->29921 29951 2dacc91 29950->29951 29952 2daccb5 29951->29952 29953 2dad218 GetModuleHandleW 29951->29953 29954 2dad228 GetModuleHandleW 29951->29954 29952->29921 29953->29952 29954->29952 29962 2dab0a8 29955->29962 29956 2daafbf 29956->29942 29959 2daafb0 29958->29959 29961 2dab0a8 GetModuleHandleW 29959->29961 29960 2daafbf 29960->29942 29961->29960 29963 2dab0dc 29962->29963 29964 2dab0b9 29962->29964 29963->29956 29964->29963 29965 2dab2e0 GetModuleHandleW 29964->29965 29966 2dab30d 29965->29966 29966->29956 29968 2dad235 29967->29968 29969 2dad26f 29968->29969 29975 2dacff0 29968->29975 29969->29947 29972 2dad235 29971->29972 29973 2dad26f 29972->29973 29974 2dacff0 GetModuleHandleW 29972->29974 29973->29947 29974->29973 29976 2dacffb 29975->29976 29978 2dadb80 29976->29978 29979 2dad11c 29976->29979 29978->29978 29980 2dad127 29979->29980 29981 2da5d58 GetModuleHandleW 29980->29981 29982 2dadbef 29981->29982 29982->29978 30061 2dad340 30062 2dad386 30061->30062 30066 2dad50f 30062->30066 30069 2dad520 30062->30069 30063 2dad473 30072 2dad0b8 30066->30072 30070 2dad54e 30069->30070 30071 2dad0b8 DuplicateHandle 30069->30071 30070->30063 30071->30070 30073 2dad588 DuplicateHandle 30072->30073 30074 2dad54e 30073->30074 30074->30063 30075 54c95f2 30076 54c9600 30075->30076 30077 54c7298 GetModuleHandleW 30076->30077 30078 54c960f 30077->30078

              Executed Functions

              Function 054C7358 Relevance: 3.3, Strings: 1, Instructions: 2026COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 316 54c7358-54c7361 318 54c73ae-54c73b6 316->318 319 54c7363-54c7393 316->319 320 54c73dc-54c7440 call 54c70e8 * 2 318->320 321 54c73b8 318->321 324 54c739a-54c73ab 319->324 325 54c7395 319->325 338 54c744a-54c7456 call 54c70f8 320->338 323 54c73ba-54c73bd 321->323 330 54c73bf-54c73d9 323->330 324->318 325->324 330->320 340 54c745b-54c753a call 54c70f8 call 54c70e8 call 54c70f8 * 2 338->340 358 54c7544-54c7550 call 54c7108 340->358 360 54c7555-54c7582 call 54c7108 358->360 364 54c7587-54c759e 360->364 366 54c75a4-54c75c3 364->366 368 54c75cd-54c75e3 366->368 369 54c75ec-54c75f0 368->369 370 54c75f7-54c7610 369->370 372 54c7616-54c7620 370->372 373 54c7627-54c76b6 call 54c7118 372->373 374 54c7622 372->374 381 54c76be-54c76d0 373->381 374->373 382 54c76d8-54c8ebb call 54c70f8 call 54c7128 * 2 call 54c70f8 call 54c7138 call 54c7128 call 54c70f8 call 54c7148 call 54c7158 call 54c7168 call 54c7178 call 54c7188 call 54c7198 call 54c7148 call 54c7158 call 54c7168 call 54c7178 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71b8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7148 call 54c71c8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7148 call 54c71c8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71d8 call 54c71e8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71f8 call 54c7208 call 54c71d8 * 2 call 54c71e8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71f8 call 54c7208 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7218 * 2 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71d8 * 4 call 54c71e8 381->382 685 54c8ebd-54c8ec9 382->685 686 54c8ee5 382->686 687 54c8ecb-54c8ed1 685->687 688 54c8ed3-54c8ed9 685->688 689 54c8eeb-54c95b9 call 54c7228 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71f8 call 54c7208 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7238 call 54c7248 call 54c7258 call 54c7218 * 14 call 54c7268 call 54c7168 call 54c7278 call 54c7288 * 2 686->689 690 54c8ee3 687->690 688->690 690->689
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.2060321661.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_54c0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Pp]q
              • API String ID: 0-2528107101
              • Opcode ID: c483b89bb1fbba2bac3c797357c6faefcac27d0494d6896552df72fdcca4a643
              • Instruction ID: 9f1c09f02515ded088df2c833ef908170b56889d4bc9e49f2bbf8a0488949489
              • Opcode Fuzzy Hash: c483b89bb1fbba2bac3c797357c6faefcac27d0494d6896552df72fdcca4a643
              • Instruction Fuzzy Hash: 4423C538A10219CFCB59DF65C898AD9B7B6FF89300F5141E9E509AB361DB31AE85CF40
              Function 054C7368 Relevance: 3.3, Strings: 1, Instructions: 2020COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 792 54c7368-54c7393 793 54c739a-54c73b6 792->793 794 54c7395 792->794 797 54c73dc-54c7620 call 54c70e8 * 2 call 54c70f8 * 2 call 54c70e8 call 54c70f8 * 2 call 54c7108 * 2 793->797 798 54c73b8 793->798 794->793 846 54c7627-54c76d0 call 54c7118 797->846 847 54c7622 797->847 799 54c73ba-54c73bd 798->799 803 54c73bf-54c73d9 799->803 803->797 855 54c76d8-54c8ebb call 54c70f8 call 54c7128 * 2 call 54c70f8 call 54c7138 call 54c7128 call 54c70f8 call 54c7148 call 54c7158 call 54c7168 call 54c7178 call 54c7188 call 54c7198 call 54c7148 call 54c7158 call 54c7168 call 54c7178 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71b8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7148 call 54c71c8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7148 call 54c71c8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71d8 call 54c71e8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71f8 call 54c7208 call 54c71d8 * 2 call 54c71e8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71f8 call 54c7208 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7218 * 2 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71d8 * 4 call 54c71e8 846->855 847->846 1158 54c8ebd-54c8ec9 855->1158 1159 54c8ee5 855->1159 1160 54c8ecb-54c8ed1 1158->1160 1161 54c8ed3-54c8ed9 1158->1161 1162 54c8eeb-54c95b9 call 54c7228 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c71f8 call 54c7208 call 54c71a8 call 54c7158 call 54c7168 call 54c7188 call 54c7198 call 54c7238 call 54c7248 call 54c7258 call 54c7218 * 14 call 54c7268 call 54c7168 call 54c7278 call 54c7288 * 2 1159->1162 1163 54c8ee3 1160->1163 1161->1163 1163->1162
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.2060321661.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_54c0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Pp]q
              • API String ID: 0-2528107101
              • Opcode ID: 1e670f65f4a2d40db2c4e435b187242931aaf7b7d7a604228e169f1ccfeb3646
              • Instruction ID: 24bacb143c95d9bbfeb16d599f4ad9e06bd7918ec74488c1e06550b4ac2fb93f
              • Opcode Fuzzy Hash: 1e670f65f4a2d40db2c4e435b187242931aaf7b7d7a604228e169f1ccfeb3646
              • Instruction Fuzzy Hash: 1523C538A10219CFCB59DF65C898AD9B7B6FF89300F5141E9E509AB361DB31AE85CF40
              Function 0AE80738 Relevance: .1, Instructions: 123COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2070774348.000000000AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AE80000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_ae80000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ee844ebf366f39d6f433abf4803656847fba555220ff20db6c73b14ec3c31d22
              • Instruction ID: ef15ee1dddf86203a6a700eb51207f0f76aa735a0e3451419016eaad4de1b283
              • Opcode Fuzzy Hash: ee844ebf366f39d6f433abf4803656847fba555220ff20db6c73b14ec3c31d22
              • Instruction Fuzzy Hash: B65118B1D156298FDB28DF66C8007E9FBB6BF89300F05D2AAD40DA6611EB704AC5CF40
              Function 02DAB0A8 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1298 2dab0a8-2dab0b7 1299 2dab0b9-2dab0c6 call 2da9b14 1298->1299 1300 2dab0e3-2dab0e7 1298->1300 1305 2dab0c8 1299->1305 1306 2dab0dc 1299->1306 1301 2dab0fb-2dab13c 1300->1301 1302 2dab0e9-2dab0f3 1300->1302 1309 2dab149-2dab157 1301->1309 1310 2dab13e-2dab146 1301->1310 1302->1301 1353 2dab0ce call 2dab340 1305->1353 1354 2dab0ce call 2dab331 1305->1354 1306->1300 1312 2dab17b-2dab17d 1309->1312 1313 2dab159-2dab15e 1309->1313 1310->1309 1311 2dab0d4-2dab0d6 1311->1306 1316 2dab218-2dab2d8 1311->1316 1317 2dab180-2dab187 1312->1317 1314 2dab169 1313->1314 1315 2dab160-2dab167 call 2daad10 1313->1315 1319 2dab16b-2dab179 1314->1319 1315->1319 1348 2dab2da-2dab2dd 1316->1348 1349 2dab2e0-2dab30b GetModuleHandleW 1316->1349 1320 2dab189-2dab191 1317->1320 1321 2dab194-2dab19b 1317->1321 1319->1317 1320->1321 1323 2dab1a8-2dab1b1 call 2daad20 1321->1323 1324 2dab19d-2dab1a5 1321->1324 1329 2dab1be-2dab1c3 1323->1329 1330 2dab1b3-2dab1bb 1323->1330 1324->1323 1332 2dab1e1-2dab1ee 1329->1332 1333 2dab1c5-2dab1cc 1329->1333 1330->1329 1339 2dab1f0-2dab20e 1332->1339 1340 2dab211-2dab217 1332->1340 1333->1332 1334 2dab1ce-2dab1de call 2daad30 call 2daad40 1333->1334 1334->1332 1339->1340 1348->1349 1350 2dab30d-2dab313 1349->1350 1351 2dab314-2dab328 1349->1351 1350->1351 1353->1311 1354->1311
              APIs
              • GetModuleHandleW.KERNELBASE(00000000), ref: 02DAB2FE
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: HandleModule
              • String ID:
              • API String ID: 4139908857-0
              • Opcode ID: a1b3eb523444cff354a2e145760f6d9a893f5d35ff50a74b58844f6c96c8d9bc
              • Instruction ID: 15782eb2547234beb1650dac7699a90cbb1a4e09534ec58968b4e6e487948fcd
              • Opcode Fuzzy Hash: a1b3eb523444cff354a2e145760f6d9a893f5d35ff50a74b58844f6c96c8d9bc
              • Instruction Fuzzy Hash: E6712370A00B058FD724DF69D465BAABBF5FF48304F008A2AD48AD7B50DB35E846CB90
              Function 02DA590C Relevance: 1.6, APIs: 1, Instructions: 99COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1355 2da590c-2da59d9 CreateActCtxA 1357 2da59db-2da59e1 1355->1357 1358 2da59e2-2da5a3c 1355->1358 1357->1358 1365 2da5a4b-2da5a4f 1358->1365 1366 2da5a3e-2da5a41 1358->1366 1367 2da5a60-2da5a90 1365->1367 1368 2da5a51-2da5a5d 1365->1368 1366->1365 1372 2da5a42-2da5a4a 1367->1372 1373 2da5a92-2da5b14 1367->1373 1368->1367 1372->1365
              APIs
              • CreateActCtxA.KERNEL32(?), ref: 02DA59C9
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: Create
              • String ID:
              • API String ID: 2289755597-0
              • Opcode ID: 8a818a1002e0a050bf3701801362a53a5299211f0e3fb52ee4c3fd5e499dfac8
              • Instruction ID: eea234aa54d7049c52e99fb898062623f1a8f01ec30e6bdcd4c09b9443474c44
              • Opcode Fuzzy Hash: 8a818a1002e0a050bf3701801362a53a5299211f0e3fb52ee4c3fd5e499dfac8
              • Instruction Fuzzy Hash: FC4113B1C00619CBDF24CFA9C895BDEBBF5BF49314F20806AD409AB251D775694ACF90
              Function 054C155C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1375 54c155c-54c42fc 1378 54c43ac-54c43cc call 54c1434 1375->1378 1379 54c4302-54c4307 1375->1379 1386 54c43cf-54c43dc 1378->1386 1381 54c4309-54c4340 1379->1381 1382 54c435a-54c4392 CallWindowProcW 1379->1382 1388 54c4349-54c4358 1381->1388 1389 54c4342-54c4348 1381->1389 1384 54c439b-54c43aa 1382->1384 1385 54c4394-54c439a 1382->1385 1384->1386 1385->1384 1388->1386 1389->1388
              APIs
              • CallWindowProcW.USER32(?,?,?,?,?), ref: 054C4381
              Memory Dump Source
              • Source File: 00000000.00000002.2060321661.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_54c0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: CallProcWindow
              • String ID:
              • API String ID: 2714655100-0
              • Opcode ID: 9e653acbe0f4716f9a2d0e41d7af96d25950bd5f15c2e1ffd4e8ede610a88053
              • Instruction ID: c6f4713934c272047b438c764934aea879901ed1a5956bc8526dda0d4369dac6
              • Opcode Fuzzy Hash: 9e653acbe0f4716f9a2d0e41d7af96d25950bd5f15c2e1ffd4e8ede610a88053
              • Instruction Fuzzy Hash: A14109B9A002059FCB54CF99C549AEABFF5FF88314F14849EE519A7321D774A841CFA0
              Function 02DA44B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1392 2da44b4-2da59d9 CreateActCtxA 1395 2da59db-2da59e1 1392->1395 1396 2da59e2-2da5a3c 1392->1396 1395->1396 1403 2da5a4b-2da5a4f 1396->1403 1404 2da5a3e-2da5a41 1396->1404 1405 2da5a60-2da5a90 1403->1405 1406 2da5a51-2da5a5d 1403->1406 1404->1403 1410 2da5a42-2da5a4a 1405->1410 1411 2da5a92-2da5b14 1405->1411 1406->1405 1410->1403
              APIs
              • CreateActCtxA.KERNEL32(?), ref: 02DA59C9
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: Create
              • String ID:
              • API String ID: 2289755597-0
              • Opcode ID: c555724eed5b2e2400cfaf1ae26cf0d8d77c06fffafe7bdf5474582105012146
              • Instruction ID: b7bf2bb8f94d5febb5fee86bfca49df903578af39c900cb689839bf71cf63118
              • Opcode Fuzzy Hash: c555724eed5b2e2400cfaf1ae26cf0d8d77c06fffafe7bdf5474582105012146
              • Instruction Fuzzy Hash: 9D41F3B1D0071DCBDB24CFA9C885BDEBBB5BF48304F60806AD409AB251DB75694ACF90
              Function 02DAD0B8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1413 2dad0b8-2dad61c DuplicateHandle 1415 2dad61e-2dad624 1413->1415 1416 2dad625-2dad642 1413->1416 1415->1416
              APIs
              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02DAD54E,?,?,?,?,?), ref: 02DAD60F
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: DuplicateHandle
              • String ID:
              • API String ID: 3793708945-0
              • Opcode ID: 48dcd031f67d8631d902346c633aae531a12018f05ac9aa9146b108ff860ab4a
              • Instruction ID: ad7b6d108ecf7e0b51c241c23f8eb275aeafc474141cbf4011bc8a57894a27a9
              • Opcode Fuzzy Hash: 48dcd031f67d8631d902346c633aae531a12018f05ac9aa9146b108ff860ab4a
              • Instruction Fuzzy Hash: 7321E6B59002489FDB10CF9AD984ADEFFF5FB48314F14845AE918A3350D378A954CFA5
              Function 02DAD580 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1419 2dad580-2dad61c DuplicateHandle 1420 2dad61e-2dad624 1419->1420 1421 2dad625-2dad642 1419->1421 1420->1421
              APIs
              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02DAD54E,?,?,?,?,?), ref: 02DAD60F
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: DuplicateHandle
              • String ID:
              • API String ID: 3793708945-0
              • Opcode ID: 51de4f8aa49f46c2db23ac9c2184df2dada85d5316e2edb1c22059ab6bf72e9d
              • Instruction ID: e4d16d0639a0321a095bf498a3072b9dc721a88e4e0cc4c90a4c83491c0850de
              • Opcode Fuzzy Hash: 51de4f8aa49f46c2db23ac9c2184df2dada85d5316e2edb1c22059ab6bf72e9d
              • Instruction Fuzzy Hash: 2421E2B5D002489FDB10CFA9D985AEEBBF5FF08324F14841AE918A3350D378A954CFA1
              Function 0AE81840 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1424 ae81840-ae818b2 PostMessageW 1426 ae818bb-ae818cf 1424->1426 1427 ae818b4-ae818ba 1424->1427 1427->1426
              APIs
              • PostMessageW.USER32(?,?,?,?), ref: 0AE818A5
              Memory Dump Source
              • Source File: 00000000.00000002.2070774348.000000000AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AE80000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_ae80000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: MessagePost
              • String ID:
              • API String ID: 410705778-0
              • Opcode ID: e26302ff3d839ca610cbe5a75d193e0e2f56ae51d6cd8bab19fdfe68526306cd
              • Instruction ID: 939ebffe8e5db95a7e00e6650a22ee96fdcc73b7e76d88b1ca1d7894c888c135
              • Opcode Fuzzy Hash: e26302ff3d839ca610cbe5a75d193e0e2f56ae51d6cd8bab19fdfe68526306cd
              • Instruction Fuzzy Hash: 2B11F2B58003499FDB10DF9AD485BDEFFF8EB49324F10841AE958A7610D379A584CFA1
              Function 02DAB298 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1429 2dab298-2dab2d8 1430 2dab2da-2dab2dd 1429->1430 1431 2dab2e0-2dab30b GetModuleHandleW 1429->1431 1430->1431 1432 2dab30d-2dab313 1431->1432 1433 2dab314-2dab328 1431->1433 1432->1433
              APIs
              • GetModuleHandleW.KERNELBASE(00000000), ref: 02DAB2FE
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: HandleModule
              • String ID:
              • API String ID: 4139908857-0
              • Opcode ID: c0a4538a36b66c7c36f0e3221e5fea26d70d942049f5e24be7e813215580b152
              • Instruction ID: 269a002f8ffae5ebca7915994c49fc52edd9f66cdb7cc86031f4837e04c0e2c0
              • Opcode Fuzzy Hash: c0a4538a36b66c7c36f0e3221e5fea26d70d942049f5e24be7e813215580b152
              • Instruction Fuzzy Hash: ED11E0B5C002498FDB10DF9AD444ADEFBF8EF88328F10845AD459A7310C379A545CFA5
              Function 0AE81848 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1435 ae81848-ae818b2 PostMessageW 1436 ae818bb-ae818cf 1435->1436 1437 ae818b4-ae818ba 1435->1437 1437->1436
              APIs
              • PostMessageW.USER32(?,?,?,?), ref: 0AE818A5
              Memory Dump Source
              • Source File: 00000000.00000002.2070774348.000000000AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AE80000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_ae80000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: MessagePost
              • String ID:
              • API String ID: 410705778-0
              • Opcode ID: 6a7dbe2aa78e6e0944322fc883dc8ec3fa58665f0988599e7e6615160de47c88
              • Instruction ID: 7ab0f56250ea65ab09ece7ab109a17a0a60dbe55a9047f0502ee8dce68495891
              • Opcode Fuzzy Hash: 6a7dbe2aa78e6e0944322fc883dc8ec3fa58665f0988599e7e6615160de47c88
              • Instruction Fuzzy Hash: AA11E5B58003499FDB10DF9AD445BDEFBF8FB48324F108419D518A7210C379A544CFA5
              Function 012ED4C4 Relevance: .1, Instructions: 75COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2039883340.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_12ed000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 921d8c7d6bb50e09d79be69dc0162a9edb74f108cc12677cfb5d3713d6e03f49
              • Instruction ID: 92bc15ece1221062782a0307829cc4dfd79bd14ef4e18a33dad13caef1ed890b
              • Opcode Fuzzy Hash: 921d8c7d6bb50e09d79be69dc0162a9edb74f108cc12677cfb5d3713d6e03f49
              • Instruction Fuzzy Hash: BE212571510248DFDB16DF58E9C8F26BFA5FB88318F60C569E9090B256C33AD416CBA2
              Function 012FD01C Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2039954715.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_12fd000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8466081804eefd0d1c2f62a0a2624c50e0a9d5985b22cc1898a9d002f75075f4
              • Instruction ID: 040dfa431e2e0366f5b627e0d92f52ced5a1ef118b4bcc851ed9fb8b0c4470dc
              • Opcode Fuzzy Hash: 8466081804eefd0d1c2f62a0a2624c50e0a9d5985b22cc1898a9d002f75075f4
              • Instruction Fuzzy Hash: FF210071614208DFDB15DF68D980B26FF65EB88314F20C57DEA0A4B256C37AD406CA62
              Function 012FD006 Relevance: .1, Instructions: 62COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2039954715.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_12fd000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ce04c23e8672d40545515d216d60e3282410386dd2f454013869e1a05bdb1d0f
              • Instruction ID: ce825f8d9c534849fdb9ac9605cb3b9934374f04a20d76aab5c69c1d71599319
              • Opcode Fuzzy Hash: ce04c23e8672d40545515d216d60e3282410386dd2f454013869e1a05bdb1d0f
              • Instruction Fuzzy Hash: 80217C755093848FDB03CF24D994715BF71EB46314F28C5EEDA498B2A7C33A980ACB62
              Function 012ED4BF Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2039883340.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_12ed000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
              • Instruction ID: 7272ce65d5ab4c8c841cc95b3e995cf7fe3fa32c03b49169af7d60888b25ef01
              • Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
              • Instruction Fuzzy Hash: 25110376404284CFCB12CF54D9C4B16BFB1FB88314F24C6A9D9490B257C336D45ACBA2
              Function 012ED731 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2039883340.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_12ed000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 12c75094cc985edd56a68dc42b10f3c61f33c0377e36b9d6bbae8734bfbb40c5
              • Instruction ID: 76b1785cffce0f3bda4daf2d8903a1de4b36e96b37fc0c7b73bc77103f19a200
              • Opcode Fuzzy Hash: 12c75094cc985edd56a68dc42b10f3c61f33c0377e36b9d6bbae8734bfbb40c5
              • Instruction Fuzzy Hash: 34012B310543889AE7148BA9CD88B67FFDCEF45330F58C429EE094B282C2789840C671
              Function 012ED730 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2039883340.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_12ed000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c83a38c0df69926a12710dafb53c11ce22b0bf36c98c84450db3ca233e39196c
              • Instruction ID: f37fcba4f31a48794e710905551f0ab62330e639a573d7b4a0c3128f02098825
              • Opcode Fuzzy Hash: c83a38c0df69926a12710dafb53c11ce22b0bf36c98c84450db3ca233e39196c
              • Instruction Fuzzy Hash: 22F0F6710043889EE7148F1ACC88B62FFD8EF85334F18C45AEE084F282C2799844CA70

              Non-executed Functions

              Function 0AE833B0 Relevance: .4, Instructions: 353COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2070774348.000000000AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AE80000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_ae80000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cd8ec5379013111f693db7ffe71b4ab4ebc280d41aecfaa3c7d5a020061d80ec
              • Instruction ID: 203730a292011f650b710e0664d0cbcb89dc4907853987d7df816195382e2d2b
              • Opcode Fuzzy Hash: cd8ec5379013111f693db7ffe71b4ab4ebc280d41aecfaa3c7d5a020061d80ec
              • Instruction Fuzzy Hash: 6CD199B07006029FDB25EB79C460BAEB7F6AF88B04F584569C14E9F391CB35E906CB51
              Function 054C0040 Relevance: .3, Instructions: 315COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2060321661.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_54c0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e524b7c2d2b51bcb03715c9338e7e41257c932a5e4b0ab17843116b4432340e2
              • Instruction ID: ed442ddabd5fb5e20e8729113766a9708777cd5c039552683ee86f021bce11b3
              • Opcode Fuzzy Hash: e524b7c2d2b51bcb03715c9338e7e41257c932a5e4b0ab17843116b4432340e2
              • Instruction Fuzzy Hash: AD1274B08817478AD710CF65F94C1893BB1BB95318BF04B09D1617B3E5DBB929AACF44
              Function 02DADE4C Relevance: .3, Instructions: 264COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2040299340.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_2da0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 82abdea09ca048665982f893ed37619cf1a7915e4134d7b9821e45448bf0b783
              • Instruction ID: 8c025e5b55fc15604a0322546eca9887d28dadc026b65b8ae93aca9681ddaae4
              • Opcode Fuzzy Hash: 82abdea09ca048665982f893ed37619cf1a7915e4134d7b9821e45448bf0b783
              • Instruction Fuzzy Hash: 52A14C32E002098FCF15DFA4C99499EB7B3FF84304B2585AAE805AB365DB71ED15CB50
              Function 054C0006 Relevance: .2, Instructions: 243COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2060321661.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_54c0000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c5a2f00d22473bc9d967d8dcbbc7ff804c08e68550fea01e38e33510e755281b
              • Instruction ID: 68fc0aab112a15347a91b748b52ef634601cf5018ac9266e5cb9df6d2d928d4e
              • Opcode Fuzzy Hash: c5a2f00d22473bc9d967d8dcbbc7ff804c08e68550fea01e38e33510e755281b
              • Instruction Fuzzy Hash: DBC123B0C807478BD711CF65F9481893BB1BB95328BB54B09D1617B3E5DBB828AACF44

              Execution Graph

              Execution Coverage:0.8%
              Dynamic/Decrypted Code Coverage:5.5%
              Signature Coverage:10.1%
              Total number of Nodes:109
              Total number of Limit Nodes:9
              execution_graph 94634 42c0e3 94635 42c100 94634->94635 94638 fa2df0 LdrInitializeThunk 94635->94638 94636 42c128 94638->94636 94744 425253 94749 42526c 94744->94749 94745 4252ff 94746 4252b7 94747 42eb73 RtlFreeHeap 94746->94747 94748 4252c7 94747->94748 94749->94745 94749->94746 94750 4252fa 94749->94750 94751 42eb73 RtlFreeHeap 94750->94751 94751->94745 94752 42fd33 94753 42fd43 94752->94753 94754 42fd49 94752->94754 94755 42ec53 RtlAllocateHeap 94754->94755 94756 42fd6f 94755->94756 94757 424eb3 94758 424ecf 94757->94758 94759 424ef7 94758->94759 94760 424f0b 94758->94760 94761 42caf3 NtClose 94759->94761 94762 42caf3 NtClose 94760->94762 94763 424f00 94761->94763 94764 424f14 94762->94764 94767 42ec93 RtlAllocateHeap 94764->94767 94766 424f1f 94767->94766 94644 414283 94648 4142a3 94644->94648 94646 41430c 94647 414302 94648->94646 94649 41b9e3 RtlFreeHeap LdrInitializeThunk 94648->94649 94649->94647 94650 41aba3 94651 41abbb 94650->94651 94653 41ac15 94650->94653 94651->94653 94654 41ea93 94651->94654 94655 41eab9 94654->94655 94659 41ebb0 94655->94659 94660 42fe63 94655->94660 94657 41eb4e 94657->94659 94666 42c133 94657->94666 94659->94653 94661 42fdd3 94660->94661 94662 42fe30 94661->94662 94670 42ec53 94661->94670 94662->94657 94664 42fe0d 94673 42eb73 94664->94673 94667 42c150 94666->94667 94682 fa2c0a 94667->94682 94668 42c17c 94668->94659 94676 42ce03 94670->94676 94672 42ec6b 94672->94664 94679 42ce53 94673->94679 94675 42eb89 94675->94662 94677 42ce1d 94676->94677 94678 42ce2e RtlAllocateHeap 94677->94678 94678->94672 94680 42ce70 94679->94680 94681 42ce81 RtlFreeHeap 94680->94681 94681->94675 94683 fa2c1f LdrInitializeThunk 94682->94683 94684 fa2c11 94682->94684 94683->94668 94684->94668 94768 417db3 94770 417dd7 94768->94770 94769 417dde 94770->94769 94771 417e13 LdrLoadDll 94770->94771 94772 417e2a 94770->94772 94771->94772 94685 401ba8 94686 401c00 94685->94686 94689 430203 94686->94689 94692 42e743 94689->94692 94693 42e766 94692->94693 94702 4078a3 94693->94702 94695 42e77c 94696 401c82 94695->94696 94705 41b6d3 94695->94705 94698 42e79b 94699 42e7b0 94698->94699 94700 42cea3 ExitProcess 94698->94700 94716 42cea3 94699->94716 94700->94699 94719 416a73 94702->94719 94704 4078b0 94704->94695 94706 41b6ff 94705->94706 94730 41b5c3 94706->94730 94709 41b744 94711 41b760 94709->94711 94714 42caf3 NtClose 94709->94714 94710 41b72c 94712 41b737 94710->94712 94736 42caf3 94710->94736 94711->94698 94712->94698 94715 41b756 94714->94715 94715->94698 94717 42cebd 94716->94717 94718 42cecb ExitProcess 94717->94718 94718->94696 94720 416a90 94719->94720 94722 416aa6 94720->94722 94723 42d523 94720->94723 94722->94704 94725 42d53d 94723->94725 94724 42d56c 94724->94722 94725->94724 94726 42c133 LdrInitializeThunk 94725->94726 94727 42d5cc 94726->94727 94728 42eb73 RtlFreeHeap 94727->94728 94729 42d5e2 94728->94729 94729->94722 94731 41b6b9 94730->94731 94732 41b5dd 94730->94732 94731->94709 94731->94710 94739 42c1d3 94732->94739 94735 42caf3 NtClose 94735->94731 94737 42cb0d 94736->94737 94738 42cb1e NtClose 94737->94738 94738->94712 94740 42c1f0 94739->94740 94743 fa35c0 LdrInitializeThunk 94740->94743 94741 41b6ad 94741->94735 94743->94741 94773 fa2b60 LdrInitializeThunk

              Executed Functions

              Function 00417DB3 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
              Download Yara Rule

              Control-flow Graph

              APIs
              • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417E25
              Memory Dump Source
              • Source File: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_400000_906982022050120220531MES_S Quote.jbxd
              Yara matches
              Similarity
              • API ID: Load
              • String ID:
              • API String ID: 2234796835-0
              • Opcode ID: f8c0f3aef9c94af5ac5890a13dcb9a83ab1e3ff87fedb79cadc258e64543bc3b
              • Instruction ID: 7a7af7b9856f89c3fd4e954990ffc23e41ee1a07a0ddb8f3e6700b18da091ebf
              • Opcode Fuzzy Hash: f8c0f3aef9c94af5ac5890a13dcb9a83ab1e3ff87fedb79cadc258e64543bc3b
              • Instruction Fuzzy Hash: 150112B5E4020DBBDF10DAE5DC42FDEB7B89B54308F0041A6E90897241F635EB588795
              Function 0042CAF3 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 32 42caf3-42cb2c call 404c23 call 42dd03 NtClose
              APIs
              • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042CB27
              Memory Dump Source
              • Source File: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_400000_906982022050120220531MES_S Quote.jbxd
              Yara matches
              Similarity
              • API ID: Close
              • String ID:
              • API String ID: 3535843008-0
              • Opcode ID: 6cb53540c7ea946b1ba5a4a79a97e69a3689a57fe710644927e3e1f50da07631
              • Instruction ID: 45d2abd956cc72b103f40ef8a9e7e76d0b57bbc16aa4e3d8fe2f272dbf1175f9
              • Opcode Fuzzy Hash: 6cb53540c7ea946b1ba5a4a79a97e69a3689a57fe710644927e3e1f50da07631
              • Instruction Fuzzy Hash: E8E04F362546147BD110BA6AEC01FD7776CDBC5714F404419FA186B142C675B90087F4
              Function 00FA2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 46 fa2b60-fa2b6c LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: da4f0c0c48aaf92bd89fb117e7b18152bd100f391a33d8b7fac8db75b6099644
              • Instruction ID: 778b7ceb9fd645a1aa591e683abfe89eff6a0bbfc408362a0183e6bc92bd035e
              • Opcode Fuzzy Hash: da4f0c0c48aaf92bd89fb117e7b18152bd100f391a33d8b7fac8db75b6099644
              • Instruction Fuzzy Hash: C590026120240013420571598814656400E87E0341B55C032E10155D0EC9298992B925
              Function 00FA2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 47 fa2c70-fa2c7c LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 0bda2e9ddc2be9dbd378e8f14e1dd7c1bb03bd83e87eae9762e1df4c6395dc88
              • Instruction ID: 8af42a157bced598b53946c69341dcbfe877e9aaa065210cc6926d1ba234737a
              • Opcode Fuzzy Hash: 0bda2e9ddc2be9dbd378e8f14e1dd7c1bb03bd83e87eae9762e1df4c6395dc88
              • Instruction Fuzzy Hash: 1A90023120148812D2107159C80478A000D87D0341F59C422A4425698E8A998992B921
              Function 00FA2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 48 fa2df0-fa2dfc LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 7cd76b7972a0dcaf54c09d97b7a1a5ca2bc2ebcc9f12bea7c2f2a9bec237c493
              • Instruction ID: 9517d00eab424d98d8442838862014c51fc2a734ac2b24bdb3d10d9f15128336
              • Opcode Fuzzy Hash: 7cd76b7972a0dcaf54c09d97b7a1a5ca2bc2ebcc9f12bea7c2f2a9bec237c493
              • Instruction Fuzzy Hash: 7290023120140423D21171598904747000D87D0381F95C423A0425598E9A5A8A53F921
              Function 00FA35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 49 fa35c0-fa35cc LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 7452d8bc660806c42174e3745beb7fd4d8fd05f950eb90e498531353c9e28b6d
              • Instruction ID: 68e663891a30bffe9fd1c570e1488b62b4574376199ce01a593b97010f99aa48
              • Opcode Fuzzy Hash: 7452d8bc660806c42174e3745beb7fd4d8fd05f950eb90e498531353c9e28b6d
              • Instruction Fuzzy Hash: FF90023160550412D20071598914746100D87D0341F65C422A04255A8E8B998A52BDA2
              Function 0042CE53 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 27 42ce53-42ce97 call 404c23 call 42dd03 RtlFreeHeap
              APIs
              • RtlFreeHeap.NTDLL(00000000,00000004,00000000,8D03EB6A,00000007,00000000,00000004,00000000,00417631,000000F4), ref: 0042CE92
              Memory Dump Source
              • Source File: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_400000_906982022050120220531MES_S Quote.jbxd
              Yara matches
              Similarity
              • API ID: FreeHeap
              • String ID:
              • API String ID: 3298025750-0
              • Opcode ID: e1331cc36c5945004700624128acb5afa1fdd07976f8d13c6fbc2c78a299b5af
              • Instruction ID: d85744db10bdecab0864699f22691b615d7124c726db26a9576ad4e24232d768
              • Opcode Fuzzy Hash: e1331cc36c5945004700624128acb5afa1fdd07976f8d13c6fbc2c78a299b5af
              • Instruction Fuzzy Hash: C3E092722046047BE610EF59EC41FDB73ACEFC8714F000419FA08A7241C670BD108BB4
              Function 0042CE03 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 22 42ce03-42ce44 call 404c23 call 42dd03 RtlAllocateHeap
              APIs
              • RtlAllocateHeap.NTDLL(00424F1F,?,?,00424F1F,00000000,?,?,00424F1F,?,00000104), ref: 0042CE3F
              Memory Dump Source
              • Source File: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_400000_906982022050120220531MES_S Quote.jbxd
              Yara matches
              Similarity
              • API ID: AllocateHeap
              • String ID:
              • API String ID: 1279760036-0
              • Opcode ID: 853d8483f0a569b97e05312c38e78c3643b957040a3357300215ab518641cb18
              • Instruction ID: 4e8d72455eb196b7fd05b5b43cd6f1ce286c666e83c0fe79fcdfc952d3acb63a
              • Opcode Fuzzy Hash: 853d8483f0a569b97e05312c38e78c3643b957040a3357300215ab518641cb18
              • Instruction Fuzzy Hash: B6E092726046047BD610EF59EC42FDB73ACDFC8710F004419F908A7241C771B91087B8
              Function 0042CEA3 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 37 42cea3-42ced9 call 404c23 call 42dd03 ExitProcess
              APIs
              Memory Dump Source
              • Source File: 00000005.00000002.2299413776.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_400000_906982022050120220531MES_S Quote.jbxd
              Yara matches
              Similarity
              • API ID: ExitProcess
              • String ID:
              • API String ID: 621844428-0
              • Opcode ID: 18fd83222f856daeec0d0feb39f52adac9340f236ad58e71794387deb31dfb4b
              • Instruction ID: 1d7481a278b1beaf86daa700f85c17531e133debc4042f65be51d634c678f4f4
              • Opcode Fuzzy Hash: 18fd83222f856daeec0d0feb39f52adac9340f236ad58e71794387deb31dfb4b
              • Instruction Fuzzy Hash: D5E086362046147BD110FB5AEC41FD7775CDFC5715F414419FA08A7141C675BA1187F4
              Function 00FA2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 42 fa2c0a-fa2c0f 43 fa2c1f-fa2c26 LdrInitializeThunk 42->43 44 fa2c11-fa2c18 42->44
              APIs
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 8858fe62f8f4be6ce78cc6cdc08400da8445066f395528a0640666d87d729efe
              • Instruction ID: 90170a90549b85eb1ae09ca98a9ab9a5d2430bd9b7a23c6b82b662d040512e8a
              • Opcode Fuzzy Hash: 8858fe62f8f4be6ce78cc6cdc08400da8445066f395528a0640666d87d729efe
              • Instruction Fuzzy Hash: E3B09B71D015C5D5DB51E7644A0871B79046BD1761F15C072D2030681F473CC5D1F575

              Non-executed Functions

              Function 00FE2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
              • API String ID: 0-2160512332
              • Opcode ID: 84f23d41cf2f637790b24a4267bd6425707bb0a92871f18b514c3c316a17460a
              • Instruction ID: b95be93d025998fae8c0ad9ecf7cd0cd8fa6ca5dffedfee5c1da7641326353e9
              • Opcode Fuzzy Hash: 84f23d41cf2f637790b24a4267bd6425707bb0a92871f18b514c3c316a17460a
              • Instruction Fuzzy Hash: 5292C071A04381AFE760CF25CC85B6BB7E8BB84720F04492DFA94D7291E774E944EB52
              Function 00F98620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
              Download Yara Rule
              Strings
              • Thread identifier, xrefs: 00FD553A
              • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 00FD540A, 00FD5496, 00FD5519
              • undeleted critical section in freed memory, xrefs: 00FD542B
              • Critical section address., xrefs: 00FD5502
              • Critical section address, xrefs: 00FD5425, 00FD54BC, 00FD5534
              • double initialized or corrupted critical section, xrefs: 00FD5508
              • 8, xrefs: 00FD52E3
              • Address of the debug info found in the active list., xrefs: 00FD54AE, 00FD54FA
              • Invalid debug info address of this critical section, xrefs: 00FD54B6
              • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 00FD54E2
              • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 00FD54CE
              • Thread is in a state in which it cannot own a critical section, xrefs: 00FD5543
              • Critical section debug info address, xrefs: 00FD541F, 00FD552E
              • corrupted critical section, xrefs: 00FD54C2
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
              • API String ID: 0-2368682639
              • Opcode ID: b36e04a27e4482893ce9c618b8de56fc1edbb8453218f896b0643e2aaa06719c
              • Instruction ID: eaeb93d6a9f5f94a82a86f983cac74755a115df821821a5bf751bbb3be9b6aaf
              • Opcode Fuzzy Hash: b36e04a27e4482893ce9c618b8de56fc1edbb8453218f896b0643e2aaa06719c
              • Instruction Fuzzy Hash: 4F81AEB1E00748EFDB20CF94C841BAEBBB6BB08B54F24411AF905BB280D775AD45EB51
              Function 00F929F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
              Download Yara Rule
              Strings
              • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 00FD2602
              • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 00FD22E4
              • @, xrefs: 00FD259B
              • RtlpResolveAssemblyStorageMapEntry, xrefs: 00FD261F
              • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 00FD2412
              • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 00FD2409
              • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 00FD2498
              • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 00FD2506
              • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 00FD2624
              • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 00FD24C0
              • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 00FD25EB
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
              • API String ID: 0-4009184096
              • Opcode ID: fc887e4cde7d23e287c81e72c6c80cc79eb646667ef3339086dff3e7115a1a23
              • Instruction ID: 690dca118aabf242a576773ee8486752485482800321df4d9531ea96e17ae99f
              • Opcode Fuzzy Hash: fc887e4cde7d23e287c81e72c6c80cc79eb646667ef3339086dff3e7115a1a23
              • Instruction Fuzzy Hash: 8B0272F2D002289BEF61DB14CC81BDDB7B8AF55314F0441DAAA09A7241DB749F84EF99
              Function 01008B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
              • API String ID: 0-2515994595
              • Opcode ID: 53579b43033335fc858399071e7abba2f4d371ebf3af620d14b35b61c1fcc54d
              • Instruction ID: f56ae4bac3671efd5e5a553f19d3fba44cd54f647389f07320e12207885c0097
              • Opcode Fuzzy Hash: 53579b43033335fc858399071e7abba2f4d371ebf3af620d14b35b61c1fcc54d
              • Instruction Fuzzy Hash: D451C4B19083059BE736EF188849BABBBE8FF84350F148A5FF99583181E770D504D792
              Function 01010274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
              • API String ID: 0-1700792311
              • Opcode ID: b486a415281ca1089b9b270edf9f4c70a8f76e236f29c687390c00a09af44c63
              • Instruction ID: 2ed4fd44619a60e12790c0e9143987238edb53be23f0fdd3dcb156dd5bc09dd8
              • Opcode Fuzzy Hash: b486a415281ca1089b9b270edf9f4c70a8f76e236f29c687390c00a09af44c63
              • Instruction Fuzzy Hash: E9D1CB31600685DFDB22DF68C841AAEBBF1FF4A710F088099F9C59B65AD739D984DB10
              Function 00FE89B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
              Download Yara Rule
              Strings
              • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 00FE8A67
              • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 00FE8A3D
              • HandleTraces, xrefs: 00FE8C8F
              • VerifierDebug, xrefs: 00FE8CA5
              • VerifierFlags, xrefs: 00FE8C50
              • AVRF: -*- final list of providers -*- , xrefs: 00FE8B8F
              • VerifierDlls, xrefs: 00FE8CBD
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
              • API String ID: 0-3223716464
              • Opcode ID: 4cce14ba025b015a588df9da22047f25a271ed441e567995fe89ac6b23bb0ef0
              • Instruction ID: cb6208a096968d032ac4d7d20576f4d89e5ace865e0f7d7164a4d6d4273b7bcb
              • Opcode Fuzzy Hash: 4cce14ba025b015a588df9da22047f25a271ed441e567995fe89ac6b23bb0ef0
              • Instruction Fuzzy Hash: D9916D72645791EFD721FF29CC81B1B77A5EB85790F140418F9896B281CB78EC02E7A2
              Function 00F6EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
              • API String ID: 0-1109411897
              • Opcode ID: b464d40c78abd3c57a0342d66c9a44ec83d22986d84b23dd60f818d4a5f04747
              • Instruction ID: 6cd08eabd05ee06bc649be3acfebfff168333eab10c38c33c0db9faeeba40b76
              • Opcode Fuzzy Hash: b464d40c78abd3c57a0342d66c9a44ec83d22986d84b23dd60f818d4a5f04747
              • Instruction Fuzzy Hash: 0FA26C75E0562ACFDB64CF14CD99BA9B7B1AF45310F2442E9D80DA7290DB31AE85EF00
              Function 00F963FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
              • API String ID: 0-792281065
              • Opcode ID: 889d8511e72dec88a52a5e71a1e4e6d6762e9264bbdec56283a69ddd13c42fe7
              • Instruction ID: 3801119917bf616ba2692abff4a2a3b716c0cf408c9790729238fc667c31a641
              • Opcode Fuzzy Hash: 889d8511e72dec88a52a5e71a1e4e6d6762e9264bbdec56283a69ddd13c42fe7
              • Instruction Fuzzy Hash: 51913771E003159BEB35DF58DC46BAA7BA1BB41B24F18012AF940AB3C1D779AC41FB91
              Function 00F5645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00FB9A11, 00FB9A3A
              • apphelp.dll, xrefs: 00F56496
              • Getting the shim engine exports failed with status 0x%08lx, xrefs: 00FB9A01
              • LdrpInitShimEngine, xrefs: 00FB99F4, 00FB9A07, 00FB9A30
              • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 00FB9A2A
              • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 00FB99ED
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
              • API String ID: 0-204845295
              • Opcode ID: 1626673a0827db2d76281725bae6d4f620c1c1343625d73e3b2d621918ed8749
              • Instruction ID: d97340d517761305aaece9c519cde6963be2a114fb42a63602f2d0a4a0f1fe54
              • Opcode Fuzzy Hash: 1626673a0827db2d76281725bae6d4f620c1c1343625d73e3b2d621918ed8749
              • Instruction Fuzzy Hash: 1051E1716483049FD320EF24CC42BAB7BE8FB84754F40491AFA959B191D778E904EB93
              Function 00F9C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
              Download Yara Rule
              Strings
              • LdrpInitializeProcess, xrefs: 00F9C6C4
              • minkernel\ntdll\ldrinit.c, xrefs: 00F9C6C3
              • Loading import redirection DLL: '%wZ', xrefs: 00FD8170
              • Unable to build import redirection Table, Status = 0x%x, xrefs: 00FD81E5
              • LdrpInitializeImportRedirection, xrefs: 00FD8177, 00FD81EB
              • minkernel\ntdll\ldrredirect.c, xrefs: 00FD8181, 00FD81F5
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
              • API String ID: 0-475462383
              • Opcode ID: 67c53bf3019ab5bc3b4b68da9f4a89a2667389ee29263137bfdc94a234acb07b
              • Instruction ID: b66adc755fc7a9950dffe3e2a76cf97fdd140967ea100822f3063f6ed697395e
              • Opcode Fuzzy Hash: 67c53bf3019ab5bc3b4b68da9f4a89a2667389ee29263137bfdc94a234acb07b
              • Instruction Fuzzy Hash: 0B31F7716443459BD324EF28DC46E1B7795FFC4B60F040568F884AB3D2DA28ED05E7A2
              Function 00F92674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
              Download Yara Rule
              Strings
              • RtlGetAssemblyStorageRoot, xrefs: 00FD2160, 00FD219A, 00FD21BA
              • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 00FD219F
              • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 00FD2178
              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 00FD21BF
              • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 00FD2180
              • SXS: %s() passed the empty activation context, xrefs: 00FD2165
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
              • API String ID: 0-861424205
              • Opcode ID: d80aad543ad5f0b01ef1a9146cc08bc595f08f8432eea0d49e8b122d556fc0e7
              • Instruction ID: 54ee6ab185872a6769adf7ee6e1a029a5702ed6d76c4e24846c9ee8333584a08
              • Opcode Fuzzy Hash: d80aad543ad5f0b01ef1a9146cc08bc595f08f8432eea0d49e8b122d556fc0e7
              • Instruction Fuzzy Hash: A031E532F4032477FB219A958C85F5E7A69DBA5B50F19406ABA04BB281D370DE00F6E2
              Function 00FA096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
              Download Yara Rule
              APIs
                • Part of subcall function 00FA2DF0: LdrInitializeThunk.NTDLL ref: 00FA2DFA
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA0BA3
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA0BB6
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA0D60
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA0D74
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
              • String ID:
              • API String ID: 1404860816-0
              • Opcode ID: 0478cde6aac8655f50641cf0adc2b84787adb6b6cd8416e5be20c4128d4ec362
              • Instruction ID: dfaaacc936b7a2b28423cccc474f9ac33783388cd85b346ba002f698242cbdcc
              • Opcode Fuzzy Hash: 0478cde6aac8655f50641cf0adc2b84787adb6b6cd8416e5be20c4128d4ec362
              • Instruction Fuzzy Hash: F1427EB2900715DFDB20CF64C881BAAB7F5FF05310F1445AAE949DB241DB74AA84EF61
              Function 00F6A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
              • API String ID: 0-379654539
              • Opcode ID: de4e6a050f2067f0cf56bcb8f3a2e463550f0c827a7118994abcd943d7912628
              • Instruction ID: 4f40497d74a3907b2374893b6a5d895f66b91f13b678f973bdcace9619614b50
              • Opcode Fuzzy Hash: de4e6a050f2067f0cf56bcb8f3a2e463550f0c827a7118994abcd943d7912628
              • Instruction Fuzzy Hash: 23C166755083868FC711CF28C540B6AB7E4FF84714F04896AF896AB261E778CA49EF53
              Function 00F98402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00F98421
              • LdrpInitializeProcess, xrefs: 00F98422
              • @, xrefs: 00F98591
              • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 00F9855E
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
              • API String ID: 0-1918872054
              • Opcode ID: 3ffcfbb878b652b1ed3c867af31f27cbaac45f91364a4ca2c4ceed03f8a62d63
              • Instruction ID: 70a612520a61db80f3603776ca4aa14da1716dcbfe6cb56a7afda2e6c04d88e4
              • Opcode Fuzzy Hash: 3ffcfbb878b652b1ed3c867af31f27cbaac45f91364a4ca2c4ceed03f8a62d63
              • Instruction Fuzzy Hash: B891BEB1508340AFEB21DF64CC41FABB7E8BF857A0F44492EF58492141E734D909AB62
              Function 00F9273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
              Download Yara Rule
              Strings
              • .Local, xrefs: 00F928D8
              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 00FD22B6
              • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 00FD21D9, 00FD22B1
              • SXS: %s() passed the empty activation context, xrefs: 00FD21DE
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
              • API String ID: 0-1239276146
              • Opcode ID: 57c904c25d582b0fc4960e6373f4afe080bec8e6672040fa2561c25cc034eca2
              • Instruction ID: 4d13b6e8b53a697bafb588b4c41119f8f895d6fd2757fec36935ecd447d141f2
              • Opcode Fuzzy Hash: 57c904c25d582b0fc4960e6373f4afe080bec8e6672040fa2561c25cc034eca2
              • Instruction Fuzzy Hash: F6A19131D00229ABEF65CF54DC84BA9B3B1BF58324F2541EAE808A7351D7309E80EF91
              Function 00F94AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON
              Download Yara Rule
              Strings
              • SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 00FD3456
              • SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 00FD3437
              • SXS: %s() called with invalid flags 0x%08lx, xrefs: 00FD342A
              • RtlDeactivateActivationContext, xrefs: 00FD3425, 00FD3432, 00FD3451
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
              • API String ID: 0-1245972979
              • Opcode ID: cee5160b126a9179515d92267800648f91a14a05b8f3a6ca078e96631b513a5b
              • Instruction ID: a7c23c04a003f42bebeb7786de791031282fe2136556e4828ec71ddf6053b000
              • Opcode Fuzzy Hash: cee5160b126a9179515d92267800648f91a14a05b8f3a6ca078e96631b513a5b
              • Instruction Fuzzy Hash: 98615B32A40B119FDB22CF18C841F2AB7A1EF91B60F18451AF9559B381D738FD01EB92
              Function 00F664AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
              Download Yara Rule
              Strings
              • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 00FC106B
              • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 00FC0FE5
              • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 00FC1028
              • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 00FC10AE
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
              • API String ID: 0-1468400865
              • Opcode ID: b37abb13d03d7b2abbed1bf30a552f41e6356b442c9e7b0417092e380ce33432
              • Instruction ID: b5eafde329260e7048152e8f5ba27dbaa265584c69e78aacdc622c8929250049
              • Opcode Fuzzy Hash: b37abb13d03d7b2abbed1bf30a552f41e6356b442c9e7b0417092e380ce33432
              • Instruction Fuzzy Hash: D371CFB19043459FCB20DF14C886F9B7FA8AF85764F040468F9498B186D778D989EBD2
              Function 00F8245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00FCA9A2
              • LdrpDynamicShimModule, xrefs: 00FCA998
              • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 00FCA992
              • apphelp.dll, xrefs: 00F82462
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
              • API String ID: 0-176724104
              • Opcode ID: 11ee87239ff51c3436cbe34fc9a84605ad18df178392882b8d166569e7c2c88d
              • Instruction ID: 083bf3c1d4c2e13fd0bfcd87431c588693f2fa217dc5b30aab6bbe7c47a21913
              • Opcode Fuzzy Hash: 11ee87239ff51c3436cbe34fc9a84605ad18df178392882b8d166569e7c2c88d
              • Instruction Fuzzy Hash: DE313772A00306EBCB30AF599986F6BB7B4FB80718F25001DF840AB245C779AC81E791
              Function 00F729A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
              Download Yara Rule
              Strings
              • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 00F7327D
              • HEAP: , xrefs: 00F73264
              • HEAP[%wZ]: , xrefs: 00F73255
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
              • API String ID: 0-617086771
              • Opcode ID: 5ec0e0a5268afdd3458e23bc94ea3db712fd269dc1f667bed793b474c9b964e4
              • Instruction ID: 0180f6585960aba2cad07d43eebce09bf87c1ea4599fa22c6fddd25894ac9740
              • Opcode Fuzzy Hash: 5ec0e0a5268afdd3458e23bc94ea3db712fd269dc1f667bed793b474c9b964e4
              • Instruction Fuzzy Hash: 7992AD71E04249AFDB25CF68C440BADBBF1FF49310F14C05AE889AB351D739AA45EB51
              Function 00F70770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
              • API String ID: 0-4253913091
              • Opcode ID: ac13b4fbc41b5385e4a6a240ad006b383407433cb5a259e37af8431cfba78057
              • Instruction ID: cb3c91f128ed7f566885ae41a04544c5cfb14372b6f94245193d864d3a478054
              • Opcode Fuzzy Hash: ac13b4fbc41b5385e4a6a240ad006b383407433cb5a259e37af8431cfba78057
              • Instruction Fuzzy Hash: FBF1BB31A00606DFDB14CF68C985FAAB7B5FF44710F248169E44A9B381DB34ED81EB92
              Function 00F86962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: $@
              • API String ID: 0-1077428164
              • Opcode ID: a5e1c131a1d4c806fc2203076ee0285e0cd392c260bdfd98fc6eb6b844e4fed6
              • Instruction ID: 195c8d5e0a46a94956133be6c984aec657fc179dbb9cbbfddf3bbc3f10060f21
              • Opcode Fuzzy Hash: a5e1c131a1d4c806fc2203076ee0285e0cd392c260bdfd98fc6eb6b844e4fed6
              • Instruction Fuzzy Hash: 41C29072A0C3419FDB25DF24C881BABBBE5AF88754F14892DF989C7241D734D805EB92
              Function 00F5A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: FilterFullPath$UseFilter$\??\
              • API String ID: 0-2779062949
              • Opcode ID: 5c095ab5f54df2610de3c20c3bc043d72ebff6016e299727951ededa8c8b64b9
              • Instruction ID: f77da04e3da444264fd941909e2b370eab91f71429facf4a6c4afe0e1b9b6fb8
              • Opcode Fuzzy Hash: 5c095ab5f54df2610de3c20c3bc043d72ebff6016e299727951ededa8c8b64b9
              • Instruction Fuzzy Hash: 32A17C72D112299BDB31DF64CC89BEAB7B8EF44710F1441EAE908A7250D7399E84DF90
              Function 00F80BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00FCA121
              • Failed to allocated memory for shimmed module list, xrefs: 00FCA10F
              • LdrpCheckModule, xrefs: 00FCA117
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
              • API String ID: 0-161242083
              • Opcode ID: e23a4a1d483e8dd29162c9f0dbea46e302edabbb8a78944cd6a1df25d22d96e7
              • Instruction ID: 53a6fee2921f8225ce928773dee57e656e454cae1c32601f815c84f568ea46bc
              • Opcode Fuzzy Hash: e23a4a1d483e8dd29162c9f0dbea46e302edabbb8a78944cd6a1df25d22d96e7
              • Instruction Fuzzy Hash: 3771DE71E002099FCB64EF68CD42BBEB7B4FB44714F54412DE842AB241EB39AD45EB51
              Function 00F70A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
              • API String ID: 0-1334570610
              • Opcode ID: 3a2372c71bf70ff1aa38a05774febe4ba2ff824aff519b74608303726f26eff9
              • Instruction ID: 8bbac06cde21c8cb93ec75626c0e9e10f7d455659863e38045e50b7527852c6d
              • Opcode Fuzzy Hash: 3a2372c71bf70ff1aa38a05774febe4ba2ff824aff519b74608303726f26eff9
              • Instruction Fuzzy Hash: 5461B071600342DFDB28CF28C541B6ABBE1FF45714F14855EE889CB282CB74E981EB92
              Function 00F9C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00FD82E8
              • Failed to reallocate the system dirs string !, xrefs: 00FD82D7
              • LdrpInitializePerUserWindowsDirectory, xrefs: 00FD82DE
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
              • API String ID: 0-1783798831
              • Opcode ID: ed97814f3cb33a856d41504aa0696d22bfc19c6a28ebaf99b977c9f01e5d872a
              • Instruction ID: e542277dd261458b153d12e57637e4a1660b0c05b1783fc4b97d6916b0eeef52
              • Opcode Fuzzy Hash: ed97814f3cb33a856d41504aa0696d22bfc19c6a28ebaf99b977c9f01e5d872a
              • Instruction Fuzzy Hash: 6741B771944304ABDB30EB64DC45B5B77E8EF48760F44492AF988D7291EB79D800EB92
              Function 0101C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
              Download Yara Rule
              Strings
              • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0101C1C5
              • PreferredUILanguages, xrefs: 0101C212
              • @, xrefs: 0101C1F1
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
              • API String ID: 0-2968386058
              • Opcode ID: d6329d00f5df33132740393a0954870f9a84699b5a76c5656a7c1e65c2101ceb
              • Instruction ID: aad20698904e2c3a8b5b7017df66fc966416be52946e98979a84e58d8dff3ca2
              • Opcode Fuzzy Hash: d6329d00f5df33132740393a0954870f9a84699b5a76c5656a7c1e65c2101ceb
              • Instruction Fuzzy Hash: 10418272E40209EBEF51DAD8CD41FEEBBF8AB04700F04406AEA49B7284D778DE449B50
              Function 00FF4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
              • API String ID: 0-1373925480
              • Opcode ID: f61296ae08122abea480b476d218b52240eef53a4d44e40bc28cd5d0e0ff3e67
              • Instruction ID: 5ba590454568013fb9447c623ff6e05807f82f2b07de06e4bcee301358e4d23c
              • Opcode Fuzzy Hash: f61296ae08122abea480b476d218b52240eef53a4d44e40bc28cd5d0e0ff3e67
              • Instruction Fuzzy Hash: 7541F632D0429C8BDB22DB95CC40BBEB7B4FF45350F24046AEA01EB7A1D738A941EB11
              Function 00FE4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrredirect.c, xrefs: 00FE4899
              • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 00FE4888
              • LdrpCheckRedirection, xrefs: 00FE488F
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
              • API String ID: 0-3154609507
              • Opcode ID: c6df477114ad95bc4653e9a6be2b26f7792b2ca8124ede25cca6ceb7f6299516
              • Instruction ID: cc76760b4c48697926f5c29644b78ba8b8396e50d0777b4aca3d45e90db59919
              • Opcode Fuzzy Hash: c6df477114ad95bc4653e9a6be2b26f7792b2ca8124ede25cca6ceb7f6299516
              • Instruction Fuzzy Hash: EB419032E047909BCB21CE6AD840A267BE5BF89760F05065DEC9997251D735FD00EBD1
              Function 00F70BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
              • API String ID: 0-2558761708
              • Opcode ID: f29dd1952e5ed39aa2688c2968974d3ffaaaf68cca6406e3b4d132f4fdac1ea8
              • Instruction ID: 88b6bca644af96ae95c2be8fabd1de9686ce550b3ee5439a196ed2ba68b909e3
              • Opcode Fuzzy Hash: f29dd1952e5ed39aa2688c2968974d3ffaaaf68cca6406e3b4d132f4fdac1ea8
              • Instruction Fuzzy Hash: AC119331315542DFD71CD618C852F6AB3A4AF81B26F24816EE409CB251DB34ECC4E752
              Function 00FE20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00FE2104
              • Process initialization failed with status 0x%08lx, xrefs: 00FE20F3
              • LdrpInitializationFailure, xrefs: 00FE20FA
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
              • API String ID: 0-2986994758
              • Opcode ID: 6c02abf5d7fae5f49f6ded7a7082a03e46c4d60d636cbda9b80a362e52221351
              • Instruction ID: ae64405c7b5cfb01e96c12124c86e52088b48f4015a4ae00aac26290b20d849e
              • Opcode Fuzzy Hash: 6c02abf5d7fae5f49f6ded7a7082a03e46c4d60d636cbda9b80a362e52221351
              • Instruction Fuzzy Hash: 1AF0C871A4034C7BE724E649CC43F9A3B6CFB41B54F500066FA406B282D6F8AA40EA51
              Function 00F703E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: #%u
              • API String ID: 48624451-232158463
              • Opcode ID: 1b66f9dbef81844dedf044a324e4b93f03ddcf58421dc81b2e620beb606d3afd
              • Instruction ID: be7f95818d1767f57d73466218e6e7d0d244d5fccd6eaf0ffc1a5f3ca6a14b20
              • Opcode Fuzzy Hash: 1b66f9dbef81844dedf044a324e4b93f03ddcf58421dc81b2e620beb606d3afd
              • Instruction Fuzzy Hash: DA715C72A0014A9FDB01DF98C991FAEB7B8EF08714F144069E905E7251EB38EE41DB61
              Function 00F6A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
              Download Yara Rule
              Strings
              • LdrResSearchResource Enter, xrefs: 00F6AA13
              • LdrResSearchResource Exit, xrefs: 00F6AA25
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
              • API String ID: 0-4066393604
              • Opcode ID: cc375e6f28ec9710b7b7008728103a84ce7d0054e0a39069ee4918ba44bcaad8
              • Instruction ID: 2f85bbcbce02b8de171a6de97c164d9f743003d86a3c76be4dcb9c05dcefcbf1
              • Opcode Fuzzy Hash: cc375e6f28ec9710b7b7008728103a84ce7d0054e0a39069ee4918ba44bcaad8
              • Instruction Fuzzy Hash: 83E17F72E00219EFDB219E99CA81BAEB7B9FF44364F14402AE901E7251D7789D40FF52
              Function 0102A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: `$`
              • API String ID: 0-197956300
              • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
              • Instruction ID: b47132bcc6a5d88cea9777ad00ba3dbbb19dd740be35bc8242dd2f4c2947e4f0
              • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
              • Instruction Fuzzy Hash: 49C1CD31304352DBEB24CE28C845B6BBBE5AFC8318F088A6DF6D68B691DB74D505CB41
              Function 00FDE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID: Legacy$UEFI
              • API String ID: 2994545307-634100481
              • Opcode ID: 6e7f9a13e8bd3ac169b1959f70f0a9071240ebd4a09a425429e0a4bd3e53c5c5
              • Instruction ID: 510f5d3883c251eacd90100ac61ad1954304e8679f389f0ac588f0b3b20ded30
              • Opcode Fuzzy Hash: 6e7f9a13e8bd3ac169b1959f70f0a9071240ebd4a09a425429e0a4bd3e53c5c5
              • Instruction Fuzzy Hash: 72615D72E006189FDB14EFA8C841BADBBB6FB44700F24406EE559EB391D731AD40EB50
              Function 010043D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: @$MUI
              • API String ID: 0-17815947
              • Opcode ID: a385e193909df7f1189a90a935cc103fce5c95cc299e168d5d3dff8474675a0b
              • Instruction ID: d9a8bcad32dcdd8811fc0338636d3322f342727af63f86dfe487e16652d7dc63
              • Opcode Fuzzy Hash: a385e193909df7f1189a90a935cc103fce5c95cc299e168d5d3dff8474675a0b
              • Instruction Fuzzy Hash: E3513AB1E0021DAFEB11DFA9CC81AEEBBB8EB44754F100529E651F7281D735AD05DB60
              Function 00F604E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
              Download Yara Rule
              Strings
              • kLsE, xrefs: 00F60540
              • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 00F6063D
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
              • API String ID: 0-2547482624
              • Opcode ID: 9745cba96141829cbc66135b70eee7223e32ee8597ad2c1c2a988fcf2ce56c58
              • Instruction ID: 201ea46e5a9ed5e8bdff641a4efa698ca33a2229899ff193c8300fa60c54b2f3
              • Opcode Fuzzy Hash: 9745cba96141829cbc66135b70eee7223e32ee8597ad2c1c2a988fcf2ce56c58
              • Instruction Fuzzy Hash: 9A51F271A047468FC724EF24C4406A7B7E4AF84324F24483EE9DA87281EB75E945DFA2
              Function 00F6A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
              Download Yara Rule
              Strings
              • RtlpResUltimateFallbackInfo Enter, xrefs: 00F6A2FB
              • RtlpResUltimateFallbackInfo Exit, xrefs: 00F6A309
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
              • API String ID: 0-2876891731
              • Opcode ID: 5151f0dd3d9db9d37c92737c2f5b58c51b74291f544a962b40cf0d7a573f61af
              • Instruction ID: 6fdc02f3a0c97fa4b33c8e95d80257f43b4e9cd63556d359af932273f3616e0f
              • Opcode Fuzzy Hash: 5151f0dd3d9db9d37c92737c2f5b58c51b74291f544a962b40cf0d7a573f61af
              • Instruction Fuzzy Hash: 0941AD31A04649DBDB21CF59C942B6A77B4FF85720F2440A9E904EB391E376DE40EB52
              Function 00F9A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID: Cleanup Group$Threadpool!
              • API String ID: 2994545307-4008356553
              • Opcode ID: 486f2be800b12e56f1eaa2af42ddc5c8a8c17186a124cb1fc607ef465cf616f4
              • Instruction ID: 9950356a3cdeeed2b6fa828d2aa03efe44412a48e661dbab978be608d9aecaca
              • Opcode Fuzzy Hash: 486f2be800b12e56f1eaa2af42ddc5c8a8c17186a124cb1fc607ef465cf616f4
              • Instruction Fuzzy Hash: 4801D1B2240704AFE711DF14CD46B1677E8E784B26F058939B548C7190E738D804EB96
              Function 00F6C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: MUI
              • API String ID: 0-1339004836
              • Opcode ID: cb57717c3922391e7dce3d66960a88f4c311a08b880645d2f715708d1de42991
              • Instruction ID: dadbdaa7395f3bb825cac5222edcbf7a17f267bf121ba6d401a62a5a8da82d65
              • Opcode Fuzzy Hash: cb57717c3922391e7dce3d66960a88f4c311a08b880645d2f715708d1de42991
              • Instruction Fuzzy Hash: F0826D75E002589FDB24CFA9C880BADB7B1FF49310F248169E899AB351DB349D41EF90
              Function 00FE6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID: 0-3916222277
              • Opcode ID: c2abfdfa674026e7c5ea45fc0bbacfe7365919e279073cffcb8b5e497c440846
              • Instruction ID: 746347a6b1551e0e39b08d8b6ff8293013c91d454e31db7c0b5a3356adb35418
              • Opcode Fuzzy Hash: c2abfdfa674026e7c5ea45fc0bbacfe7365919e279073cffcb8b5e497c440846
              • Instruction Fuzzy Hash: 8E9161B2A40259AFDB21DB95CD85FEEB7B8EF18B50F144065F600EB191D774AD00EBA0
              Function 0100E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID: 0-3916222277
              • Opcode ID: 2f6e165dc3fb2ceacab3a6b4057b870f733c689e6c773ceb278bb52751d57858
              • Instruction ID: 3b2878e26d4e761fec3b0c29a2f826c2f798a4c556c7ac01078368f24a9f0be0
              • Opcode Fuzzy Hash: 2f6e165dc3fb2ceacab3a6b4057b870f733c689e6c773ceb278bb52751d57858
              • Instruction Fuzzy Hash: 8491CE72901608BEEB23ABA4DC44FEFBBB9EF85740F104429F544B7291DB789901DB91
              Function 00F9A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: GlobalTags
              • API String ID: 0-1106856819
              • Opcode ID: ca6569ac104ea4941e9812f262e7a0060de5049ffb4948dff95b1698b78a68ef
              • Instruction ID: 67d4c8fb4003b746af13e00c100eafc68be0c45dd16d1be789c48f81386711c2
              • Opcode Fuzzy Hash: ca6569ac104ea4941e9812f262e7a0060de5049ffb4948dff95b1698b78a68ef
              • Instruction Fuzzy Hash: EF716C75E0020A9FDF28DF98C5906ADBBB2BF58714F28812AE805E7340DB359D41EB60
              Function 01004978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: .mui
              • API String ID: 0-1199573805
              • Opcode ID: b9c86163012d763a1a7ae533aa2b5071848f2481411facd181f69454a99039dd
              • Instruction ID: 2a9b6ad7be15bc2dd3da30dbc0f267668cad2aacfa4c1c8f53ac4b4274ad8f28
              • Opcode Fuzzy Hash: b9c86163012d763a1a7ae533aa2b5071848f2481411facd181f69454a99039dd
              • Instruction Fuzzy Hash: 8451DB72D006259BEF11DF99D840AAEBBB4BF09B10F054169FB51F7291D3749D01CBA8
              Function 00F7E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: EXT-
              • API String ID: 0-1948896318
              • Opcode ID: 3ee979f4e4eabd39c832daf02e87e7b34fbd7bfd7648f5cb5fcc879708ad4a13
              • Instruction ID: 22f7e904f2a08340cc4f43d18097576c7e16869ab89e078ed19692f6e3dea5e0
              • Opcode Fuzzy Hash: 3ee979f4e4eabd39c832daf02e87e7b34fbd7bfd7648f5cb5fcc879708ad4a13
              • Instruction Fuzzy Hash: 4A41A1729083019BD714DA74CC41B6BB7E8AF8CB14F44896FF998D7180E678D909A793
              Function 00FDC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: BinaryHash
              • API String ID: 0-2202222882
              • Opcode ID: e33abf95a2c2b2b181cd20527c2f7961804e0a80729a3fc030a1255ecbe922b9
              • Instruction ID: befd333b97f9a26b5f2e7f88a18cea07ed6e5cdaf7d053534ce25c34df4598e6
              • Opcode Fuzzy Hash: e33abf95a2c2b2b181cd20527c2f7961804e0a80729a3fc030a1255ecbe922b9
              • Instruction Fuzzy Hash: 054194F1D0012DABDB21DA60CC81FDEB77DAB45714F0445A6EA08AB241DB749E88DFE4
              Function 00FF6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: #
              • API String ID: 0-1885708031
              • Opcode ID: 15de0f61a48937624a3cffa5f5baf6983bb21b463427f92f2afeaa0ba752e1d0
              • Instruction ID: c9cf545c31bb8e08a63a8ec397bf3e9493b910546ea4983ac10d88af1f933b84
              • Opcode Fuzzy Hash: 15de0f61a48937624a3cffa5f5baf6983bb21b463427f92f2afeaa0ba752e1d0
              • Instruction Fuzzy Hash: 92310531A0071C9ADB21DB68CC50BBE77A8DF45715F104029EAC1EB292CFA9ED05EB50
              Function 00FDCA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: BinaryName
              • API String ID: 0-215506332
              • Opcode ID: 940ccbe0eff4572cb64ab490e5fd8abcdd9a99e9e2e7b6913818748bb53cc8c7
              • Instruction ID: ee97ccc5d609747e51729cbfbf92dd4b12d922a2b6bfba14efaf0e3453cc7913
              • Opcode Fuzzy Hash: 940ccbe0eff4572cb64ab490e5fd8abcdd9a99e9e2e7b6913818748bb53cc8c7
              • Instruction Fuzzy Hash: 56310376D0051AAFEB16DA58C852E6FB776EBC0760F15412BE805A7391D730DE00EBE0
              Function 00FE892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
              Download Yara Rule
              Strings
              • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 00FE895E
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
              • API String ID: 0-702105204
              • Opcode ID: 41d92f751aee857d3df9aeda14895426ea63259ea3f588b749af9909d52db485
              • Instruction ID: 868d277d3062bfa8ab454364d5cce4f84c5198c7c286dd99156739febc977741
              • Opcode Fuzzy Hash: 41d92f751aee857d3df9aeda14895426ea63259ea3f588b749af9909d52db485
              • Instruction Fuzzy Hash: FC01D432A002909BD7217A539C85A6F7B65AF82BE0B040128F98517553CF65AC42F792
              Function 01002000 Relevance: .8, Instructions: 757COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9a547c740528f1c221a0930b47b38369e35db4865adce492eec2952ffb13d37d
              • Instruction ID: 0b07ebcbd253e305a8f4be88a2d9e8dfa7a0da1ce7cb70e0ffa46cda5a76b471
              • Opcode Fuzzy Hash: 9a547c740528f1c221a0930b47b38369e35db4865adce492eec2952ffb13d37d
              • Instruction Fuzzy Hash: 5B42F2356083019BF766CF68C898A6FBBE5BF88300F08496DFAC687291D771D945CB52
              Function 00FF8158 Relevance: .6, Instructions: 617COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 86f657d93f92aeaaacc342c8cc9d153b13354e7af17abe74b8ce54d9bb4b9725
              • Instruction ID: 0f81fc477dc5e149ac05caa9134b8247732fb8ec4f7fe14ddd7948ce51b69b39
              • Opcode Fuzzy Hash: 86f657d93f92aeaaacc342c8cc9d153b13354e7af17abe74b8ce54d9bb4b9725
              • Instruction Fuzzy Hash: 3E424975E002198FDB24CF69C881BADB7F5BF48750F188099E949EB252DB34AD82DF50
              Function 00F72840 Relevance: .6, Instructions: 605COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 816286e1842c1e6e314e14f5c8051baaae1736564042fc1f0b61644a521eb7f5
              • Instruction ID: 745aad57082d6b26753d94eb3ea809dbed33174bfb19e8498a0bfe7e2da64d95
              • Opcode Fuzzy Hash: 816286e1842c1e6e314e14f5c8051baaae1736564042fc1f0b61644a521eb7f5
              • Instruction Fuzzy Hash: 2D32F270E087568BDB24CF65C945BBEB7F2BF84314F24451DD48ADB284D735A801EB51
              Function 0100A118 Relevance: .6, Instructions: 591COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9cc87b39cf58958f38fe585905c720b870335f72a249c673d6c77afb3dc84fcd
              • Instruction ID: 9b330855a373e4d4ebe89e5431dac504f6be23c6e69a10a5560c680dba334279
              • Opcode Fuzzy Hash: 9cc87b39cf58958f38fe585905c720b870335f72a249c673d6c77afb3dc84fcd
              • Instruction Fuzzy Hash: B2229974704761CAFB668F29C490376BBF1BF48340F08859AE9C68B2C6D735E582CB60
              Function 00F66A50 Relevance: .5, Instructions: 548COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1437b5248f11417503935b367ad5bc5e39fa6ac1ddc7b4d6fc87bbc57c745a4b
              • Instruction ID: 12276b50d7dd2dc0c2dc156323f8dd54254ee7da5fcc0c4b29bac224bb62d478
              • Opcode Fuzzy Hash: 1437b5248f11417503935b367ad5bc5e39fa6ac1ddc7b4d6fc87bbc57c745a4b
              • Instruction Fuzzy Hash: 4F328A75A00205CFCB24CFA8C980BAAB7F5FF89314F248569E955EB352D734AC51EB90
              Function 00F84A35 Relevance: .4, Instructions: 423COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
              • Instruction ID: c31cd74d80e15818696f1b7d7bca8191db6a2bf5f08e04cc791846cfd163c1bf
              • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
              • Instruction Fuzzy Hash: B6F16E75E0121A9BDF14DF95C981BEEB7F9AF48714F048129E805AB380E774EC42EB60
              Function 00FF892B Relevance: .4, Instructions: 386COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cf67da56dfa3e7cf045d72334a3f66e23db460dda949671ce9c8d4f2807520d3
              • Instruction ID: fcaee332596b7e00f515ab1816c6eae8645da4da84c2b2b3e5f8be304e984ca6
              • Opcode Fuzzy Hash: cf67da56dfa3e7cf045d72334a3f66e23db460dda949671ce9c8d4f2807520d3
              • Instruction Fuzzy Hash: 37D10372E0061D9BDF14CF58C841BFEB7F1AF88354F18816ADA55E7290DB39E9029B60
              Function 00F665D0 Relevance: .4, Instructions: 383COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: beacecd827c5541d5b3b7c10a198986cdde7ab0e549ba22340cf2d981e0944ba
              • Instruction ID: fd624f327b9564fdc27472681bd1abf9f303f8c7f4d04f36e2725b130f16329e
              • Opcode Fuzzy Hash: beacecd827c5541d5b3b7c10a198986cdde7ab0e549ba22340cf2d981e0944ba
              • Instruction Fuzzy Hash: B6E17B71908342CFC714CF28C590A6ABBE0FF99318F158A6DE999CB351DB31E905DB92
              Function 00F58397 Relevance: .4, Instructions: 380COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c4005afbf150fc028e5d906e793850a912025bb8de9eaddd650c5c4fee2064e6
              • Instruction ID: 3c84bab44b422a3b3391358e3e816bc7ef2afaaa4981fcdce21a0184b658bab8
              • Opcode Fuzzy Hash: c4005afbf150fc028e5d906e793850a912025bb8de9eaddd650c5c4fee2064e6
              • Instruction Fuzzy Hash: 52D10172A00206DBCB14DF25CC81BBA77A1BF54355F144229FE12EB281EB74ED4AEB50
              Function 00FE8243 Relevance: .3, Instructions: 322COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
              • Instruction ID: 2cd3026bfefb0070d6db385fb28b11acb00ee2a59060cbb2afa4a2cb4af1fda7
              • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
              • Instruction Fuzzy Hash: 2BB18074A00644AFDF24EB96C940EABB7B9FF84394F10446DAA0697791DE34ED07EB10
              Function 00F70535 Relevance: .3, Instructions: 300COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
              • Instruction ID: 9d77aa791f8dc954ed76b00efc32527a61bfabf730c11fb74af0bece8ae87576
              • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
              • Instruction Fuzzy Hash: 4AB15532A00646EFDB25CB68C951FBEB7F6AF84310F14416AE146D7281DB34ED41EB51
              Function 00F683C0 Relevance: .3, Instructions: 281COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b020de3ddf3ef1efa1035b5f000eedece36a126d3c2754eb5995cefd1cd01645
              • Instruction ID: 73e401574ed3fdb4ec39cebd096572104c2bfac8aab88fc19f17953f0f101be4
              • Opcode Fuzzy Hash: b020de3ddf3ef1efa1035b5f000eedece36a126d3c2754eb5995cefd1cd01645
              • Instruction Fuzzy Hash: E6C177706083418FD764CF18C485BABB7E4BF88354F44492DE98A87291EB74E909DF92
              Function 00F5C427 Relevance: .3, Instructions: 280COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7965029e7a0c3ca1bdf49426ca50a329272671ab31e3fc643b131dfc534ec1e8
              • Instruction ID: 962d5c888c8bedfe8e2dbf61bec00ed58faba278b926cd059d30b06ecdd31435
              • Opcode Fuzzy Hash: 7965029e7a0c3ca1bdf49426ca50a329272671ab31e3fc643b131dfc534ec1e8
              • Instruction Fuzzy Hash: 89B18270A002658FDB34DF55C880BA9B3F1EF44710F1485E9D90AE7281EB74AE85DF61
              Function 00F8E5E7 Relevance: .3, Instructions: 278COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 97160ef8dc91fa4e52cd71a9b6ba8275af25b573b12510429b18499fe1e24df7
              • Instruction ID: dc2ff1ae8560e50335f620277727050bb750224f3dda4bd892c7432370fd24d4
              • Opcode Fuzzy Hash: 97160ef8dc91fa4e52cd71a9b6ba8275af25b573b12510429b18499fe1e24df7
              • Instruction Fuzzy Hash: F8A15532E0025AAFDB21EB58CD45FEEFBB5AF00720F150129E911AB2D1D7789D44EB91
              Function 00FA0185 Relevance: .3, Instructions: 276COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 92661a1eeb242491b8c5263986ac8dba935301fb8c78d0de12aac0a2e6dde459
              • Instruction ID: fa3ab693e7dd9649464f2099380b70cdfb3143858d5865b31fe987280525d540
              • Opcode Fuzzy Hash: 92661a1eeb242491b8c5263986ac8dba935301fb8c78d0de12aac0a2e6dde459
              • Instruction Fuzzy Hash: 61A103B1F007169FDB24DF65D890BAAB3B1FF59324F14402AEA0597381EB78E811EB50
              Function 01034500 Relevance: .3, Instructions: 275COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0384e05468157d2417c46439c8e4eb928164316507f640d2979d11b28253e86a
              • Instruction ID: 061fd6b2b841dc305300d1a28f26f0217481bebca367c6d304e6fc4be6cb61eb
              • Opcode Fuzzy Hash: 0384e05468157d2417c46439c8e4eb928164316507f640d2979d11b28253e86a
              • Instruction Fuzzy Hash: F9A1DD72A00601AFC712DF28CD81B5ABBE9FF88704F454669F589DB652D739E900CB92
              Function 01032B57 Relevance: .3, Instructions: 266COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
              • Instruction ID: f198fcdecb75ddaf33a314d146aa6acfeae00fb76c2175d5e4cf80117b834999
              • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
              • Instruction Fuzzy Hash: DBB12971E0061ADFDF59DFA9C880AADB7F9FF88310F148169E954AB351D730A941CBA0
              Function 00FE60E0 Relevance: .3, Instructions: 264COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a54ca9d735b0b266a9cc7aa2eb0b657caa252f00cba195d947a409812040946e
              • Instruction ID: 560c152c9567b552ef4b5976dd5632cf67f1b54b23e3e9a9d7619c0e879b3d4d
              • Opcode Fuzzy Hash: a54ca9d735b0b266a9cc7aa2eb0b657caa252f00cba195d947a409812040946e
              • Instruction Fuzzy Hash: ED91B271D00259AFDF15CFAADC84BAEBBB5AF58750F104169E610EB351D738ED00ABA0
              Function 00F7E3F0 Relevance: .3, Instructions: 261COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 23463b6ebbcad47b280a2a8a9f02a84cf80abe51df5b22dab726fee855010b65
              • Instruction ID: 40b63903b7ba7f9f3ca683eea7b75abcb3782b41f6d36aad2664a6375694b30b
              • Opcode Fuzzy Hash: 23463b6ebbcad47b280a2a8a9f02a84cf80abe51df5b22dab726fee855010b65
              • Instruction Fuzzy Hash: 13914536E006168BDB24DF58C945F7E77A1EF88724F19C0ABE809DB281E678DD01E752
              Function 00FB6ACC Relevance: .2, Instructions: 226COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a18117ed9ab27489a9701831e793ed29334b7cbcc1751ad711e231ebf20290c7
              • Instruction ID: 1860359389f4d477fe736a6ed4dea95c10326b780f591579f84d64d5e8a052eb
              • Opcode Fuzzy Hash: a18117ed9ab27489a9701831e793ed29334b7cbcc1751ad711e231ebf20290c7
              • Instruction Fuzzy Hash: C981A3B1E006199BDB14CF6AC840AFEBBF9FB48710F14852EE445E7640E738E941DB94
              Function 0102AB40 Relevance: .2, Instructions: 222COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
              • Instruction ID: e5684086de2e6cf66184f955200ebf5262280174fafc26edb5b2f2b56b8eac77
              • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
              • Instruction Fuzzy Hash: 7A817F31B00219DFDF19DF99C880AAEBBF6BF88310F1885A9D9569B745DB34E901CB50
              Function 00F9E284 Relevance: .2, Instructions: 212COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 02f17358258093984c643712fc0783901e5fa9637dccdb54fb42785c49fe3592
              • Instruction ID: 17c5f6a79d8e2e5a3fbce7db07f7e4479f68fd4578cfb6292a817329377716c7
              • Opcode Fuzzy Hash: 02f17358258093984c643712fc0783901e5fa9637dccdb54fb42785c49fe3592
              • Instruction Fuzzy Hash: 5E815F71A00609AFEB25CFA5C880FEEBBBAFF48354F144429E555A7250D770AC45EB60
              Function 00F7C640 Relevance: .2, Instructions: 206COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a2d16000d6328e45a5a6931278c8be2f07a65decb7ca97a0ed792727d1cbda73
              • Instruction ID: 3e256009376eb10f259ed688d84e0cbde4fd22d6e0899da9f9eac7deadd67601
              • Opcode Fuzzy Hash: a2d16000d6328e45a5a6931278c8be2f07a65decb7ca97a0ed792727d1cbda73
              • Instruction Fuzzy Hash: 7D71D175C00226DBCB258F58D990BBEBBB4FF58750F14811EE846AB390DB359802EBD1
              Function 010147A0 Relevance: .2, Instructions: 202COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 245fe181fa4aa8b9e5750b439d6a0d89b5b3b131b78486284d2ef3bd7bd0ff57
              • Instruction ID: 9781308e270c3148512a3d11bb6748be2473ca99289c99893bdd5171c8463e14
              • Opcode Fuzzy Hash: 245fe181fa4aa8b9e5750b439d6a0d89b5b3b131b78486284d2ef3bd7bd0ff57
              • Instruction Fuzzy Hash: C17180B1D00304EFDB60DF59D941A9BBBF9FF85300F81459AE684EB269C73A8944CB64
              Function 00F7260B Relevance: .2, Instructions: 201COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ee57cc6788f2703b9c4798e973ca62549959e52485e1ad0de450699028b46721
              • Instruction ID: 7e671090f9c67ab6ab05ee1aef13256fadbbc59542749ce33d11422517a680b9
              • Opcode Fuzzy Hash: ee57cc6788f2703b9c4798e973ca62549959e52485e1ad0de450699028b46721
              • Instruction Fuzzy Hash: 6271D475A042429FC355DF28C880B6AB7E5FF84310F04C5AAE898CB352DB38DD46DB92
              Function 00FF62A0 Relevance: .2, Instructions: 198COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9fd1ceed77d23e576a6d17d37a47ccc7600dc208b15a911ea49b1c7f8834ac5e
              • Instruction ID: 6e383ab7d01cbbf73144f9a300a90798f68eebcf515f0a7398cce1ecce7dc6e3
              • Opcode Fuzzy Hash: 9fd1ceed77d23e576a6d17d37a47ccc7600dc208b15a911ea49b1c7f8834ac5e
              • Instruction Fuzzy Hash: 6B71F032600B09AFDB31EF18CC45F66B7A5EF44760F104828E256CB6B1DB79E944EB50
              Function 00FE035C Relevance: .2, Instructions: 198COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
              • Instruction ID: 43e93b18ed9fb0cd29e6552318d3b87266481f3ddd559f8c386a0878ace95ccb
              • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
              • Instruction Fuzzy Hash: D7718D71E00609AFCB10DFAACD85E9EBBB8FF48300F144469E505E7251DB78EA41DB90
              Function 00F68AA0 Relevance: .2, Instructions: 197COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9ef15aaa99674d54eb557e8eccadda0c441783b4c13eb4cceb4343a62af26271
              • Instruction ID: f1c9feab6ee3e29a1944d30aa201c534ad6589b354db740645d8df01ba7e4425
              • Opcode Fuzzy Hash: 9ef15aaa99674d54eb557e8eccadda0c441783b4c13eb4cceb4343a62af26271
              • Instruction Fuzzy Hash: 93819372A043168FDB24CF58D585BAE77B1FF88324F25422DD900AB291D7799D41EB90
              Function 01038324 Relevance: .2, Instructions: 192COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0135b29f8eec13f1e328afe5a384446f88219353ad86dab637075cd3de8f3b45
              • Instruction ID: 61ddd6f1d8a6ffbeda1c5ad7225c994ac3350ee31ff0697a2c57b5b4cfd7360c
              • Opcode Fuzzy Hash: 0135b29f8eec13f1e328afe5a384446f88219353ad86dab637075cd3de8f3b45
              • Instruction Fuzzy Hash: 03710CB1E00209BFDB15DF94CC41FEEBBB8FB44360F10825AF655A6290D774AA05CB90
              Function 0101A250 Relevance: .2, Instructions: 184COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 34052243d429fd4334b243ddfc5cca1c71cb91eed30cc61c8d80fe05e04f2208
              • Instruction ID: 9f4e138bf626f307757a97ef58d2e890b4d08dec86fdef2c0ae621cd4dde1db4
              • Opcode Fuzzy Hash: 34052243d429fd4334b243ddfc5cca1c71cb91eed30cc61c8d80fe05e04f2208
              • Instruction Fuzzy Hash: 1551E172605741EFD312DE68C844F5BB7E8EBC9750F00492ABA80DB114DB79ED04C7A2
              Function 01008350 Relevance: .2, Instructions: 161COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 03b7ffc7a2820e5a2e132d38f85c8925686e3288a9150d57049a5ec744228fce
              • Instruction ID: 99c77cb01e6d161040d12924f0bf5e9d1aad08462d4e7ca16b21f6683adf91df
              • Opcode Fuzzy Hash: 03b7ffc7a2820e5a2e132d38f85c8925686e3288a9150d57049a5ec744228fce
              • Instruction Fuzzy Hash: 1D519E70900B05DFE762DF5AC880AABFBF8BF94710F10861EE296576E1DBB0A545CB50
              Function 00F9E443 Relevance: .2, Instructions: 158COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 99835652e8ff010409f7144236306c508aa47be1d6ea74d831eb1d384139fc31
              • Instruction ID: 5451b0d2ef69eeb064f8764cec1d15db7c6dc781dbe9c7fa483217201dbcd8fa
              • Opcode Fuzzy Hash: 99835652e8ff010409f7144236306c508aa47be1d6ea74d831eb1d384139fc31
              • Instruction Fuzzy Hash: 9D517A71600A05EFDB22DFA8C980FAAB3F9FB04754F55042AE54597261D734ED40EB51
              Function 01004180 Relevance: .2, Instructions: 156COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 44091f9201ffa07dfe5ba53d0f621c10e08edb5d289fc1be6fc0c4cd9c79f5d9
              • Instruction ID: daa23ab4d11e83423227afc14dff237dd8fdd6a6e59269467a8a67a3680f13c3
              • Opcode Fuzzy Hash: 44091f9201ffa07dfe5ba53d0f621c10e08edb5d289fc1be6fc0c4cd9c79f5d9
              • Instruction Fuzzy Hash: 665168716083019FE755DF29C881A6BBBE5BFC8704F44892DF689C7290DB30EA05CB56
              Function 00F845B1 Relevance: .2, Instructions: 156COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
              • Instruction ID: 3a3a366afd079fc160985a2f97e376ecc22db76869ae6d6cc6c4235fd9904051
              • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
              • Instruction Fuzzy Hash: D6519175E0021BABCF15EF94C841FEEBBB5AF45754F14406AE901AB240D734EE44EBA4
              Function 00FEE9E0 Relevance: .2, Instructions: 154COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
              • Instruction ID: b2eb7627ed255f97a1c6ae9498f4f57c3a409e42b79255aac05f5b4544d8fdfb
              • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
              • Instruction Fuzzy Hash: 79512B71D00259EFDF20DF95DC81FAEB779AF80324F104629E512A7191D7749E44E790
              Function 01028B28 Relevance: .2, Instructions: 152COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 05aa73d7cb82b6f94ef860a3af517a382e4854dbd22f05972c8a2b970c5fb4ae
              • Instruction ID: 14d7957b7313fb57cf9c843f9420ca697e2bbea4a96fa2ef426475d73d03839b
              • Opcode Fuzzy Hash: 05aa73d7cb82b6f94ef860a3af517a382e4854dbd22f05972c8a2b970c5fb4ae
              • Instruction Fuzzy Hash: E94115747016259BDB6ADB2DC894B7BBBDAEF90220F18C25AF9D587280DB34D801C691
              Function 00FECBF0 Relevance: .1, Instructions: 148COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: abc04d7c58a1fca8a839ce164f31276022fe2fe3e78992417a4bc706508b248b
              • Instruction ID: 54dbb5fe192cf2a622730ea0d59e595de0d773a8deab8ed7750446f88f8f91d8
              • Opcode Fuzzy Hash: abc04d7c58a1fca8a839ce164f31276022fe2fe3e78992417a4bc706508b248b
              • Instruction Fuzzy Hash: 18519E72D00255DFCB20DFAAC8809AFBBB9FB48764B614529E555A3300DB36AD42DBD0
              Function 00F9A430 Relevance: .1, Instructions: 139COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2621065bc33c1d9b1c983835c299deface8c82ac85c863c350370b23720e4bad
              • Instruction ID: 52d41b7a3b37b719c2c29969080b2f1cbb6573f013acbef80b5e33d83d9ba25b
              • Opcode Fuzzy Hash: 2621065bc33c1d9b1c983835c299deface8c82ac85c863c350370b23720e4bad
              • Instruction Fuzzy Hash: 4E41D672B40301DBEF25EF689C81B6B3765EB44758F450429FD499B241DBBADC00A792
              Function 0102A9D3 Relevance: .1, Instructions: 139COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
              • Instruction ID: d5f0fcc4828d87c94ce313204fd6dcf9d31e5e1d946d2eaa8867693b7d8d7ba8
              • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
              • Instruction Fuzzy Hash: DE41D531700726DFDB25CF68C984A6AB7E9FF84310B05866EE99687A41EF34ED04C791
              Function 00F901F8 Relevance: .1, Instructions: 138COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 851ea5275d4887fa1de09e2c2a8e34a18cf3e2524d4d7c52c1f6cbef07eb1a94
              • Instruction ID: cf789bc4fc400e57bb61f470cdbd5a772ef6c4fb5a637de864350ec525263c38
              • Opcode Fuzzy Hash: 851ea5275d4887fa1de09e2c2a8e34a18cf3e2524d4d7c52c1f6cbef07eb1a94
              • Instruction Fuzzy Hash: 02419C36D002199FEF15DF98C840AEEB7B5AF48710F29816AE815E7240DB359D41EBA4
              Function 00F8EBFC Relevance: .1, Instructions: 138COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: eb1068f32dcf9a1d8a3384409ea2df3be9f6a7ebace9d87d7a1d1dda9e110346
              • Instruction ID: 07a188aff9d91551cb872eafcef20b8ae361255f018c3e34efdb1b0aa270a6b1
              • Opcode Fuzzy Hash: eb1068f32dcf9a1d8a3384409ea2df3be9f6a7ebace9d87d7a1d1dda9e110346
              • Instruction Fuzzy Hash: 11419072A043019FDB24EF24C885A5BB7E9FB89324F14483EE957C7611DB35E848EB51
              Function 00FA2750 Relevance: .1, Instructions: 137COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
              • Instruction ID: f9e75b23c083b7df33de9027196fef4a4297ace5692e0d4b1a0884458e837631
              • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
              • Instruction Fuzzy Hash: D2515B75E00215DFCB14CF98C480AAEF7B2FF85724F2881AAD855A7350D770AE42DB95
              Function 00F66154 Relevance: .1, Instructions: 133COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 45023ec3c593936baf98c40a1e561d8eb14e1738fb6ba69364559a2ae2530a64
              • Instruction ID: db0e907de2d7008a75c6cd42e04f36cbfd4eafddaa64950718d45997798dd4db
              • Opcode Fuzzy Hash: 45023ec3c593936baf98c40a1e561d8eb14e1738fb6ba69364559a2ae2530a64
              • Instruction Fuzzy Hash: AA511570D00216DBDF25CB64CD11BA9B7B5EF05328F1482A9E419E76D1DB39AD81EF80
              Function 00F60BCD Relevance: .1, Instructions: 130COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e1327f453d097d5e7e04b0e8170d46418cc173003b7ae15fdbb47c5826f4b7c8
              • Instruction ID: 8abd6c22e94057e4b471a8cd9f7cec8539e5775706049f96a9a7f5f751fb1949
              • Opcode Fuzzy Hash: e1327f453d097d5e7e04b0e8170d46418cc173003b7ae15fdbb47c5826f4b7c8
              • Instruction Fuzzy Hash: 59418F72E002289BCB21DF65CD41BEE77B4EF49750F1141A6E908AB241DB78DE84EF91
              Function 0102866E Relevance: .1, Instructions: 129COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
              • Instruction ID: 58a816e00fc4596966597832989752098cc678c80e435c899b9716e5b19e0bc8
              • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
              • Instruction Fuzzy Hash: 0C418679B00125ABDB15DF99CC84AAFBBFABF88610F14806AE984A7341D774DD01C750
              Function 00F60887 Relevance: .1, Instructions: 128COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b6d2b2b94e53986b649ae7ad521e453e5d8d0da7e86cd18b7d51a19c8cba257
              • Instruction ID: b6ac05e7005696cc87fce55fcfae2d204544426155540e43ad97434ae7eae0e6
              • Opcode Fuzzy Hash: 0b6d2b2b94e53986b649ae7ad521e453e5d8d0da7e86cd18b7d51a19c8cba257
              • Instruction Fuzzy Hash: 9841A3B16007019FD725CF25C880A27B7F5FF49314B248A6EE44A87752EB35E845EB90
              Function 00F8A470 Relevance: .1, Instructions: 127COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: eae013d6aee12ac0a5ce6d76db66d18264f06e8371e5ad02fe8dcb2dff1a108b
              • Instruction ID: 5db5fa01306a72f3a0899f5424bb267a4fc2e63b598456be1cac2f21a5a09028
              • Opcode Fuzzy Hash: eae013d6aee12ac0a5ce6d76db66d18264f06e8371e5ad02fe8dcb2dff1a108b
              • Instruction Fuzzy Hash: 4641B432A40205CFEF25EF68D955BEE77B0FB04320F18015AD411AB295EB799D80EB61
              Function 00F68BF0 Relevance: .1, Instructions: 124COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1b0a42c54d8491f3fae7e835744451c077087d3f3082ad6058fab6942b9ff6e7
              • Instruction ID: bc9525dc79b20342213f5559e7a54285725fa38b526a94c9571d591ad3779e3d
              • Opcode Fuzzy Hash: 1b0a42c54d8491f3fae7e835744451c077087d3f3082ad6058fab6942b9ff6e7
              • Instruction Fuzzy Hash: 1441E472900302CBC724DF58D941B9BB7B5FF84754F24862EE8019B256DB79D943EBA0
              Function 00F58918 Relevance: .1, Instructions: 123COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: acbb9855d5f9ebf5edb9a59b9e8f083f374f31c09d4b5a5af3f30161ad908c64
              • Instruction ID: 385f1ad909cb60b7ab3f18901edfb72bf7dee2d6a98d0d676794ff93240f5b92
              • Opcode Fuzzy Hash: acbb9855d5f9ebf5edb9a59b9e8f083f374f31c09d4b5a5af3f30161ad908c64
              • Instruction Fuzzy Hash: AF4192325083069FD311DF65CC41AABB7E9EF84B94F50092AF984E7150EB70DE09AB93
              Function 00F5A020 Relevance: .1, Instructions: 122COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
              • Instruction ID: f7c62d9f320e8c8a6f8b5091a1607cedd09babe7e80723153e45acc06832b2dd
              • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
              • Instruction Fuzzy Hash: 7C412932E00211DBCB20DF9688507FAB761EF50736F25816AEE458B280D7758D54FF92
              Function 00F609AD Relevance: .1, Instructions: 122COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3050427b3bb015093d5a1d1f99fcabf03b7ddafd5fc4ee839e563bc5aef5eee7
              • Instruction ID: a83e5fd6659315c79ab65fa7508ebc4e27f4327e4007ed26df9344795fb2b4a1
              • Opcode Fuzzy Hash: 3050427b3bb015093d5a1d1f99fcabf03b7ddafd5fc4ee839e563bc5aef5eee7
              • Instruction Fuzzy Hash: C5418971A40700EFD320CF58C841B66BBE5EF48764F24852AE4498B252EB75ED42EB91
              Function 00F90710 Relevance: .1, Instructions: 121COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
              • Instruction ID: 813e5805b082235dade0607049f321c038d81a000ea7c1621ae48116e001fea9
              • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
              • Instruction Fuzzy Hash: 38413871A00605EFEB24CF98C980AAAB7F4FF48710B20496DE556D7691D730EA44EFA1
              Function 00F6262C Relevance: .1, Instructions: 119COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 03e4ecf5121d6c1a4583018e6fca48bf4e927eb56317dabe85dde51f3378234c
              • Instruction ID: da0c708d4ef86cb7c8a267dd67f5266513013a6a54b2b8cd9d27930d157b7964
              • Opcode Fuzzy Hash: 03e4ecf5121d6c1a4583018e6fca48bf4e927eb56317dabe85dde51f3378234c
              • Instruction Fuzzy Hash: 0E41D2B1901B00CFCBA1EF25D941B69B7F1FF44324F2082AAD8469B6A1EB359D41EF51
              Function 00F9C8F9 Relevance: .1, Instructions: 116COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9e6915f3f3648a1fa82a171d88e425fb01cc4ccba548d364b942207da0e61e1d
              • Instruction ID: dddda6c9203aa8ceca04695c8fca662e0c07796070f8d51704b039c0c766b455
              • Opcode Fuzzy Hash: 9e6915f3f3648a1fa82a171d88e425fb01cc4ccba548d364b942207da0e61e1d
              • Instruction Fuzzy Hash: 32318CB1A00345DFDB11CF58C441799BBF4FB49724F2085AAE019EB251D7769902DF90
              Function 00FE07C3 Relevance: .1, Instructions: 114COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 062dc017e32354384327461ddd470013e88e1e627093eb58a09f86ef07161904
              • Instruction ID: 2ea8283738dc6c47e8cd262c142aa4a59b1bd5c47cb3884f39e75011477fa246
              • Opcode Fuzzy Hash: 062dc017e32354384327461ddd470013e88e1e627093eb58a09f86ef07161904
              • Instruction Fuzzy Hash: B94181B15043419BD320DF25C845B9BBBE8FF88764F004A2AF598D7291DB74D944DB92
              Function 00F580A0 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 614a305cba76ef96a9c7eeb133d85d79adcedd6d23d80950189b3deb5eaf32f5
              • Instruction ID: 3890bb209f056aa3e46676d5a6c3b6095b964858b9899befecde164c539f042a
              • Opcode Fuzzy Hash: 614a305cba76ef96a9c7eeb133d85d79adcedd6d23d80950189b3deb5eaf32f5
              • Instruction Fuzzy Hash: 9341DF72E05A15AFCB10DF14CC816A8B7B1BB447A1F248229ED16B7291DF34ED47AB90
              Function 00FE05A7 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 93c9249153316f8875c704cdfb1871870975810877aaa46a3569395a2b9e9cb8
              • Instruction ID: 6f40d8c0a4413c98af1972afcf79d2039b08a3ec8e0c1438c3873673258a52bb
              • Opcode Fuzzy Hash: 93c9249153316f8875c704cdfb1871870975810877aaa46a3569395a2b9e9cb8
              • Instruction Fuzzy Hash: 4B41D272A047819FC320DF29C840B6AB3E5EFC8710F044629F89897680EB74ED54D7A6
              Function 00F64859 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: afb7b7f0c7db832892a8ffae2fc9e9b957fd30b457334c2740012e69b3868b4c
              • Instruction ID: 64a3183eca2741cd35f643b17d67a209cd88b3d2fc74ae3705775007bd60a14a
              • Opcode Fuzzy Hash: afb7b7f0c7db832892a8ffae2fc9e9b957fd30b457334c2740012e69b3868b4c
              • Instruction Fuzzy Hash: 9141E231A403018BD725EF28D894B2BB7EAEF80764F14442DF9958B291DB35ED41EB91
              Function 00F58B50 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f54216bed50d7a85f9267ef37bfe54c2b1c966eb35a9fcd74d05d14513682f64
              • Instruction ID: 72c3bd9399b54dd50a95d0708719da8dd5541a5658c1e5a404750c3b5dad5f79
              • Opcode Fuzzy Hash: f54216bed50d7a85f9267ef37bfe54c2b1c966eb35a9fcd74d05d14513682f64
              • Instruction Fuzzy Hash: B941B372E01604DFCB14CF69C98159DB7F1FF88361B20862EE956B7251DB349906EF50
              Function 00F702E1 Relevance: .1, Instructions: 106COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
              • Instruction ID: 59242f231ab07d82e538eab6ae4cf2de3ace30a59b120fbda23ffcc73ba9af2d
              • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
              • Instruction Fuzzy Hash: 80314832A00244EFDB51CB78CC80BDABBE9EF04350F0481A6F859D7352D678D884EBA5
              Function 0100E3DB Relevance: .1, Instructions: 105COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dcebe1ee4a99e9d42ca19cee9ce20e6786347377d0129070505312b2b4b3a525
              • Instruction ID: 81c8a2d0b36f06b368d32945dfaa8db150d2b873b9a610391a0c7e5ec3292caa
              • Opcode Fuzzy Hash: dcebe1ee4a99e9d42ca19cee9ce20e6786347377d0129070505312b2b4b3a525
              • Instruction Fuzzy Hash: D731B471740705ABE723AF65CC41FAF76A8AB49B50F110428F604BB3D2CFA9DD0097A1
              Function 01014B4B Relevance: .1, Instructions: 104COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 28209f012760a7e44ad1d720391430fd75844802a8964dddf71642e81dd5f620
              • Instruction ID: 8b484f5a326cd5aeecb992c41b60bf7ef22dc4736559c4567283de51fc3e7bc2
              • Opcode Fuzzy Hash: 28209f012760a7e44ad1d720391430fd75844802a8964dddf71642e81dd5f620
              • Instruction Fuzzy Hash: C631C5326052058FC361DF19D880E6A77E5FB80360F5944AEE9D9CB265D73AA800CF91
              Function 00F64260 Relevance: .1, Instructions: 102COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 67ae14a6e239fdb2b2c36a44ac7bfcbeda3e2fd9379d33b6c99abd1c529783b9
              • Instruction ID: d793ea2ec3b0584a01a3a92a00b1f3f96329a063e80041410321bb5162c7e185
              • Opcode Fuzzy Hash: 67ae14a6e239fdb2b2c36a44ac7bfcbeda3e2fd9379d33b6c99abd1c529783b9
              • Instruction Fuzzy Hash: BB41CE72600B45DFC722DF28C986FD677E8BB49324F10842DE59A8B251CB74E844EBA0
              Function 01014BB0 Relevance: .1, Instructions: 101COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cc023f7a8819aaacb28cab7a6922a0f163aef86146d2e3967b0d88bb36de4af6
              • Instruction ID: 7ca8116e42a5c7f0fa09dec104c050d4105858671080093b6359541f2c213b3b
              • Opcode Fuzzy Hash: cc023f7a8819aaacb28cab7a6922a0f163aef86146d2e3967b0d88bb36de4af6
              • Instruction Fuzzy Hash: D7317E716043058FD360DF28C881E6AB7E5FB84710F0549ADF999DB369D739E805CB91
              Function 010261C3 Relevance: .1, Instructions: 97COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 60cc53b61fc46e69cf41075ca586380ecabf0f58d2ab245f79c0287b11e334ba
              • Instruction ID: 9531050d6adc0038592b27cc5cea8652f7d694e99399ac4d06fc4d6ea7f7054a
              • Opcode Fuzzy Hash: 60cc53b61fc46e69cf41075ca586380ecabf0f58d2ab245f79c0287b11e334ba
              • Instruction Fuzzy Hash: 07310175A00629ABDB15CF98CC41FAEB7B9EB49B40F004168F940AB241D7B0ED00CBA0
              Function 0100483A Relevance: .1, Instructions: 96COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 47350fc6f980f054210b97a83de989a1739d07d45bcccf467030b754b4b1d2f4
              • Instruction ID: 6a944c4b91e078456a1df0901a8aae757822e38e21de966e76abaf7e19a33bb3
              • Opcode Fuzzy Hash: 47350fc6f980f054210b97a83de989a1739d07d45bcccf467030b754b4b1d2f4
              • Instruction Fuzzy Hash: 88319372A4012CABDF22DF54DC84BDEBBF5AB98350F0000E5B608E3251CB749E819F90
              Function 010260B8 Relevance: .1, Instructions: 95COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d7cc7e3fa4e6d5a13b534a0c69eb7e71a13b2d23c72ffcc9dbcf0c8a251cb7b2
              • Instruction ID: a7f034cecf8e001c56df9ea98df85f0f8ae26f4938cee1aba1ff255e1b7abab6
              • Opcode Fuzzy Hash: d7cc7e3fa4e6d5a13b534a0c69eb7e71a13b2d23c72ffcc9dbcf0c8a251cb7b2
              • Instruction Fuzzy Hash: 92312431A00221ABDB129FA8CC40B6FBBF9EF44744F244069F985DB352DA36ED009B90
              Function 00F607AF Relevance: .1, Instructions: 95COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a065e7e533888886c77ef273cc9a1eecfb7d25728c3c4609dfcd1f7dea3ac9ff
              • Instruction ID: bdfac9bfd4becf3410e3c83f92ae0fe0d847500e540a9023301054e7639fab2d
              • Opcode Fuzzy Hash: a065e7e533888886c77ef273cc9a1eecfb7d25728c3c4609dfcd1f7dea3ac9ff
              • Instruction Fuzzy Hash: 9331D172A04711EBC722DE348880EABBBA5AF94360F214529FC55A7351DE34DC01BBE2
              Function 00F68550 Relevance: .1, Instructions: 94COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9b45d57b286fb6b873bf80312a5336894d0668c5f1e25a3a744785c425895a0a
              • Instruction ID: 1bb434196ec0c5f0130785d6552d722acbb0b604f9ed727f4a556d101cb1fae3
              • Opcode Fuzzy Hash: 9b45d57b286fb6b873bf80312a5336894d0668c5f1e25a3a744785c425895a0a
              • Instruction Fuzzy Hash: 66319A72A093028FD360CF19C941B2AB7E4FF88760F184A6EE88597251D770EC48EB91
              Function 00F9A6C7 Relevance: .1, Instructions: 92COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
              • Instruction ID: 786704dfeacab0146faa30ec413535c849ab9540956963f21b16ff96d69c0e82
              • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
              • Instruction Fuzzy Hash: 9A310E72B00B01AFDB64CF69DD41B57B7F8AF48B60F14452DA55AC3651E630E900AB62
              Function 0100EBD0 Relevance: .1, Instructions: 91COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 82abe820ff76962728bed0915af35b8c637c8863093f22e2a71cda75dfb7169e
              • Instruction ID: fd981592e072714b9318d5cffdf47c05d7035c6b3d07ede266c1f50463798d95
              • Opcode Fuzzy Hash: 82abe820ff76962728bed0915af35b8c637c8863093f22e2a71cda75dfb7169e
              • Instruction Fuzzy Hash: 7C318D71A053098FC752DF19C54095ABBF1FF89314F4489AEF8C8AB292D332D945CB92
              Function 00F8438F Relevance: .1, Instructions: 89COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 95365fc9d7ab9f8f3f39186ac812d1d4d333be38e37a36d4e413854eda443b00
              • Instruction ID: 107fd74af78c7f90f437418c0d4ba994cfa0ad4b9d276758e4e9c803e128d6aa
              • Opcode Fuzzy Hash: 95365fc9d7ab9f8f3f39186ac812d1d4d333be38e37a36d4e413854eda443b00
              • Instruction Fuzzy Hash: 2431D172B002069FD720EFB8CD82BAEB7F9AB84704F10852AE445D7295D734ED45EB90
              Function 00F5CB7E Relevance: .1, Instructions: 89COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
              • Instruction ID: c681285e23a95577bc5519967456f26fc4bf3918907531cd2161960337093520
              • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
              • Instruction Fuzzy Hash: 0F21F236E4025AAACB119BB58841BEFB7B5AF44750F198035AE56E7340E231DD04ABE1
              Function 00F5C156 Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fd243c486fa80fa8d4c0d142e78c9be5cbdaeed25b06d4b794b4da319e9c7a3a
              • Instruction ID: d619dadd8eea5561a3303f47fa69bbd59d2b9c5913d0b7c660b201b7333fef43
              • Opcode Fuzzy Hash: fd243c486fa80fa8d4c0d142e78c9be5cbdaeed25b06d4b794b4da319e9c7a3a
              • Instruction Fuzzy Hash: 7A3129729003108BCB20AF24CC41BE977B4EF41314F64C1A9EC899B342EE399D86EF91
              Function 0101C3CD Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
              • Instruction ID: 12e0abaa2f230e32474e1d9636098eddec554cab4b688dd8a7ebced3a8581707
              • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
              • Instruction Fuzzy Hash: 41212D3A68065177EB15AB958D01FBBBBB5EF40710F40801AFAD587651EB3CDD41D360
              Function 00F5E420 Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4e26a0fa17ed7e0d946784a2b9494e6eb76df0180684e422804d76d80002783e
              • Instruction ID: e5c4eacc63b56da170d4235fe9a46db312fb4809057b8eadc5435c5928f5b6f9
              • Opcode Fuzzy Hash: 4e26a0fa17ed7e0d946784a2b9494e6eb76df0180684e422804d76d80002783e
              • Instruction Fuzzy Hash: EC310A36A0012C9BDB35DF14CC42FEE77B9EB15750F0100A1FA45A7290D674AF84AF91
              Function 00F944B0 Relevance: .1, Instructions: 87COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b4e5b909f6f178c65c7c58bd8cf63a09c302bde7079f6a596fb2b5e21c2c9104
              • Instruction ID: 3abe7a49f8553abf76f1198e1ccecded2e95d69c5a3e6d3a5cac60f1f3bfb564
              • Opcode Fuzzy Hash: b4e5b909f6f178c65c7c58bd8cf63a09c302bde7079f6a596fb2b5e21c2c9104
              • Instruction Fuzzy Hash: 4221E372A047059BDB22DF58C840F6B77E4FB88720F094519FD589B241C735ED01ABA2
              Function 00F94588 Relevance: .1, Instructions: 87COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
              • Instruction ID: c9e224c2dacd5ead0ce184f9d81f4c539defdb767a420079d4b93a2b98f4c165
              • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
              • Instruction Fuzzy Hash: 262191B2A00608EBDF15CF58C980E8EBBB5FF59710F108169ED259B241D675EE06EB90
              Function 00F5E388 Relevance: .1, Instructions: 86COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
              • Instruction ID: a88298a83d05b61f749b721117ea0ad084dbefb058a3e7e0e2cbf2607f6ca86b
              • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
              • Instruction Fuzzy Hash: 7631BF31600604EFD725CF68C884F6AB7F8EF45354F1045A9EA52CB291E734EE05EB51
              Function 00FDE609 Relevance: .1, Instructions: 86COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 417c18f17e926a19628af18f69f8022646c6bce3c197f637435488ec4e814acd
              • Instruction ID: 4e638e813abd06c634a84738cbb36249d1e46a27d6b66a03d3cc41876a738982
              • Opcode Fuzzy Hash: 417c18f17e926a19628af18f69f8022646c6bce3c197f637435488ec4e814acd
              • Instruction Fuzzy Hash: 6A31B175A10205DFCB14DF18C8849AEB7B6FF94704B19846AF8499B391E772EE40DB90
              Function 00FE06F1 Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 577021e61e4b01255bd16c54d100cd845c72eb80cb0bd495c3e65fc56c9e233d
              • Instruction ID: 3f01e412836b7abc8642e2880c5d7428bef6c4d6da40fc78c20baed1065e22c3
              • Opcode Fuzzy Hash: 577021e61e4b01255bd16c54d100cd845c72eb80cb0bd495c3e65fc56c9e233d
              • Instruction Fuzzy Hash: 90218071900629ABCF20DF59C881ABEB7F4FF48750B544069F941A7240D778AD42DBA1
              Function 00FE019F Relevance: .1, Instructions: 78COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 508c2564f27f36b5015fc9c93ad9bef03c9c3d583445d9e24cfd143f72317932
              • Instruction ID: e409f04705b34f354505046c619497fd15a97b962371fe720ae331cb11cc5eb8
              • Opcode Fuzzy Hash: 508c2564f27f36b5015fc9c93ad9bef03c9c3d583445d9e24cfd143f72317932
              • Instruction Fuzzy Hash: 6221DB71A00644BFC715DB69CC40F2AB3A8FF48740F14406AF904DB691DA78EE40DB65
              Function 00FE0283 Relevance: .1, Instructions: 74COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d43e085b13c10d534b98090917244e32b1a223c1aae593b564005d9e18f5d92c
              • Instruction ID: 0080b992957610e8ea396c41f92dc0ce880cfe429f07ab282dab1f19803c1b6d
              • Opcode Fuzzy Hash: d43e085b13c10d534b98090917244e32b1a223c1aae593b564005d9e18f5d92c
              • Instruction Fuzzy Hash: E121D3729043859FC721EF5AC848B5BB7DCAF80750F084466BD84C7252DB74DA84E7A2
              Function 00F82835 Relevance: .1, Instructions: 73COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: de6d138e2727db72e5056e26f58eb290d8829330a20a7f723005b66d66436fa8
              • Instruction ID: a9f030375201ed6dd3c16151f7ee895690b986b52c97898f2026bde705e16cd7
              • Opcode Fuzzy Hash: de6d138e2727db72e5056e26f58eb290d8829330a20a7f723005b66d66436fa8
              • Instruction Fuzzy Hash: DF213B32A44685ABE73267288E05F643794AF41774F280365F9219FAD2DB6CEC41B302
              Function 00F9A30B Relevance: .1, Instructions: 70COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e4b2df65526c32b95a35a797bf89ff0f4d6459c8de670ae9840448717e91ade3
              • Instruction ID: 15c05cd3ddab7403154b35906fe3bc9aed176574e8d43d0c58e32a407f556cf0
              • Opcode Fuzzy Hash: e4b2df65526c32b95a35a797bf89ff0f4d6459c8de670ae9840448717e91ade3
              • Instruction Fuzzy Hash: 6C21BE35600A00AFCB25DF29CC01F5673F5FF48B04F288469A449CBB61E336E942EB95
              Function 0101A49A Relevance: .1, Instructions: 70COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3217cc8fb5ce1db43cce17c51e8747d3740661f5061846b8357dc6021037c868
              • Instruction ID: 5f29efe0aa3fe26f5b70b52f12f87c4df07a1eeac40b14ec8545987512409ff5
              • Opcode Fuzzy Hash: 3217cc8fb5ce1db43cce17c51e8747d3740661f5061846b8357dc6021037c868
              • Instruction Fuzzy Hash: 73112372385B10FFE72256589C01F2B7699AFC4BB0F100028B748CB294EF78DC018795
              Function 00FE0946 Relevance: .1, Instructions: 70COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ded352a6a58ab32f2ec9761a64a0a7b56a9841db48b4530bc9d7adc9ff9aa19b
              • Instruction ID: 532b12fb6ec62306342406030db7bb2b4f8af13a231160db9c88b3873e1968ff
              • Opcode Fuzzy Hash: ded352a6a58ab32f2ec9761a64a0a7b56a9841db48b4530bc9d7adc9ff9aa19b
              • Instruction Fuzzy Hash: 5121EBB1E01348ABCB20DF9AD8819AEFBF8FF98710F10012EE405A7351DB749985DB54
              Function 00FF80A8 Relevance: .1, Instructions: 69COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
              • Instruction ID: e77c23455b7b70080c22e45105162e5a1f8ef887442186e361707a6ebc51dbe6
              • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
              • Instruction Fuzzy Hash: 8F216D72A00209AFDB129F94CC40BAEBBB9EF48360F204456FA05A7261DB74DD52AB50
              Function 00F90124 Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
              • Instruction ID: f88c4aa3aa473e7885abcfd475e2f912c78d662ecdb1b47dd2dacf76fc654308
              • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
              • Instruction Fuzzy Hash: 02110473600614BFEB229F54CC41F9ABBB8EF80B60F204029F6048B180DA71EE84EB54
              Function 00F68770 Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 01c7af6651efe2221b9ee1ba51357e81f70c20afb195478e2ad8ddcf84dee662
              • Instruction ID: 72a2b1719337c627c4d55a607090956fbf6a630df7b28adeabbc0326032d02f2
              • Opcode Fuzzy Hash: 01c7af6651efe2221b9ee1ba51357e81f70c20afb195478e2ad8ddcf84dee662
              • Instruction Fuzzy Hash: B511C432B006109BCB11CF59C4C0A26B7E9AF4ABA0B28426DED089F205DAB2DD02D790
              Function 00F9AAEE Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
              • Instruction ID: 65a7d45c7675ec9e883fb4085e6df8354452db0f98538d9c232c040dfa82c192
              • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
              • Instruction Fuzzy Hash: 14219D72A00A40DFEB31DF49C540A66F7E6EBD4B20F24803EE44A97A21C775ED01EB81
              Function 00F680E9 Relevance: .1, Instructions: 66COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8814023fc16ae2d854aab5903f4a9fb9a6ff0baf91589795cddbabedd0b8a804
              • Instruction ID: 67d91050acd195914120ba03d452845c9ddeb20df04811df82d1344f59e09ffd
              • Opcode Fuzzy Hash: 8814023fc16ae2d854aab5903f4a9fb9a6ff0baf91589795cddbabedd0b8a804
              • Instruction Fuzzy Hash: 5F215B76A00209DFCB14CF98C581BAEBBB5FB89758F24426DD105AB311DB71AE07DB90
              Function 00F9674D Relevance: .1, Instructions: 65COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 78f92769e3031877eb907d3998db37cd639d492fee1eb725fcf591abc6cc668d
              • Instruction ID: 172d7ff9a2616dbf7395a034daba6eb1ea791672b13fd0954f7f412cfbb4a9e0
              • Opcode Fuzzy Hash: 78f92769e3031877eb907d3998db37cd639d492fee1eb725fcf591abc6cc668d
              • Instruction Fuzzy Hash: 62219D75600A00EFEB608FA8C881F66B3F8FF44754F50882DE4AAC7250DA70BD40EB61
              Function 00F8E8C0 Relevance: .1, Instructions: 63COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5e15f9e29425a5ab0ba9d89a43fa33d1b79726ba1a6bc84fc34ca78b71b0e62a
              • Instruction ID: f3ba8e9c5f19af935aab4557717881dffa9d49b00f2bcf69c3f57a10cf368e43
              • Opcode Fuzzy Hash: 5e15f9e29425a5ab0ba9d89a43fa33d1b79726ba1a6bc84fc34ca78b71b0e62a
              • Instruction Fuzzy Hash: CC11E1337001189BCF19DA24CD86B6BB267EFD5370B358539E9268B290E931DC02E791
              Function 00FF6870 Relevance: .1, Instructions: 63COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 11e47b5e923c25a0c819bd976aaf6d9769e507810208d745009ed93ddec64661
              • Instruction ID: 2c8486409bc51722ba20f4a94a11b08b81afc50a917bba1f37cc37e1425c3ac8
              • Opcode Fuzzy Hash: 11e47b5e923c25a0c819bd976aaf6d9769e507810208d745009ed93ddec64661
              • Instruction Fuzzy Hash: F7119432240518FBD722DB69CD40F6A77A8EF59BA0F114025F305DB261DEB4ED05E790
              Function 00F966B0 Relevance: .1, Instructions: 61COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 34495444b1b9e159c9bbf80c899b8f895d52f3cd50de1f26449ff5b63fce7034
              • Instruction ID: 6d575e7b5ab3017f101f024f2266ddc2ee963c81d70f4f4b70eb45aea7f9a6c2
              • Opcode Fuzzy Hash: 34495444b1b9e159c9bbf80c899b8f895d52f3cd50de1f26449ff5b63fce7034
              • Instruction Fuzzy Hash: 5F11C176E01204DFDF25CF99D980E5ABBE4EF84724B15807AE809DB311EA34DD00EB91
              Function 0102A8E4 Relevance: .1, Instructions: 61COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
              • Instruction ID: 4bdf3acdb8515a1dd4cd040831817fbfe0c10fa9158fe3de01a690322a59c645
              • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
              • Instruction Fuzzy Hash: C511C436B00929EFDB19CB58CC05B9DFBF5EF84310F058269E89597340EA75AE51CB80
              Function 00F60AD0 Relevance: .1, Instructions: 61COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
              • Instruction ID: 10287e60cf42a49d762ab8a094b7ef21403ab463f8c62ae5d0173e2c9c8e753a
              • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
              • Instruction Fuzzy Hash: FD21F4B5A40B059FD3A0CF29C441B52BBF4FB48B20F10892AE98AC7B40E771E814DB90
              Function 00FEE7E1 Relevance: .1, Instructions: 59COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
              • Instruction ID: 28cb6e44c56bf818d7e3ee07d54c1cc1ec1ad8e0ab2be5e4ee6eead88065a05d
              • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
              • Instruction Fuzzy Hash: 86110232A00640EFDB209F46EC41B1AB7E5EF45760F058428F8089B161EB74DE44FB90
              Function 00F827ED Relevance: .1, Instructions: 58COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c5111eebb391756819442a0895355f5c6324e8f9dbe0b1534e98d23d3d5fd09
              • Instruction ID: 0447079079bb949c160d4299cebdd98a75d116572c6e102f05d25344d96503c6
              • Opcode Fuzzy Hash: 9c5111eebb391756819442a0895355f5c6324e8f9dbe0b1534e98d23d3d5fd09
              • Instruction Fuzzy Hash: ED012672B05649AFE726A26ADD45F67779CEF803A4F15407AF8018B641DB18EC00F3A2
              Function 00F64690 Relevance: .1, Instructions: 57COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8aea84e2d38bfeae8cc8d761f2e6e622ff774923392d7b1809b3e65efe01221f
              • Instruction ID: a460a8941362b7b36220069f623e64cbdf098ff7d7ef48ae48817c369c67e9c8
              • Opcode Fuzzy Hash: 8aea84e2d38bfeae8cc8d761f2e6e622ff774923392d7b1809b3e65efe01221f
              • Instruction Fuzzy Hash: 8511CB76640644AFCB25EF59D980F567BA8EB9AB75F18411AF804CB290C774FC40EFA0
              Function 01034B00 Relevance: .1, Instructions: 57COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 259b7e054e3e1881e737e508d3b84e5f1dc2ad0ba366187f4f3ce125b588e5d1
              • Instruction ID: d8ad26bcbd68c8a380f655b79a088be4fbe5e48cbfc6af3d3c4730cb8d9a1948
              • Opcode Fuzzy Hash: 259b7e054e3e1881e737e508d3b84e5f1dc2ad0ba366187f4f3ce125b588e5d1
              • Instruction Fuzzy Hash: 5611C2362006119FD7669A29DC40F67BBEAFFC4710F194469EAC6CB790DB34A802CB90
              Function 00F96620 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d2d763824cc6439d24d2ec5ef254c23fa69077ecd304c063519a5d4959d9fa92
              • Instruction ID: ec46789681bfdc149ce18759a00d4e018c932bb98b7c597d4a3a5875facf19e6
              • Opcode Fuzzy Hash: d2d763824cc6439d24d2ec5ef254c23fa69077ecd304c063519a5d4959d9fa92
              • Instruction Fuzzy Hash: 6111C272D00714ABEF22DF69CD81B5EF7B8EF84B50F500059E904BB201D735AD01AB50
              Function 00F8EA2E Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 343d6f2c588d44df85538af5a468ce36deb4de78a3be438328df6034640cc481
              • Instruction ID: 90b86af32df76d6d816d7eb4a10b723a1414bfb0c7af4155bbbad7501fd2f0e3
              • Opcode Fuzzy Hash: 343d6f2c588d44df85538af5a468ce36deb4de78a3be438328df6034640cc481
              • Instruction Fuzzy Hash: 5B01B5716002089FC729EF15DD49F66BBF9FB85724F24816AF0058B261D778EC46DB90
              Function 00F8E53E Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
              • Instruction ID: a71f9f883dc2618a9339ae76b68241a122f5fc62b7bab10c8404c858539a7481
              • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
              • Instruction Fuzzy Hash: 9F112932A016C69BD7229718CE45F65B794EB01768F2D00B5ED05CBA42E33CCC45F311
              Function 00FEE75D Relevance: .1, Instructions: 54COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
              • Instruction ID: e5365750b3ef32ed26c143df5fb4d9f85b1c7a922006a15aaad04d6cb5cba7d9
              • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
              • Instruction Fuzzy Hash: B9016832A00144AFD7219F56DC00F5A77A9EF49B60F098034F8148B260E775DD40F790
              Function 00F5A250 Relevance: .1, Instructions: 52COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
              • Instruction ID: 2b18dd1b9983162f2848a7d116fc4c926b31a80bf9c7858d8eda6934686f5214
              • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
              • Instruction Fuzzy Hash: A3012672814B11AFCB308F15EC41A327BA4EF55B71B008A2DFD958B281C735D825EB61
              Function 01034940 Relevance: .1, Instructions: 52COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1aa7462556a1d1a21ab80e44eba1162f613f012eed4e8dacc56ee43e9e174147
              • Instruction ID: 4b017889b60b199e5006d9b4af18b5d48fcc959f024ece96e0594da93dfd8e62
              • Opcode Fuzzy Hash: 1aa7462556a1d1a21ab80e44eba1162f613f012eed4e8dacc56ee43e9e174147
              • Instruction Fuzzy Hash: 4501C0725416009BC7A2DF1C9C40E16BBECEBC5770B2582A6E9E8DF1A6E630D801CB91
              Function 00FDE1D0 Relevance: .1, Instructions: 51COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8ba60edb3e0dae04a7901c6e9f7b9a19ab6fef92b0a14b06cc200f597eefd057
              • Instruction ID: 26fa85db034aec4717339216a7f6f492a80bbf6ab4fee4564a383f70f7981ca5
              • Opcode Fuzzy Hash: 8ba60edb3e0dae04a7901c6e9f7b9a19ab6fef92b0a14b06cc200f597eefd057
              • Instruction Fuzzy Hash: BC11AD32641240EFCB16EF19DD91F56BBB9FF44B94F2400A9F9059F662C239ED01EA90
              Function 00F66259 Relevance: .1, Instructions: 51COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 695ba77d71ac53381f6d5a3ea68c96ef6310192688ef098c7529db1be3fe7526
              • Instruction ID: 13a55ba757a94c84cd3856e76a518ce5f82bed85e42e0fd8c5177dc7cd3bb704
              • Opcode Fuzzy Hash: 695ba77d71ac53381f6d5a3ea68c96ef6310192688ef098c7529db1be3fe7526
              • Instruction Fuzzy Hash: 32119EB0A01218ABDF65AB64CC52FE9B374AB44710F5041D4B318E60E1DB349E81EF94
              Function 00F6208A Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
              • Instruction ID: 2f91067926b6205593ae4cb243340d309b0e8c735b4fa965f0989207941f9325
              • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
              • Instruction Fuzzy Hash: 7D014733A00501ABDF509E29DC80F92B76ABFD4720F1945A9EC05CF246DA71CC81F790
              Function 00FE6050 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7e2b7e16f0db1b91716dae646211f05fd8197f53189f9c0529e19e6d869de801
              • Instruction ID: 94bc9a76d849781684c727e0411fed12b505899e3880c32a5b87e01d5313ce22
              • Opcode Fuzzy Hash: 7e2b7e16f0db1b91716dae646211f05fd8197f53189f9c0529e19e6d869de801
              • Instruction Fuzzy Hash: 7711177390011DABCB11DB95CC81EEFBB7CEF48358F044166A906E7211EA34AA15DBA1
              Function 00FF6500 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b420344da0dd6e814a7d2ad949e1ed22a5f5157a4275b4931e151805e4253220
              • Instruction ID: 49d66d483ec11dfe82f6c1729ce8347ce756b4a20e357a000d0983e0e017842b
              • Opcode Fuzzy Hash: b420344da0dd6e814a7d2ad949e1ed22a5f5157a4275b4931e151805e4253220
              • Instruction Fuzzy Hash: 7D118E326441499FC710CF68D850BA6BBB9FF5A314F1C8159E948DB325DB32EC85EBA0
              Function 00FEC810 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6ac6f49ba5b8a3aa09d84f6637961f0359a3765059aff71e889462b1e7fa88e6
              • Instruction ID: 951d0e423b90921019c3227eb5aa9e8962d62f7393a769fb340982352f0f4892
              • Opcode Fuzzy Hash: 6ac6f49ba5b8a3aa09d84f6637961f0359a3765059aff71e889462b1e7fa88e6
              • Instruction Fuzzy Hash: C211ECB1E01249ABCB04DF9AD541A9EB7F4EF48350F10806AB905E7351D674EE019BA4
              Function 0100EA60 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cff49607da137a181fbdbce6db9b1cbe1cb58ddaef90f27a3ccc70fb7156da1a
              • Instruction ID: 0f670f85fa10c3814e36f55aed98f3564bac4d6b2534485def077c4db91c00cb
              • Opcode Fuzzy Hash: cff49607da137a181fbdbce6db9b1cbe1cb58ddaef90f27a3ccc70fb7156da1a
              • Instruction Fuzzy Hash: 2501F5315402109FD773AA14C800D2BBBE9FF46790F14886AF5852B682CB34AC81DB92
              Function 00FA20F0 Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9edefc854191c57c543d92bd17aa0356ed633c6edf8084241e94cbbcca3fc5be
              • Instruction ID: a4caf32feb1dc26a0fab79aea5b66cbbeea2940a5a6098c92b8b3768067177bc
              • Opcode Fuzzy Hash: 9edefc854191c57c543d92bd17aa0356ed633c6edf8084241e94cbbcca3fc5be
              • Instruction Fuzzy Hash: 6611ADB1A0020CABCB00DF64CC41FAE7BB6EB45350F004059F91597281DB35AE01EB91
              Function 00F5C020 Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
              • Instruction ID: 06a58d3295dcf982fddc712483e1af14040a1853fc850ab0f65036f6c2082667
              • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
              • Instruction Fuzzy Hash: 5C01F532600705DFDF32A666C840FA773E9FFC4320F188419AA46CB580EA74E805EF91
              Function 00F9E5CF Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cec476b049e806be8da27fb425d04b58751edcfe6c08317baa258eb4bfd378a7
              • Instruction ID: 7b819eee01a894c8d6e21a03570c2ea4c8be408ccb6c935f03037b6121642892
              • Opcode Fuzzy Hash: cec476b049e806be8da27fb425d04b58751edcfe6c08317baa258eb4bfd378a7
              • Instruction Fuzzy Hash: 4E01F272200A00BFD351BB79CD81E67B7ACFF857A0B04462AB50883652DB68EC01E6E1
              Function 00FF69C0 Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 011c945839edade1a73e164246b03cb7a09015945e5345ce155ae4e51ccedf33
              • Instruction ID: 8d3d39d33f8f20263bc34388c4a7b328a8a9ab4e848ccbeef6666cc19aecb365
              • Opcode Fuzzy Hash: 011c945839edade1a73e164246b03cb7a09015945e5345ce155ae4e51ccedf33
              • Instruction Fuzzy Hash: BF014C322243059BC320DF68C849A77F7A8EF84734F204229F968D7191EB38AD01E7D1
              Function 00FEC460 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 82991bfd5e740cc531b621bdc981130b782cb70485e4535081670880ed146f98
              • Instruction ID: 0a78210efa80fcf482c42b03f750313c9edf3c15e785adadb7fb5915949deb02
              • Opcode Fuzzy Hash: 82991bfd5e740cc531b621bdc981130b782cb70485e4535081670880ed146f98
              • Instruction Fuzzy Hash: 2A116D71A0124CEBCB15EF65C851EAE7BB5EB88350F004059FC0197381DB39EE12EB90
              Function 00FEC97C Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a61d038dfdea578a223fc01001d66c493ebd5d3d4191159e57d8ab9c328f12c1
              • Instruction ID: 9a2dc9b9861f4c56ca9a0ba98caa50871c494ea983aeafb76d12ca256f3bf7c1
              • Opcode Fuzzy Hash: a61d038dfdea578a223fc01001d66c493ebd5d3d4191159e57d8ab9c328f12c1
              • Instruction Fuzzy Hash: 601179B16083489FC700DF69C842A5BBBE4EF89310F00851AB998D7392E634E901DB92
              Function 00FECA11 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 435a0c51aa104185d99fb0f30bd90dfa3d96271555f073fa0a377df298df0714
              • Instruction ID: 915c8f55a3c44b5b677ba7fa49adeb5c3485400a1f043288b397ab4b4c6362f4
              • Opcode Fuzzy Hash: 435a0c51aa104185d99fb0f30bd90dfa3d96271555f073fa0a377df298df0714
              • Instruction Fuzzy Hash: 6B118BB16093089FC310DF6AC841A4BBBF4EF89750F00852EF998D73A1E634E901DB92
              Function 01034A80 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
              • Instruction ID: 8ffe06204577f904f28716641b1e1547ca1c9b3e84d135ed9e1f1bddf88735c7
              • Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
              • Instruction Fuzzy Hash: 2001D432204A059FD7219A69DC45F96BBEEFFC6210F084859E682CF650DAB4F842C794
              Function 00F7E016 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
              • Instruction ID: 8662417019427284e3afff8614da772a8bae3332fa3f407229b01a60622cbf16
              • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
              • Instruction Fuzzy Hash: 3F0184326045849FD322871DC948F6677DCEF4A764F0D44A7F909CB691D7B8DC40E622
              Function 00F5826B Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 03c830f71fd4c0d838c50f825156a1b9969e284d9113f427fc1eeabf89d175b5
              • Instruction ID: c09feb796e9357a08f121164f639cc07cf3cf2729d40496bd2d5ab9de39e4a73
              • Opcode Fuzzy Hash: 03c830f71fd4c0d838c50f825156a1b9969e284d9113f427fc1eeabf89d175b5
              • Instruction Fuzzy Hash: B701D432B006049FC714DB66DC019AF7BA9FF803A0F154029AE01A7246DE70ED06E691
              Function 0100EB50 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 21824236ad9f35e94ca7670197a1b78aa1fa3fe930b7a8e64c30a42fe8c2c0ea
              • Instruction ID: 080b01a77869da10eecb1856487d4a9479c48a62504de75c9b9b6755cb1cd731
              • Opcode Fuzzy Hash: 21824236ad9f35e94ca7670197a1b78aa1fa3fe930b7a8e64c30a42fe8c2c0ea
              • Instruction Fuzzy Hash: CC01F271640B04AFE3325F19DC01F07BBA8EF45B90F10482AB6899F391D6B5D8408B64
              Function 00F62582 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6e4e40bd55a77b8f2cc311f76781610793c76b37f63ad448394dd727207572de
              • Instruction ID: 471bc832361de14dd4b89ab783cdae32401dbb818f8d486274b29c1310e94c2f
              • Opcode Fuzzy Hash: 6e4e40bd55a77b8f2cc311f76781610793c76b37f63ad448394dd727207572de
              • Instruction Fuzzy Hash: 2DF0F433B41A20B7C7319B56CC40F47BAA9EB84BA0F144429B50A97640CA34ED01EBA0
              Function 00F8C073 Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
              • Instruction ID: 889f677a25e06575ce3c4c3e4bdc13ca5ed9ebf34caa8e7f3310cb17c09a2c2a
              • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
              • Instruction Fuzzy Hash: 52F0C2B2A00A10ABD324DF4DDC41E57F7EADFC4B90F048129B649C7220EA71DD04CB90
              Function 0103634F Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8158286640f7def27382d2caf28ab9ca41021aace7af44793c835832a6dc5df2
              • Instruction ID: d44b187e22a54539b76f6ac89611caba93fb678a9372adf1755acf0030533bee
              • Opcode Fuzzy Hash: 8158286640f7def27382d2caf28ab9ca41021aace7af44793c835832a6dc5df2
              • Instruction Fuzzy Hash: DD0144B1A1020DEFDB04DFA9D95199EB7F8EF88304F10805AF904E7351D778AB019BA1
              Function 0103625D Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f41deaddec0f2aca1e8d9d47158ed69d3341906d3a68fbb37412711803feff3f
              • Instruction ID: 9b7cae24fccc26a5ab583e76677687d655a8bb9440d446cf710fb4dbdd69ea9d
              • Opcode Fuzzy Hash: f41deaddec0f2aca1e8d9d47158ed69d3341906d3a68fbb37412711803feff3f
              • Instruction Fuzzy Hash: 860144B1A1060DEFCB04DFA9D8519AEB7F8EF48304F10805AF904E7351D778AA01DBA1
              Function 010362D6 Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9668faf814baf748dc690865a3ef74a8e685a4ae99765ffd9c44f9d9588252b7
              • Instruction ID: f3b64f36e36816aacc078c3dad13a8e6a98bf7354e64f656c8ff0b0857c2991d
              • Opcode Fuzzy Hash: 9668faf814baf748dc690865a3ef74a8e685a4ae99765ffd9c44f9d9588252b7
              • Instruction Fuzzy Hash: 470144B1A0020DEFDB04DFA9D8519AEB7F8EF48304F50845AF914E7351D774AE019BA1
              Function 00F5C310 Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
              • Instruction ID: d6552166c766f6d2a8b5aa8fafb7760724c72334f5a9e111d6727829fe127a91
              • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
              • Instruction Fuzzy Hash: A5F04C33204B329FC73217594C40B2BB6D58FC1B62F194035FB0B9B200C9A48C09B6D1
              Function 00F9CA6F Relevance: .0, Instructions: 42COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
              • Instruction ID: db6ae9ebd86aca9a3f4afd2f11dfbf2f5be4910748915d98f30d1e0aafbad7fd
              • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
              • Instruction Fuzzy Hash: D401F932600689ABD732D719CC05F59BB99EF42760F0C80A6FA04CB791DB7CCD01E251
              Function 010361E5 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e1777c6a642cbbff32f122f8c3fbb723902c3c02e209ce82fd65e555aae6d042
              • Instruction ID: 9143be54484fe333624e26b6c68e7f764eba71bbcca4f76944adad804a879396
              • Opcode Fuzzy Hash: e1777c6a642cbbff32f122f8c3fbb723902c3c02e209ce82fd65e555aae6d042
              • Instruction Fuzzy Hash: 8D018FB1A00648ABCB00DFA9D841AEEBBF8EF48310F14405AF504A7380D778EB01CBA5
              Function 00FE63C0 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
              • Instruction ID: 57b1d86762c10605213428c5351a2814647c0f26185ca1b4ba9399d4dd2d020d
              • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
              • Instruction Fuzzy Hash: E1F06D7220001DBFEF029F94DD81DAF7BBDEB583D8B104125FA00A2061D235DE21ABA0
              Function 00FEA4B0 Relevance: .0, Instructions: 40COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a1e8118d11bed82eded1d675157cd24954ec4eec347bc8348eda953c55154012
              • Instruction ID: 01136591903c54f66c88768500b6a41e79996c83c9f48c53b4b66716b2159965
              • Opcode Fuzzy Hash: a1e8118d11bed82eded1d675157cd24954ec4eec347bc8348eda953c55154012
              • Instruction Fuzzy Hash: 2F019736510259EBCF129F94DC40EDE3FA6FB4C764F0A8105FE1866224C236E970EB92
              Function 00F5C0F0 Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b66e08d2e428dfa314b04fba972a4a6a21851cbd6f28c6f29dc36446b34ed2a5
              • Instruction ID: f0ba9489a210026af5c8671e5b2c48dcbfc939a3e436597e1fa7c5be3440ee04
              • Opcode Fuzzy Hash: b66e08d2e428dfa314b04fba972a4a6a21851cbd6f28c6f29dc36446b34ed2a5
              • Instruction Fuzzy Hash: 8BF0BB727047015FE764A5159C01B623295D7D0B72F298075EF068B2D3E975DC05A7D4
              Function 00F9656A Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ee35cdc148a4434b7f73787027fa24b084e36a507655b18ce2044a2707af806f
              • Instruction ID: c30b625e5e976d346812f0a3caaa5d25c1237b760ec65960a2a4f1746b10af4b
              • Opcode Fuzzy Hash: ee35cdc148a4434b7f73787027fa24b084e36a507655b18ce2044a2707af806f
              • Instruction Fuzzy Hash: C001A4B16007C49BF736AB2CCD49B2533A9AB40B50F5D4191B905CBAD6D77CE801B621
              Function 0100437C Relevance: .0, Instructions: 37COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
              • Instruction ID: e8fe7076b4189623606f0ec5b633af417e94bc0c1e6fa6e1a3338f935a2b4531
              • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
              • Instruction Fuzzy Hash: 0DF0E935341D1347FBB7AA2D9860B2EB7D6AF80E00F05A56CA7C5DB6C0DF50D8008784
              Function 00FEC89D Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b9b4586326714b11d47195b52ebd502cfc0effdec3095efecb449a4e500a0701
              • Instruction ID: bb93ac86479bcaa0f117f38d960e0de8c7101ec970dcc135e391ef6d15a0544f
              • Opcode Fuzzy Hash: b9b4586326714b11d47195b52ebd502cfc0effdec3095efecb449a4e500a0701
              • Instruction Fuzzy Hash: 87F0C2B16057449FC310EF29CD42E1FB7E4EF88710F40865AB898DB391EA38EA01D796
              Function 00FEE872 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
              • Instruction ID: 2674d31b404c26d98b18e4f01229c14a541a8ea96f91458f2c7199c65befa3da
              • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
              • Instruction Fuzzy Hash: 6DF0E233B41691ABD3318E4AEC80F12B3A8EFD5B70F290025B508AB260C360ED01E7D0
              Function 00F90854 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
              • Instruction ID: 4a7aca0209cc8b24af009cc0761a026d6584fc1e3f1ec1c1740e827433d9dedb
              • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
              • Instruction Fuzzy Hash: 5DF0B472610204AFE714DB21CC01F56B2E9EF98750F1484789945D72A0FAB4DE01E694
              Function 00FEC912 Relevance: .0, Instructions: 34COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 11cc2e3ea33fdab801f44f3da13b14144ec375303931695c2169a717793f6164
              • Instruction ID: 4c3faecf0b9b8d8e36c0b013346f965444179db5f537499cbade87ff85faf934
              • Opcode Fuzzy Hash: 11cc2e3ea33fdab801f44f3da13b14144ec375303931695c2169a717793f6164
              • Instruction Fuzzy Hash: E7F062B0A0124DEFCB14EF69C515E5EB7B4EF48300F108056B859EB386DA78EB01DBA1
              Function 00F647FB Relevance: .0, Instructions: 33COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c09db9da2da8ce73c118bf172fe40dd45f1e471b5b2206eec9497ee09f1fef4f
              • Instruction ID: 0f5d60982d39920fce3fe78dd1ef792b56cc1cb9344145ebc034fb9aa2f08a49
              • Opcode Fuzzy Hash: c09db9da2da8ce73c118bf172fe40dd45f1e471b5b2206eec9497ee09f1fef4f
              • Instruction Fuzzy Hash: 2AF0BE32D166E0DFD733EBB8C444BA1B7D8AB10730F1C896AD49987502CB68FC84E651
              Function 01020115 Relevance: .0, Instructions: 32COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2464d2fb1bda64cad9741ccec41f1b96da60de9efe3991ec8a97a889564873f6
              • Instruction ID: f4e89f1b8901d5f25259b52c4342b62c8dd8cdceae5c1967a238d2053339b881
              • Opcode Fuzzy Hash: 2464d2fb1bda64cad9741ccec41f1b96da60de9efe3991ec8a97a889564873f6
              • Instruction Fuzzy Hash: 2CF05C774157D506CFB26B3CB8603D26FB8A741110F6914C9E8E05720DC67F8483C320
              Function 00F9C5ED Relevance: .0, Instructions: 31COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 684724820b940e8d3f5e502ee78a569cc9cb13974567e8df50b46cec7fa29e1a
              • Instruction ID: 63291a9043e5a8699666a92450d7bb601ee1c978e386dab11b1bc6532567a360
              • Opcode Fuzzy Hash: 684724820b940e8d3f5e502ee78a569cc9cb13974567e8df50b46cec7fa29e1a
              • Instruction Fuzzy Hash: 04F0E2729116509FEB329758C148B5177D8AB40BB0F189526E40EC7552C364CC80EAD1
              Function 00FA2619 Relevance: .0, Instructions: 31COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
              • Instruction ID: e13b3b865f6fe39d6ae816403251be772e2464b44046a4785a8d56b3557030ee
              • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
              • Instruction Fuzzy Hash: 91E0D872301A002BD7119E59CCC1F47776EEFC7B10F044479B5045F252C9E6DD0996A4
              Function 00FF6030 Relevance: .0, Instructions: 29COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
              • Instruction ID: 7304c8cf74223dfa8f75a940a80a8efc2f2ed51cc8e2357336224e1a6e8aa56d
              • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
              • Instruction Fuzzy Hash: 08F030725046089FE3208F05DD84F62B7E8EB05764F65C026E709DB561DB7AEC40EBA4
              Function 00F60710 Relevance: .0, Instructions: 28COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
              • Instruction ID: 0fb4c3994a1644751551baf762ff877331f0069c47a72affe0cb1af1905c603c
              • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
              • Instruction Fuzzy Hash: 31F0ED7A204354ABDB19DF16D040AE67BA8EB51360F204095E8468B341EB35FD82EF81
              Function 00F949D0 Relevance: .0, Instructions: 28COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
              • Instruction ID: c9416b00b335d04e08679a235f889e6ef482fd3142651d05880de8e048e794d6
              • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
              • Instruction Fuzzy Hash: E7E09233684546ABEB211E558C01F6677A59BE67B0F150429E1049B150DB7CEC42FB98
              Function 01034164 Relevance: .0, Instructions: 27COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f9509881aca1f2f2c44fa5eaec58bc317f32d0e1c148d8f250db9d97fb6bc124
              • Instruction ID: 40a90aecdcbb585824fad5ebcc72a6388ce35ed426e3cccd8d44cbf5437a2c19
              • Opcode Fuzzy Hash: f9509881aca1f2f2c44fa5eaec58bc317f32d0e1c148d8f250db9d97fb6bc124
              • Instruction Fuzzy Hash: 25F0E531A36D914FE7B2D72CE550F5177E8AB90730F0A05D4D484CF922C324DC80C690
              Function 0100678E Relevance: .0, Instructions: 27COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
              • Instruction ID: 0d5b72f3fdb91601a620e955c89907c3317056627774e2e9062c62a7bf8373c9
              • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
              • Instruction Fuzzy Hash: A3E0DF32A00110BBEB2297998D02F9ABEEDEB94FA0F050059B604E70D0E571EE00D690
              Function 010308C0 Relevance: .0, Instructions: 25COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
              • Instruction ID: 89e5b4f7ca1a19d0e306008b6ce8e64a3a3e35abfab65855a9b5e7def96d6e6d
              • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
              • Instruction Fuzzy Hash: 19E02B316413418BCB208F1DD100A93B7ECDFD5620F1480A9E9C407202C230F842C6D0
              Function 00F625E0 Relevance: .0, Instructions: 23COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: bf56ce753b22123de4221bfe0483ecd5149aa9bb836d41a2e52be80d9fe6dfa8
              • Instruction ID: f74607cb4c19fe71f5bfc7536d880fee9807a1372d695be41a7d489cd23407d4
              • Opcode Fuzzy Hash: bf56ce753b22123de4221bfe0483ecd5149aa9bb836d41a2e52be80d9fe6dfa8
              • Instruction Fuzzy Hash: A9E09272100A54ABC722BB29DD02F8B779AEB94364F014515B15557191CB39A910D794
              Function 0101A456 Relevance: .0, Instructions: 23COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
              • Instruction ID: 47e0d9bc8804ab9b5906da31fdf01ea0abb3a4e4de32c2b4fd031a6035d38fa4
              • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
              • Instruction Fuzzy Hash: BAE09231151650DFE7766F29DC49B927BE0BF80711F148C6DB1DA124B1CB7C98C0EA40
              Function 00FE4000 Relevance: .0, Instructions: 22COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
              • Instruction ID: f2e46887fbf03e644f2de210b52c62ae200854d71ad8e216bb50ba56dfd4e626
              • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
              • Instruction Fuzzy Hash: 9BE0AE347002458BD715CF1AC040B6277A6BFD5B20F28C079AA488F205EB32A8429A40
              Function 00F9CA38 Relevance: .0, Instructions: 22COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ae88b1dcea51e75435da71fa96fdc46032cd73ad7bb515af7d44c43f91369be4
              • Instruction ID: 6b78e6b4a015cf14a89f41f9ab5324747f6ce7356589e33de05adcf180c4325c
              • Opcode Fuzzy Hash: ae88b1dcea51e75435da71fa96fdc46032cd73ad7bb515af7d44c43f91369be4
              • Instruction Fuzzy Hash: 42D02B328814606ADF74F114BC14FD73A59AB55770F014861F10CD2010D55DCC81F3C4
              Function 00F5823B Relevance: .0, Instructions: 21COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
              • Instruction ID: cf8e559043f3d38fc257fed2e0402df67fbb9ac3cd5fb77d5f742a9aca5d4b35
              • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
              • Instruction Fuzzy Hash: 20E0CD32504910EFD7312F16DC01F517BA5FF94BA1F204819F545264758B745C86FF55
              Function 00F62050 Relevance: .0, Instructions: 20COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 42c51baa0c59d1b861344ffc1878f8a6c8154c6ea3850854240e9d11888cbd12
              • Instruction ID: 61d7cf7b2c25814fe7573e65c180d2766cb1997b440f17a8626a3c3c153715fe
              • Opcode Fuzzy Hash: 42c51baa0c59d1b861344ffc1878f8a6c8154c6ea3850854240e9d11888cbd12
              • Instruction Fuzzy Hash: FDE08C321005506BC712FA6DED42E4A739AEB94360F004221B155972D1CA29AD00D794
              Function 00F98A90 Relevance: .0, Instructions: 20COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
              • Instruction ID: 2b857a4dd2e4904d8682c696ad5fe31b87784a24990be8a2fa7fad5225f10da6
              • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
              • Instruction Fuzzy Hash: BBE08633511A149BC728DE18D512B7277A4EF45770F19463EA51347780C934E944D794
              Function 00FB6AA4 Relevance: .0, Instructions: 17COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
              • Instruction ID: b7add205d9bc6a3f1f4c2053dfd3d919940b65a61f25ce34a296f79d1daed671
              • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
              • Instruction Fuzzy Hash: EBD05E36511A50AFC7329F1BEE00C53BBF9FBC4B20705062FA54593920C674AC06EBA0
              Function 00F9E59C Relevance: .0, Instructions: 16COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
              • Instruction ID: aa4e3285b7e839076d6d42409a7267a0c852c66830b151aa19360750b5b8ab80
              • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
              • Instruction Fuzzy Hash: 08D0A7325045106BD7329A1CFC00FC333D9AB58721F05045AB008C7150C364AC41D644
              Function 00FDE908 Relevance: .0, Instructions: 16COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
              • Instruction ID: 26188d3ff4ee8e0aba4bc2c5640dbf58b4aec4428c9086ea65b2b1c56fc72a65
              • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
              • Instruction Fuzzy Hash: 84E0EC36951684AFDF12EF69DA50F5AB7F5BB84B50F590054A0086F661C628AD00EB81
              Function 00F5A0E3 Relevance: .0, Instructions: 15COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
              • Instruction ID: cb8a2266c7079424d02e688729459597e1140ae69f27abe1bdc417d712c68055
              • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
              • Instruction Fuzzy Hash: 83D02233226030A3CB2956606C00F637945AB80BA1F1A012D390AA3800C0088C53F6E2
              Function 00F9A830 Relevance: .0, Instructions: 14COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
              • Instruction ID: 8112403b69a287ade34f369b58328165431506b43a7cb4c95d0b00885bc4ff14
              • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
              • Instruction Fuzzy Hash: 3DD012371D054CBBDB129F65DC02F957BA9E754BA0F448021B508875A1C63AE950E585
              Function 00F9CA24 Relevance: .0, Instructions: 14COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2c225057435a1f257602a18012b8bbf0fae96298e8fda4ac0419205ca89f6f80
              • Instruction ID: c1fd4990cf2154effa90b5b2225e60e0ef17302aaca96a185882d0a86b6fde5b
              • Opcode Fuzzy Hash: 2c225057435a1f257602a18012b8bbf0fae96298e8fda4ac0419205ca89f6f80
              • Instruction Fuzzy Hash: 0BD0A731901106DBEF16CF14CD20E2E36B1EF14780B440069E60051120E72DDC02F650
              Function 00F702A0 Relevance: .0, Instructions: 13COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
              • Instruction ID: e1e050cf56343b37a818da4e15be3464c3c12f0e5db337c7da444460639a836c
              • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
              • Instruction Fuzzy Hash: 4DD0C936A16E80CFC71BCB0CC5A8F1533A4BF44B44F8144A1E405CBB22EA2CED40DA01
              Function 00F9C700 Relevance: .0, Instructions: 12COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
              • Instruction ID: 2a34c697fe597771f3dda6f93701f5bc73ecdea12814a5c59a1b4b4100c8c874
              • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
              • Instruction Fuzzy Hash: F8C01232150644AFD7129A94DD01F0177A9E798B40F004021F20447571C535E910E645
              Function 00F80310 Relevance: .0, Instructions: 11COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
              • Instruction ID: 2c5c7e182d99489719896a10b60f35a0dfd02ac404c81cfbd16be914115219f3
              • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
              • Instruction Fuzzy Hash: 2DD01236100248EFCB02EF41D890D9A772AFBC8710F508019FD19076118A35ED62DB50
              Function 00F60750 Relevance: .0, Instructions: 9COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
              • Instruction ID: 208b87d795fb3ef5deab2f0b945a8b38affc679a4ee9a4d54a24c15c8497edf5
              • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
              • Instruction Fuzzy Hash: CCC04C757015458FCF15DB1AD694F8577E4F744750F154890E809CB721E724ED01EA11
              Function 00FA4340 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3e579f9af8685e3cb0d9eed6f006caab90cf276bb377e0af9927b19bdc37c161
              • Instruction ID: a3b092f1f1f6fb2e285e1380d52766e3aaeb291a4bcff1f6bdedc6f8129d8438
              • Opcode Fuzzy Hash: 3e579f9af8685e3cb0d9eed6f006caab90cf276bb377e0af9927b19bdc37c161
              • Instruction Fuzzy Hash: 0190023160580022924071598C84586400D97E0341B55C022E0425594D8E188A57AB61
              Function 00FA4650 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 360b36cad9dfdbc9d2a3786a3260b43581c83c7b52cdfe0a0b197ccacb082531
              • Instruction ID: 3f86d215a448e75283293af1d2e0ca1a164b541e7b63f1aa911b9df31875c43e
              • Opcode Fuzzy Hash: 360b36cad9dfdbc9d2a3786a3260b43581c83c7b52cdfe0a0b197ccacb082531
              • Instruction Fuzzy Hash: 3290026160150052424071598C04446600D97E1341395C126A05555A0D8A1C8956EA69
              Function 00FA2AF0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6c48682c35da8efcd0a3d763a083944db239e030c85cc86ce0b7c367edc2ad24
              • Instruction ID: 99bbb21418f8141de1205d4e2a5968c4f8e0eff5dbc19b4111754663e9b0f43d
              • Opcode Fuzzy Hash: 6c48682c35da8efcd0a3d763a083944db239e030c85cc86ce0b7c367edc2ad24
              • Instruction Fuzzy Hash: AF900225221400120245B5594A0454B044D97D6391395C026F14175D0DCA258966AB21
              Function 00FA2AD0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 701588877eb0601f5195bf2b8c24780201df00e042f574d284f9c06034e8dcba
              • Instruction ID: b37d74ae61a2f7c984fb3f27224f6c6f480d3d8cb8fa27a12eb1f62c49aef4d6
              • Opcode Fuzzy Hash: 701588877eb0601f5195bf2b8c24780201df00e042f574d284f9c06034e8dcba
              • Instruction Fuzzy Hash: 4F900225211400130205B5594B04547004E87D5391355C032F1016590DDA258962A921
              Function 00FA2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 09c08339c0aea319e7e84d457985c07cbd20fee08b65845b127c1ccd1bf0aaba
              • Instruction ID: a91fca4c26f745f300b56b0bc54597563034b60572f76959023ed80e86b8afdf
              • Opcode Fuzzy Hash: 09c08339c0aea319e7e84d457985c07cbd20fee08b65845b127c1ccd1bf0aaba
              • Instruction Fuzzy Hash: CC9002A1201540A24600B259C804B4A450D87E0341B55C027E10555A0DC9298952E935
              Function 00FA2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6a6a4933bb96e093e9cf1a1809ab041c6850a9aa23f4174b4bb66fda8dfc3af1
              • Instruction ID: ae4f6a6fb114133f204992a012043de92c70af0ca0be88bed85a3cfc765914d1
              • Opcode Fuzzy Hash: 6a6a4933bb96e093e9cf1a1809ab041c6850a9aa23f4174b4bb66fda8dfc3af1
              • Instruction Fuzzy Hash: 0490023120140812D2807159880468A000D87D1341F95C026A0026694ECE198B5ABFA1
              Function 00FA2BE0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 18593c4d5deb221a68463330643cdb24155ca8f243daf8f382198b6b77f46abf
              • Instruction ID: ca243397622f7c758cee5436fbc37091b415213b23c5648386c126bda509ec49
              • Opcode Fuzzy Hash: 18593c4d5deb221a68463330643cdb24155ca8f243daf8f382198b6b77f46abf
              • Instruction Fuzzy Hash: 3690023120544852D24071598804A86001D87D0345F55C022A00656D4E9A298E56FE61
              Function 00FA2BA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 90d4f4fc4bd402a3f43b7c3da29b73eb82aa60c8be77ba1a2353b8bb6950c525
              • Instruction ID: 55dcafda70ebe4228e06bd195ad1be0736fef6940097c134cdf528cfe3ea3a7c
              • Opcode Fuzzy Hash: 90d4f4fc4bd402a3f43b7c3da29b73eb82aa60c8be77ba1a2353b8bb6950c525
              • Instruction Fuzzy Hash: DF90023160540812D25071598814786000D87D0341F55C022A0025694E8B598B56BEA1
              Function 00FA2B80 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 96639b73bb2ec28c332828ffaa7a49e35758fab7fe832f724a31bde186e85f16
              • Instruction ID: c7e8ab841b4ba48defd2b76510caab0e77e6aa35aa49d96702affc0bc2c131a4
              • Opcode Fuzzy Hash: 96639b73bb2ec28c332828ffaa7a49e35758fab7fe832f724a31bde186e85f16
              • Instruction Fuzzy Hash: E590023120140812D20471598C046C6000D87D0341F55C022A6025695F9A698992B931
              Function 00FA2CF0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5581fd2b3a222f5e1eba281e31ab91a986b0c311aeec3459b44737b5d2feab32
              • Instruction ID: 97e1d2013da9152f1df81b350c631686fbbf8feb0f9f38ce5e9ceb0e1b6a4d5d
              • Opcode Fuzzy Hash: 5581fd2b3a222f5e1eba281e31ab91a986b0c311aeec3459b44737b5d2feab32
              • Instruction Fuzzy Hash: 4F90023120140413D20071599908747000D87D0341F55D422A0425598EDA5A8952B921
              Function 00FA2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c74dff25e8ad925f1ce363e51ab9519aa7e850a17fb609813650338feef4fbf1
              • Instruction ID: 5891b1017d33b40f67c713bf04fe6e6b13c2161c455947e52054117448efef1a
              • Opcode Fuzzy Hash: c74dff25e8ad925f1ce363e51ab9519aa7e850a17fb609813650338feef4fbf1
              • Instruction Fuzzy Hash: C890022160540412D24071599818746001D87D0341F55D022A0025594ECA5D8B56BEA1
              Function 00FA2CA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e79b20403b355751dcefb45973a9bdd4ef2584fcd0a4482adf275e383743b667
              • Instruction ID: 80caca8221f9f677fefc855d4f389d926cee70ad3fde67d0775ff5c72a43f4db
              • Opcode Fuzzy Hash: e79b20403b355751dcefb45973a9bdd4ef2584fcd0a4482adf275e383743b667
              • Instruction Fuzzy Hash: D490023120140412D20075999808686000D87E0341F55D022A5025595FCA698992B931
              Function 00FA2C60 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 89df952e1a29c9a73ede26a11ccb990a47bc0f9d8e895659dc20c25941cc2d3e
              • Instruction ID: f0f40ce5f8c4ec1ed3ba551031604253709c338b57959480b9b0800dbd400522
              • Opcode Fuzzy Hash: 89df952e1a29c9a73ede26a11ccb990a47bc0f9d8e895659dc20c25941cc2d3e
              • Instruction Fuzzy Hash: 9A90023120140852D20071598804B86000D87E0341F55C027A0125694E8A19C952BD21
              Function 00FA2DD0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 332601dfb2fc146872e72fcf099ce144c3624101893f80468f45f363244fe5d9
              • Instruction ID: 5fe19c7583913f596dc89300420fd56b877135f3529c58684b996f4a77bc3ab2
              • Opcode Fuzzy Hash: 332601dfb2fc146872e72fcf099ce144c3624101893f80468f45f363244fe5d9
              • Instruction Fuzzy Hash: 2E900221242441625645B1598804547400E97E0381795C023A1415990D892A9957EE21
              Function 00FA2DB0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 89b74acba0a9b65afd391fdaf38f2c3bb1619b9aeab395ee79a898f0964dea44
              • Instruction ID: 11b08c63c3f82a0d16779b6cc7ce46036c88e9dafae5bab7bee2428777aaa467
              • Opcode Fuzzy Hash: 89b74acba0a9b65afd391fdaf38f2c3bb1619b9aeab395ee79a898f0964dea44
              • Instruction Fuzzy Hash: B590023124140412D24171598804646000D97D0381F95C023A0425594F8A598B57FE61
              Function 00FA2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a97d9d900a1cbf1c6377ad48387a1bac1f0f200d101b5fd16632520898d71527
              • Instruction ID: 73e4b20276320c7f05b0c421160031cd1ab1214d68379e312b2ce642ca895289
              • Opcode Fuzzy Hash: a97d9d900a1cbf1c6377ad48387a1bac1f0f200d101b5fd16632520898d71527
              • Instruction Fuzzy Hash: A190022130140013D24071599818646400DD7E1341F55D022E0415594DDD198957AA22
              Function 00FA2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 109a1e8761db1e10c8ec2a141f5ccfbd795b865be385832e5e24ad218fab9e38
              • Instruction ID: f837ec1cc86b8d2e3589bf3321564e26e0bf6fda600643bb72b6bc4ed5f1a6ab
              • Opcode Fuzzy Hash: 109a1e8761db1e10c8ec2a141f5ccfbd795b865be385832e5e24ad218fab9e38
              • Instruction Fuzzy Hash: 7B90022921340012D2807159980864A000D87D1342F95D426A0016598DCD19896AAB21
              Function 00FA2D00 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 86461f585d5d5ca2b8491a00a9f1ee51f9bdabe5892304369e9c114bbb61c827
              • Instruction ID: 343316d3778babc2014078e2d6ad79cca53c76bfe897223926d2e755fc541597
              • Opcode Fuzzy Hash: 86461f585d5d5ca2b8491a00a9f1ee51f9bdabe5892304369e9c114bbb61c827
              • Instruction Fuzzy Hash: DB90022120544452D20075599808A46000D87D0345F55D022A10655D5ECA398952F931
              Function 00FA2EE0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0410027c1b615086832b66163a122902c1f0c17d6fdaed493bc6a973ca174048
              • Instruction ID: 966d73bb5ba36d76330070f37821449b7511220dfabb7aef1ef5fb2046b39245
              • Opcode Fuzzy Hash: 0410027c1b615086832b66163a122902c1f0c17d6fdaed493bc6a973ca174048
              • Instruction Fuzzy Hash: 7090026120180413D24075598C04647000D87D0342F55C022A2065595F8E2D8D52B935
              Function 00FA2EA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e8a82d0eaa6a63b0e5eb95f697f655d003105be6e5166c72d3d678cc2a261a6f
              • Instruction ID: 9ad8c3458d80543564d95b9e767b6f7f51e4147c63c35160ead749ea85ae80cf
              • Opcode Fuzzy Hash: e8a82d0eaa6a63b0e5eb95f697f655d003105be6e5166c72d3d678cc2a261a6f
              • Instruction Fuzzy Hash: 2F90027120140412D24071598804786000D87D0341F55C022A5065594F8A5D8ED6BE65
              Function 00FA2E80 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2fd8df498b9999fe6cadef8bc04fd8daaf120351915c790d375d64a9c23a8d90
              • Instruction ID: 62ef8e32681a09d7c0984a491bcf424e107876cd2451b0714901998fc3c36661
              • Opcode Fuzzy Hash: 2fd8df498b9999fe6cadef8bc04fd8daaf120351915c790d375d64a9c23a8d90
              • Instruction Fuzzy Hash: C790022160140512D20171598804656000E87D0381F95C033A1025595FCE298A93F931
              Function 00FA2E30 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0c7957ecc0acb40f5636081356ebde4428d624f663dba70dc4b468e48d7cbffe
              • Instruction ID: 0d7f75ad45be9b499b1514e0083b1f219b7ad470c207000f1853693870aebfdc
              • Opcode Fuzzy Hash: 0c7957ecc0acb40f5636081356ebde4428d624f663dba70dc4b468e48d7cbffe
              • Instruction Fuzzy Hash: 8D90022130140412D20271598814646000DC7D1385F95C023E1425595E8A298A53F932
              Function 00FA2FE0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f66fdb74c97c212ac053cef237411ea26c9fc936f60f2eb5cd13eb969f5fcc4a
              • Instruction ID: a3f5f175dc953f226a751161c0bc6929de810481188910883c29e6d3e6f692bf
              • Opcode Fuzzy Hash: f66fdb74c97c212ac053cef237411ea26c9fc936f60f2eb5cd13eb969f5fcc4a
              • Instruction Fuzzy Hash: 03900221211C0052D30075698C14B47000D87D0343F55C126A0155594DCD198962AD21
              Function 00FA2FB0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 847790d0c64aeec137b49fa71e9ea481c3df5c347489b1fe1814a01f52f003fe
              • Instruction ID: 9b3a390038f3b97a0f922e78a8311a8692b3e8ebf25e05a264ba4de482bb5316
              • Opcode Fuzzy Hash: 847790d0c64aeec137b49fa71e9ea481c3df5c347489b1fe1814a01f52f003fe
              • Instruction Fuzzy Hash: 129002216014005242407169CC44946400DABE1351755C132A0999590E895D8966AE65
              Function 00FA2FA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 74c31c48933dc7f2d4d7b7e5dcf931657c4ed6a9750ce9406ddf8edac8ac605b
              • Instruction ID: 0fb0b2837b44dbeecad21fde48569d0c1e18a655cb8a7f054254cdf80f8bbdba
              • Opcode Fuzzy Hash: 74c31c48933dc7f2d4d7b7e5dcf931657c4ed6a9750ce9406ddf8edac8ac605b
              • Instruction Fuzzy Hash: 1A90023120180412D20071598C08787000D87D0342F55C022A5165595F8A69C992BD31
              Function 00FA2F90 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5f60483de2ef7765f4968eb815545a43e4737056ecbce2a1b17faffc6a968f4f
              • Instruction ID: 887a1f407d9db5bf11e5e139546073e63f3776fe66696f8aa186f14c332347a2
              • Opcode Fuzzy Hash: 5f60483de2ef7765f4968eb815545a43e4737056ecbce2a1b17faffc6a968f4f
              • Instruction Fuzzy Hash: F390023120180412D20071598C1474B000D87D0342F55C022A1165595E8A298952BD71
              Function 00FA2F60 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d8ed814cd5f47c370b2dff9909b3ffce74106b2ae55f279f0408bc76cab82208
              • Instruction ID: 657ed43ca1a61185b360c4b11954b8883195dfd9ca8b07feef61e04b9b85620f
              • Opcode Fuzzy Hash: d8ed814cd5f47c370b2dff9909b3ffce74106b2ae55f279f0408bc76cab82208
              • Instruction Fuzzy Hash: EB90026121140052D20471598804746004D87E1341F55C023A2155594DC92D8D62A925
              Function 00FA2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9fcf638fdc37dda32021ac48a7fe9d18b0a620b274f9024878eb31d8735f38f2
              • Instruction ID: 2bfe9e62c3087893bed50c4e1b9921ad277aac15ca5935519d4a37fbe67f546d
              • Opcode Fuzzy Hash: 9fcf638fdc37dda32021ac48a7fe9d18b0a620b274f9024878eb31d8735f38f2
              • Instruction Fuzzy Hash: 4490026134140452D20071598814B46000DC7E1341F55C026E1065594E8A1DCD53B926
              Function 00FA3090 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8b44d84aa35971896dcc5caaaedaa0d5cf28a395e9f6509c3d86ef8773bd2417
              • Instruction ID: dab99d41863e824b8857929351f3a086c8f1aee1c34150454f873a749955b41f
              • Opcode Fuzzy Hash: 8b44d84aa35971896dcc5caaaedaa0d5cf28a395e9f6509c3d86ef8773bd2417
              • Instruction Fuzzy Hash: C390022124140812D2407159C814747000EC7D0741F55C022A0025594E8A1A8A66BEB1
              Function 00FA3010 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9df56718bb3b87699dd603e01423889e0ca168bf31341f288e1ba8e10515a1ed
              • Instruction ID: 13e0651ee5084a03500c8a45766d1c38e68d41b7bd900d5db81f2d6d24a8fa94
              • Opcode Fuzzy Hash: 9df56718bb3b87699dd603e01423889e0ca168bf31341f288e1ba8e10515a1ed
              • Instruction Fuzzy Hash: 9590022120184452D24072598C04B4F410D87E1342F95C02AA4157594DCD198956AF21
              Function 00FA39B0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9950a85b304c99d4086120290a47a293ec40cb738d4de4aa6aec8e8141940c7f
              • Instruction ID: eacca70665be7ddaf4c66e1fdd2d0f99d3463bc20db2d634ae55bb8317d17e6f
              • Opcode Fuzzy Hash: 9950a85b304c99d4086120290a47a293ec40cb738d4de4aa6aec8e8141940c7f
              • Instruction Fuzzy Hash: E690022124545112D250715D8804656400DA7E0341F55C032A08155D4E89598956BA21
              Function 00FA3D70 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d508fe23dc56ba22cd1eec6aeee548c4920f250295287ec6d5552b05d8581367
              • Instruction ID: 6109111786066bfce5f6ab32bdc75561c40e1bf3db586d653aa5d1cfadc5be62
              • Opcode Fuzzy Hash: d508fe23dc56ba22cd1eec6aeee548c4920f250295287ec6d5552b05d8581367
              • Instruction Fuzzy Hash: 6290023520140412D61071599C04686004E87D0341F55D422A0425598E8A5889A2F921
              Function 00FA3D10 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fb0344c0901473276fecf0361df59da7a17abac55298acff33527740d1de33b3
              • Instruction ID: ddcbba6efa10a06a5bfb919e9e09e455ca28bbfa96d5c34e72a73ddc57a95744
              • Opcode Fuzzy Hash: fb0344c0901473276fecf0361df59da7a17abac55298acff33527740d1de33b3
              • Instruction Fuzzy Hash: 1790023120240152964072599C04A8E410D87E1342B95D426A0016594DCD188962AA21
              Function 00FA2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
              • Instruction ID: 9602f96c20a6d2849ca0a13a3a99dca8b55b73f4fcdf5f3fab07aaab70d2c151
              • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
              • Instruction Fuzzy Hash:
              Function 00FA2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
              • API String ID: 48624451-2108815105
              • Opcode ID: 8594d3d2a52cefed07596ce85f0401421b78aca9bfac303cd30d770e81d52885
              • Instruction ID: 1cd9c4e4cfdb3e88417120171004d16073f327883b2aeacef006c4d481ec5a67
              • Opcode Fuzzy Hash: 8594d3d2a52cefed07596ce85f0401421b78aca9bfac303cd30d770e81d52885
              • Instruction Fuzzy Hash: 7351E4F2F00116AECB50DB9CC980A7FF7B8BB09740B14822AE465D7641D638DE44BBA1
              Function 01012410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
              • API String ID: 48624451-2108815105
              • Opcode ID: 0fcf3752f4ff0e25dc00e34b5be4f40b32f38ff33f99641814b36236cf543c1b
              • Instruction ID: 0286aa9050236803d31bd3cca98d88b9961945533b33a04bdefa6d1be1f55ba1
              • Opcode Fuzzy Hash: 0fcf3752f4ff0e25dc00e34b5be4f40b32f38ff33f99641814b36236cf543c1b
              • Instruction Fuzzy Hash: DC510771A00645AFCB74DF9CCC9097FBBF8EB44300B648459F5D6C768AEA78DA409B60
              Function 00F97630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
              Download Yara Rule
              Strings
              • ExecuteOptions, xrefs: 00FD46A0
              • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00FD4655
              • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00FD4742
              • CLIENT(ntdll): Processing section info %ws..., xrefs: 00FD4787
              • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00FD4725
              • Execute=1, xrefs: 00FD4713
              • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00FD46FC
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
              • API String ID: 0-484625025
              • Opcode ID: ab97d4c6c94f7a01421202db1b15c9ff36be23593bfec874b89ab8b0214d7fd4
              • Instruction ID: a689f2348019e631bbcbb7b0cc9dd7603a268c2102e1fda78404c12e28d513cc
              • Opcode Fuzzy Hash: ab97d4c6c94f7a01421202db1b15c9ff36be23593bfec874b89ab8b0214d7fd4
              • Instruction Fuzzy Hash: 8D514931A043197BEF20BFA4DC86FEE77A8AF44310F1400A9E605A7191E771AE45EF51
              Function 01036940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
              • Instruction ID: 8d9ea07b410d81a7979f8edcd5852f6d8f02b3d56543ca976a5f41308c5b7fe1
              • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
              • Instruction Fuzzy Hash: AB0227B1508341AFD349DF18C890A6FBBE9EFC8700F04896DF9958B251DB72EA45CB52
              Function 00FAB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: __aulldvrm
              • String ID: +$-$0$0
              • API String ID: 1302938615-699404926
              • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
              • Instruction ID: 73e290a40378be5447d71d64f0b9dbc911f088fb043a8606f1571a76f639ac16
              • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
              • Instruction Fuzzy Hash: 028191B0E052499EDF24CF68C8517FEBBB5AF87320F184259E861A7393C7749841EB50
              Function 010120E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: %%%u$[$]:%u
              • API String ID: 48624451-2819853543
              • Opcode ID: 502dbb570c4c01dc57c71fea00580bdc107f29bb0355c9b270a1edd31536c035
              • Instruction ID: 0161f472e83cb0577c6f8da49ca87f0f72cf8043ba7bd24220bf485fb8808f27
              • Opcode Fuzzy Hash: 502dbb570c4c01dc57c71fea00580bdc107f29bb0355c9b270a1edd31536c035
              • Instruction Fuzzy Hash: 9921A3BAE00119ABDB10DF69CC40AEEBBE8EF58744F140156EA44E3205EB34DA019BA1
              Function 00F8F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
              Download Yara Rule
              Strings
              • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00FD02E7
              • RTL: Re-Waiting, xrefs: 00FD031E
              • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00FD02BD
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
              • API String ID: 0-2474120054
              • Opcode ID: a916b450f2e4f0c3a98f54e5c2b1d92803c23223ad1bfa4d36b27cff2388e597
              • Instruction ID: c733cb2562bd7c77fc060661244c083fe3774ac7b634fd3abc3e671d917cbf32
              • Opcode Fuzzy Hash: a916b450f2e4f0c3a98f54e5c2b1d92803c23223ad1bfa4d36b27cff2388e597
              • Instruction Fuzzy Hash: 59E1E231A047419FD725DF28C885B6AB7E1BF84324F240A2EF4A58B3D1DB74D848EB52
              Function 00F9BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
              Download Yara Rule
              Strings
              • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00FD7B7F
              • RTL: Re-Waiting, xrefs: 00FD7BAC
              • RTL: Resource at %p, xrefs: 00FD7B8E
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
              • API String ID: 0-871070163
              • Opcode ID: 9e1485050e3951eb234f46f6f013fc3972694fe1b56c75c4bd79e4d0d4d054d1
              • Instruction ID: 3553ca676f17e3016472719a22156549a965037eb54f4347aab465c372093e15
              • Opcode Fuzzy Hash: 9e1485050e3951eb234f46f6f013fc3972694fe1b56c75c4bd79e4d0d4d054d1
              • Instruction Fuzzy Hash: 644116317047029FDB20DE25DD41B6AB7E5EF88724F100A1EF956DB380DB71E805AB91
              Function 00F9B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
              Download Yara Rule
              APIs
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FD728C
              Strings
              • RTL: Re-Waiting, xrefs: 00FD72C1
              • RTL: Resource at %p, xrefs: 00FD72A3
              • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00FD7294
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
              • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
              • API String ID: 885266447-605551621
              • Opcode ID: 1d7d56d38a81bdc978e2104bf8a1b2414e87588921796fff123b6ebe4d14abdc
              • Instruction ID: d87ce0fd6a6ef30ad8f8114c3573e0ccc708aac0281be7251dbb8eebee7f509e
              • Opcode Fuzzy Hash: 1d7d56d38a81bdc978e2104bf8a1b2414e87588921796fff123b6ebe4d14abdc
              • Instruction Fuzzy Hash: FE410731B04352ABDB21EE25CC42B6AB7A5FF84721F140619F955DB381EB21E806BBD1
              Function 01012300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: %%%u$]:%u
              • API String ID: 48624451-3050659472
              • Opcode ID: 78093e83a9be9b0211f0c0e93602a836f6ca4d6e4c00be9d7bb79dbd3e5a1cec
              • Instruction ID: e5bf4c15f6efd8aa5a7a1e46f30e3d91d63aee21e53b67b55a7555401c1ef4f1
              • Opcode Fuzzy Hash: 78093e83a9be9b0211f0c0e93602a836f6ca4d6e4c00be9d7bb79dbd3e5a1cec
              • Instruction Fuzzy Hash: 7331A472A002199FDB60DE2DCC41BEFB7F8EB44750F544495E989E3245EB34EA449FA0
              Function 00FA7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID: __aulldvrm
              • String ID: +$-
              • API String ID: 1302938615-2137968064
              • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
              • Instruction ID: b153eeff31029cae7041e2ac3ae373f58d318e6d34dd55b0a1302ec4c147c388
              • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
              • Instruction Fuzzy Hash: E891B4F1E083059EDF24EF69CC81EBEB7A5AF46330F24451AE855A72C0D7749E41A760
              Function 00F69126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000005.00000002.2300193411.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_5_2_f30000_906982022050120220531MES_S Quote.jbxd
              Similarity
              • API ID:
              • String ID: $$@
              • API String ID: 0-1194432280
              • Opcode ID: 1e1c5eb65dde115b9f938869ee713bd682fc9949ec0657d1945245c7faecbf20
              • Instruction ID: 44f0010227c5e16b3cdd7fa9a28ba8308bd629b87d73867827e808774fd8a774
              • Opcode Fuzzy Hash: 1e1c5eb65dde115b9f938869ee713bd682fc9949ec0657d1945245c7faecbf20
              • Instruction Fuzzy Hash: 0E814C71D002699BDB31CB54CD45BEEB7B8EF48710F1041EAA909B7280E7745E84EFA0