Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
INVOICE.exe

Overview

General Information

Sample name:INVOICE.exe
Analysis ID:1520625
MD5:a008e7dd0417d4b3122820c73bf6631a
SHA1:9085f03e0a56782d3d780c5df3079af723e6093b
SHA256:175063717f1764ce13bf928d3f25133299ed5d61f241d63e02d29f6b2d67f4f4
Tags:exeuser-TeamDreier
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
.NET source code references suspicious native API functions
AI detected suspicious sample
Allocates memory in foreign processes
Creates an undocumented autostart registry key
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • INVOICE.exe (PID: 5892 cmdline: "C:\Users\user\Desktop\INVOICE.exe" MD5: A008E7DD0417D4B3122820C73BF6631A)
    • notepad.exe (PID: 5512 cmdline: "C:\Windows\System32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)
    • calc.exe (PID: 5596 cmdline: "C:\Windows\System32\calc.exe" MD5: 5DA8C98136D98DFEC4716EDD79C7145F)
    • cmd.exe (PID: 2968 cmdline: "C:\Windows\System32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • iexplore.exe (PID: 6024 cmdline: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" MD5: 6F0F06D6AB125A99E43335427066A4A1)
    • WerFault.exe (PID: 1096 cmdline: C:\Windows\system32\WerFault.exe -u -p 5892 -s 1088 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
    • findstr.exe (PID: 1120 cmdline: "C:\Windows\SysWOW64\findstr.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
    • findstr.exe (PID: 1276 cmdline: "C:\Windows\SysWOW64\findstr.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
    0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2bed0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13fef:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x2bed0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x13fef:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        Click to see the 6 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        5.2.iexplore.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          5.2.iexplore.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2f1b3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x172d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          5.2.iexplore.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            5.2.iexplore.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2e3b3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x164d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: CurrentVersion Autorun Keys Modification
            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\Internet Explorer\iexplore.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\findstr.exe, ProcessId: 1276, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XXVLVHS08H

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: INVOICE.exeReversingLabs: Detection: 52%
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: INVOICE.exeJoe Sandbox ML: detected

            Exploits

            barindex
            Yara detected UAC Bypass using CMSTP
            Source: Yara matchFile source: 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: INVOICE.exe PID: 5892, type: MEMORYSTR
            Source: INVOICE.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: findstr.pdbGCTL source: iexplore.exe, 00000005.00000003.2452401501.0000000003695000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: iexplore.pdbUGP source: INVOICE.exe, 00000000.00000002.2533612073.000000001F03C000.00000004.00000001.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916480740.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3915876487.0000000002955000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4532649733.00000000105AC000.00000004.00000001.00040000.00000000.sdmp
            Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb: source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF10000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbolean)e source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF10000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: System.ni.pdbRSDS source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbID source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: iexplore.exe, 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2158417148.000000000378C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2160433953.0000000003939000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000003.2452511177.0000000002857000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000003.2454489356.0000000002A09000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: findstr.pdb source: iexplore.exe, 00000005.00000003.2452401501.0000000003695000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: iexplore.exe, iexplore.exe, 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2158417148.000000000378C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2160433953.0000000003939000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, findstr.exe, 0000000C.00000003.2452511177.0000000002857000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000003.2454489356.0000000002A09000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb" source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\mscorlib.pdb6U source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: .pdbHJ source: INVOICE.exe, 00000000.00000002.2536544450.000000C396523000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: System.Core.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbDD source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: .pdb[ source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbphic Provider source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\mscorlib.pdb source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: System.Core.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb# source: INVOICE.exe, 00000000.00000002.2553461109.00000285393F0000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb9 source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.pdbh source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: System.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: System.Core.ni.pdbRSDS source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: iexplore.pdb source: INVOICE.exe, 00000000.00000002.2533612073.000000001F03C000.00000004.00000001.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916480740.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3915876487.0000000002955000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4532649733.00000000105AC000.00000004.00000001.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 4x nop then mov ebx, 00000004h0_2_027AC66D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 4x nop then mov ebx, 00000004h5_2_036104DE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 4x nop then mov ebx, 00000004h5_2_03A804DE
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 4x nop then mov ebx, 00000004h12_2_02AD04DE
            Source: explorer.exe, 0000000E.00000002.4526405649.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
            Source: explorer.exe, 0000000E.00000000.3837886482.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4522017851.0000000000F13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
            Source: explorer.exe, 0000000E.00000002.4526405649.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
            Source: explorer.exe, 0000000E.00000002.4526405649.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
            Source: explorer.exe, 0000000E.00000002.4526405649.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: explorer.exe, 0000000E.00000002.4526405649.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
            Source: explorer.exe, 0000000E.00000000.3841643921.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.4525411811.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.3841607303.0000000008870000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
            Source: Amcache.hve.8.drString found in binary or memory: http://upx.sf.net
            Source: explorer.exe, 0000000E.00000003.3858159922.000000000C549000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4530113471.000000000C549000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3844621759.000000000C549000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
            Source: explorer.exe, 0000000E.00000002.4524366956.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3840035493.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3857515555.00000000076F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
            Source: explorer.exe, 0000000E.00000003.3851770477.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
            Source: explorer.exe, 0000000E.00000000.3840035493.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4524366956.0000000007637000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
            Source: explorer.exe, 0000000E.00000002.4523164286.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3838930768.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3856012806.00000000035FA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.coml
            Source: explorer.exe, 0000000E.00000003.3855253684.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
            Source: explorer.exe, 0000000E.00000003.3855253684.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
            Source: explorer.exe, 0000000E.00000000.3844621759.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4530113471.000000000C460000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcember
            Source: explorer.exe, 0000000E.00000002.4526405649.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/)s
            Source: explorer.exe, 0000000E.00000002.4526405649.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comon

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 5.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 5.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: INVOICE.exe
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B02BB NtResumeThread,0_2_027B02BB
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B00A9 SleepEx,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_027B00A9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0042C483 NtClose,5_2_0042C483
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B535C0 NtCreateMutant,LdrInitializeThunk,5_2_03B535C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52B60 NtClose,LdrInitializeThunk,5_2_03B52B60
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_03B52DF0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_03B52C70
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B54340 NtSetContextThread,5_2_03B54340
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B53090 NtSetValueKey,5_2_03B53090
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B53010 NtOpenDirectoryObject,5_2_03B53010
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B54650 NtSuspendThread,5_2_03B54650
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52BA0 NtEnumerateValueKey,5_2_03B52BA0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52B80 NtQueryInformationFile,5_2_03B52B80
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52BF0 NtAllocateVirtualMemory,5_2_03B52BF0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52BE0 NtQueryValueKey,5_2_03B52BE0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52AB0 NtWaitForSingleObject,5_2_03B52AB0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52AF0 NtWriteFile,5_2_03B52AF0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52AD0 NtReadFile,5_2_03B52AD0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B539B0 NtGetContextThread,5_2_03B539B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52FB0 NtResumeThread,5_2_03B52FB0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52FA0 NtQuerySection,5_2_03B52FA0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52F90 NtProtectVirtualMemory,5_2_03B52F90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52FE0 NtCreateFile,5_2_03B52FE0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52F30 NtCreateSection,5_2_03B52F30
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52F60 NtCreateProcessEx,5_2_03B52F60
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52EA0 NtAdjustPrivilegesToken,5_2_03B52EA0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52E80 NtReadVirtualMemory,5_2_03B52E80
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52EE0 NtQueueApcThread,5_2_03B52EE0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52E30 NtWriteVirtualMemory,5_2_03B52E30
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52DB0 NtEnumerateKey,5_2_03B52DB0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52DD0 NtDelayExecution,5_2_03B52DD0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52D30 NtUnmapViewOfSection,5_2_03B52D30
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52D10 NtMapViewOfSection,5_2_03B52D10
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B53D10 NtOpenProcessToken,5_2_03B53D10
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52D00 NtSetInformationFile,5_2_03B52D00
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B53D70 NtOpenThread,5_2_03B53D70
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52CA0 NtQueryInformationToken,5_2_03B52CA0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52CF0 NtOpenProcess,5_2_03B52CF0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52CC0 NtQueryVirtualMemory,5_2_03B52CC0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52C00 NtQueryInformationProcess,5_2_03B52C00
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52C60 NtCreateKey,5_2_03B52C60
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0362356A NtSetContextThread,5_2_0362356A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03623BB6 NtResumeThread,5_2_03623BB6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03623889 NtSuspendThread,5_2_03623889
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A93BB6 NtResumeThread,5_2_03A93BB6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A93889 NtSuspendThread,5_2_03A93889
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A9356A NtSetContextThread,5_2_03A9356A
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C23090 NtSetValueKey,LdrInitializeThunk,12_2_02C23090
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C235C0 NtCreateMutant,LdrInitializeThunk,12_2_02C235C0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22AD0 NtReadFile,LdrInitializeThunk,12_2_02C22AD0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22B60 NtClose,LdrInitializeThunk,12_2_02C22B60
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22FE0 NtCreateFile,LdrInitializeThunk,12_2_02C22FE0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22F30 NtCreateSection,LdrInitializeThunk,12_2_02C22F30
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22CA0 NtQueryInformationToken,LdrInitializeThunk,12_2_02C22CA0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22C60 NtCreateKey,LdrInitializeThunk,12_2_02C22C60
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22C70 NtFreeVirtualMemory,LdrInitializeThunk,12_2_02C22C70
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22DD0 NtDelayExecution,LdrInitializeThunk,12_2_02C22DD0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22DF0 NtQuerySystemInformation,LdrInitializeThunk,12_2_02C22DF0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22D10 NtMapViewOfSection,LdrInitializeThunk,12_2_02C22D10
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C24340 NtSetContextThread,12_2_02C24340
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C23010 NtOpenDirectoryObject,12_2_02C23010
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C24650 NtSuspendThread,12_2_02C24650
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22AF0 NtWriteFile,12_2_02C22AF0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22AB0 NtWaitForSingleObject,12_2_02C22AB0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22BE0 NtQueryValueKey,12_2_02C22BE0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22BF0 NtAllocateVirtualMemory,12_2_02C22BF0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22B80 NtQueryInformationFile,12_2_02C22B80
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22BA0 NtEnumerateValueKey,12_2_02C22BA0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C239B0 NtGetContextThread,12_2_02C239B0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22EE0 NtQueueApcThread,12_2_02C22EE0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22E80 NtReadVirtualMemory,12_2_02C22E80
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22EA0 NtAdjustPrivilegesToken,12_2_02C22EA0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22E30 NtWriteVirtualMemory,12_2_02C22E30
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22F90 NtProtectVirtualMemory,12_2_02C22F90
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22FA0 NtQuerySection,12_2_02C22FA0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22FB0 NtResumeThread,12_2_02C22FB0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22F60 NtCreateProcessEx,12_2_02C22F60
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22CC0 NtQueryVirtualMemory,12_2_02C22CC0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22CF0 NtOpenProcess,12_2_02C22CF0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22C00 NtQueryInformationProcess,12_2_02C22C00
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22DB0 NtEnumerateKey,12_2_02C22DB0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C23D70 NtOpenThread,12_2_02C23D70
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22D00 NtSetInformationFile,12_2_02C22D00
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C23D10 NtOpenProcessToken,12_2_02C23D10
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C22D30 NtUnmapViewOfSection,12_2_02C22D30
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADF1F9 NtQueryInformationProcess,NtClose,12_2_02ADF1F9
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AE3898 NtSuspendThread,12_2_02AE3898
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027BA6620_2_027BA662
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B9A670_2_027B9A67
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027C14FB0_2_027C14FB
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027BA5470_2_027BA547
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B8D170_2_027B8D17
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027BA9FB0_2_027BA9FB
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE45F00_2_00007FF848CE45F0
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE09090_2_00007FF848CE0909
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CF4A5C0_2_00007FF848CF4A5C
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE33D00_2_00007FF848CE33D0
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE8B300_2_00007FF848CE8B30
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE8B280_2_00007FF848CE8B28
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CEE8650_2_00007FF848CEE865
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CF4ABF0_2_00007FF848CF4ABF
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CF43790_2_00007FF848CF4379
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004184735_2_00418473
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004030605_2_00403060
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004010005_2_00401000
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040118B5_2_0040118B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004011905_2_00401190
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0042EAA35_2_0042EAA3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004013005_2_00401300
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004024E05_2_004024E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040FCAC5_2_0040FCAC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040FCB35_2_0040FCB3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004166435_2_00416643
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040FED35_2_0040FED3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040DEF75_2_0040DEF7
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040DF495_2_0040DF49
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0040DF535_2_0040DF53
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B6739A5_2_03B6739A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E3F05_2_03B2E3F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE03E65_2_03BE03E6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD132D5_2_03BD132D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDA3525_2_03BDA352
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0D34C5_2_03B0D34C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B252A05_2_03B252A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C05_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC02745_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2B1B05_2_03B2B1B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE01AA5_2_03BE01AA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD81CC5_2_03BD81CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBA1185_2_03BBA118
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B101005_2_03B10100
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F1725_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BEB16B5_2_03BEB16B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B5516C5_2_03B5516C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD70E95_2_03BD70E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDF0E05_2_03BDF0E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF0CC5_2_03BCF0CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C05_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDF7B05_2_03BDF7B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1C7C05_2_03B1C7C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B207705_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B447505_2_03B44750
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3C6E05_2_03B3C6E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD16CC5_2_03BD16CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBD5B05_2_03BBD5B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE05915_2_03BE0591
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B205355_2_03B20535
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD75715_2_03BD7571
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCE4F65_2_03BCE4F6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDF43F5_2_03BDF43F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B114605_2_03B11460
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD24465_2_03BD2446
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3FB805_2_03B3FB80
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B5DBF95_2_03B5DBF9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD6BD75_2_03BD6BD7
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDFB765_2_03BDFB76
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDAB405_2_03BDAB40
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B65AA05_2_03B65AA0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBDAAC5_2_03BBDAAC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1EA805_2_03B1EA80
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCDAC65_2_03BCDAC6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B93A6C5_2_03B93A6C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDFA495_2_03BDFA49
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD7A465_2_03BD7A46
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B229A05_2_03B229A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BEA9A65_2_03BEA9A6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B369625_2_03B36962
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B299505_2_03B29950
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B9505_2_03B3B950
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B068B85_2_03B068B8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4E8F05_2_03B4E8F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B238E05_2_03B238E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8D8005_2_03B8D800
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B228405_2_03B22840
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2A8405_2_03B2A840
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDFFB15_2_03BDFFB1
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21F925_2_03B21F92
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2CFE05_2_03B2CFE0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B12FC85_2_03B12FC8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B40F305_2_03B40F30
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B62F285_2_03B62F28
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDFF095_2_03BDFF09
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B94F405_2_03B94F40
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B29EB05_2_03B29EB0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B32E905_2_03B32E90
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDCE935_2_03BDCE93
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDEEDB5_2_03BDEEDB
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDEE265_2_03BDEE26
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20E595_2_03B20E59
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B38DBF5_2_03B38DBF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1ADE05_2_03B1ADE0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3FDC05_2_03B3FDC0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2AD005_2_03B2AD00
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD7D735_2_03BD7D73
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD1D5A5_2_03BD1D5A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B23D405_2_03B23D40
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0CB55_2_03BC0CB5
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B10CF25_2_03B10CF2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDFCF25_2_03BDFCF2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B99C325_2_03B99C32
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20C005_2_03B20C00
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0362536C5_2_0362536C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0361E3B85_2_0361E3B8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0361E4D35_2_0361E4D3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0361CB885_2_0361CB88
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0361E86C5_2_0361E86C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_0361D8D85_2_0361D8D8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A8E3B85_2_03A8E3B8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A8CB885_2_03A8CB88
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A9536C5_2_03A9536C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A8D8D85_2_03A8D8D8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A8E86C5_2_03A8E86C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03A8E4D35_2_03A8E4D3
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C0B2C012_2_02C0B2C0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF52A012_2_02BF52A0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C912ED12_2_02C912ED
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C9027412_2_02C90274
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CB03E612_2_02CB03E6
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BFE3F012_2_02BFE3F0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C3739A12_2_02C3739A
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAA35212_2_02CAA352
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA132D12_2_02CA132D
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BDD34C12_2_02BDD34C
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C9F0CC12_2_02C9F0CC
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA70E912_2_02CA70E9
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAF0E012_2_02CAF0E0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF70C012_2_02BF70C0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA81CC12_2_02CA81CC
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BFB1B012_2_02BFB1B0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CB01AA12_2_02CB01AA
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C7815812_2_02C78158
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CBB16B12_2_02CBB16B
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C2516C12_2_02C2516C
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BE010012_2_02BE0100
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BDF17212_2_02BDF172
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C8A11812_2_02C8A118
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA16CC12_2_02CA16CC
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C0C6E012_2_02C0C6E0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAF7B012_2_02CAF7B0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BEC7C012_2_02BEC7C0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C1475012_2_02C14750
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF077012_2_02BF0770
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C9E4F612_2_02C9E4F6
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA244612_2_02CA2446
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BE146012_2_02BE1460
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAF43F12_2_02CAF43F
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CB059112_2_02CB0591
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C8D5B012_2_02C8D5B0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF053512_2_02BF0535
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA757112_2_02CA7571
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C9DAC612_2_02C9DAC6
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BEEA8012_2_02BEEA80
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C35AA012_2_02C35AA0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C8DAAC12_2_02C8DAAC
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAFA4912_2_02CAFA49
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA7A4612_2_02CA7A46
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C63A6C12_2_02C63A6C
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA6BD712_2_02CA6BD7
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C65BF012_2_02C65BF0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C2DBF912_2_02C2DBF9
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C0FB8012_2_02C0FB80
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAAB4012_2_02CAAB40
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAFB7612_2_02CAFB76
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BD68B812_2_02BD68B8
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C1E8F012_2_02C1E8F0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF38E012_2_02BF38E0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C5D80012_2_02C5D800
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BFA84012_2_02BFA840
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF284012_2_02BF2840
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF29A012_2_02BF29A0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CBA9A612_2_02CBA9A6
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C0B95012_2_02C0B950
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C0696212_2_02C06962
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF995012_2_02BF9950
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF9EB012_2_02BF9EB0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAEEDB12_2_02CAEEDB
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C02E9012_2_02C02E90
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CACE9312_2_02CACE93
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF0E5912_2_02BF0E59
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAEE2612_2_02CAEE26
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF1F9212_2_02BF1F92
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BFCFE012_2_02BFCFE0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BE2FC812_2_02BE2FC8
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAFFB112_2_02CAFFB1
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C64F4012_2_02C64F40
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAFF0912_2_02CAFF09
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C32F2812_2_02C32F28
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C10F3012_2_02C10F30
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CAFCF212_2_02CAFCF2
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BE0CF212_2_02BE0CF2
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C90CB512_2_02C90CB5
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF0C0012_2_02BF0C00
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C69C3212_2_02C69C32
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C0FDC012_2_02C0FDC0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BEADE012_2_02BEADE0
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02C08DBF12_2_02C08DBF
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA1D5A12_2_02CA1D5A
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02CA7D7312_2_02CA7D73
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BFAD0012_2_02BFAD00
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BF3D4012_2_02BF3D40
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADF1F912_2_02ADF1F9
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADE3B812_2_02ADE3B8
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADCB8812_2_02ADCB88
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AE536C12_2_02AE536C
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADD8D812_2_02ADD8D8
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADE86C12_2_02ADE86C
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADE4D312_2_02ADE4D3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 03B0B970 appears 268 times
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 03B8EA12 appears 86 times
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 03B9F290 appears 105 times
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 03B67E54 appears 89 times
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 03B55130 appears 36 times
            Source: C:\Windows\SysWOW64\findstr.exeCode function: String function: 02C6F290 appears 105 times
            Source: C:\Windows\SysWOW64\findstr.exeCode function: String function: 02C25130 appears 36 times
            Source: C:\Windows\SysWOW64\findstr.exeCode function: String function: 02C5EA12 appears 86 times
            Source: C:\Windows\SysWOW64\findstr.exeCode function: String function: 02C37E54 appears 96 times
            Source: C:\Windows\SysWOW64\findstr.exeCode function: String function: 02BDB970 appears 268 times
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5892 -s 1088
            Source: INVOICE.exeStatic PE information: No import functions for PE file found
            Source: INVOICE.exe, 00000000.00000000.2056775843.000002851ED62000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameTransponer.exe6 vs INVOICE.exe
            Source: INVOICE.exe, 00000000.00000002.2533612073.000000001F03C000.00000004.00000001.00040000.00000000.sdmpBinary or memory string: OriginalFilenameIEXPLORE.EXED vs INVOICE.exe
            Source: INVOICE.exeBinary or memory string: OriginalFilenameTransponer.exe6 vs INVOICE.exe
            Source: 5.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 5.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb:
            Source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
            Source: classification engineClassification label: mal100.troj.expl.evad.winEXE@14/5@0/0
            Source: C:\Users\user\Desktop\INVOICE.exeMutant created: NULL
            Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5892
            Source: C:\Windows\System32\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\0360b571-d98e-4180-b8ae-bcd426970e44Jump to behavior
            Source: INVOICE.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: INVOICE.exeStatic file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
            Source: C:\Users\user\Desktop\INVOICE.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: INVOICE.exeReversingLabs: Detection: 52%
            Source: C:\Users\user\Desktop\INVOICE.exeFile read: C:\Users\user\Desktop\INVOICE.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\INVOICE.exe "C:\Users\user\Desktop\INVOICE.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\calc.exe "C:\Windows\System32\calc.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5892 -s 1088
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\calc.exe "C:\Windows\System32\calc.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: INVOICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: INVOICE.exeStatic file information: File size 3255839 > 1048576
            Source: INVOICE.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: findstr.pdbGCTL source: iexplore.exe, 00000005.00000003.2452401501.0000000003695000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: iexplore.pdbUGP source: INVOICE.exe, 00000000.00000002.2533612073.000000001F03C000.00000004.00000001.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916480740.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3915876487.0000000002955000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4532649733.00000000105AC000.00000004.00000001.00040000.00000000.sdmp
            Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb: source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF10000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbolean)e source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF10000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: System.ni.pdbRSDS source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbID source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: iexplore.exe, 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2158417148.000000000378C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2160433953.0000000003939000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000003.2452511177.0000000002857000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000003.2454489356.0000000002A09000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: findstr.pdb source: iexplore.exe, 00000005.00000003.2452401501.0000000003695000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: iexplore.exe, iexplore.exe, 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2158417148.000000000378C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000003.2160433953.0000000003939000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, findstr.exe, 0000000C.00000003.2452511177.0000000002857000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 0000000C.00000003.2454489356.0000000002A09000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb" source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\mscorlib.pdb6U source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: .pdbHJ source: INVOICE.exe, 00000000.00000002.2536544450.000000C396523000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: System.Core.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbDD source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: .pdb[ source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbphic Provider source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\mscorlib.pdb source: INVOICE.exe, 00000000.00000002.2537107832.000002851EF73000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: System.Core.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb# source: INVOICE.exe, 00000000.00000002.2553461109.00000285393F0000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb9 source: INVOICE.exe, 00000000.00000002.2553461109.000002853942F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Microsoft.VisualBasic.pdbh source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: System.ni.pdb source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: System.Core.ni.pdbRSDS source: WER9D5C.tmp.dmp.8.dr
            Source: Binary string: iexplore.pdb source: INVOICE.exe, 00000000.00000002.2533612073.000000001F03C000.00000004.00000001.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3916480740.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 0000000C.00000002.3915876487.0000000002955000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4532649733.00000000105AC000.00000004.00000001.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B7A1F push cs; iretd 0_2_027B7A51
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027C1331 push eax; ret 0_2_027C1333
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B6B1E push edi; ret 0_2_027B6B26
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027BCBF7 push edx; iretd 0_2_027BCC4C
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B77D7 push esi; retf 0_2_027B7878
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B9057 push es; iretd 0_2_027B905D
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B9037 push edx; retf 0_2_027B904C
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B088B push 78AE3EF4h; ret 0_2_027B0898
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B3560 pushad ; retf 0_2_027B35C8
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B3567 pushad ; retf 0_2_027B35C8
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B3538 pushad ; retf 0_2_027B35C8
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B35D2 pushad ; retf 0_2_027B35C8
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_027B95D0 push ebx; retf 0_2_027B95D1
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE6FB0 push esp; retf 5F4Ch0_2_00007FF848CF5BC9
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848CE00BD pushad ; iretd 0_2_00007FF848CE00C1
            Source: C:\Users\user\Desktop\INVOICE.exeCode function: 0_2_00007FF848DB026B push esp; retf 4810h0_2_00007FF848DB0312
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02BE09AD push ecx; mov dword ptr [esp], ecx12_2_02BE09B6
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AE0A68 push edx; iretd 12_2_02AE0ABD
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AD73A9 pushad ; retf 12_2_02AD7439
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AD73D8 pushad ; retf 12_2_02AD7439
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AD73D1 pushad ; retf 12_2_02AD7439
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADB890 push cs; iretd 12_2_02ADB8C2
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AE51A2 push eax; ret 12_2_02AE51A4
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADA98F push edi; ret 12_2_02ADA997
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADCEA8 push edx; retf 12_2_02ADCEBD
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AD46FC push 78AE3EF4h; ret 12_2_02AD4709
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADCEC8 push es; iretd 12_2_02ADCECE
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADB648 push esi; retf 12_2_02ADB6E9
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02ADD441 push ebx; retf 12_2_02ADD442
            Source: C:\Windows\SysWOW64\findstr.exeCode function: 12_2_02AD7443 pushad ; retf 12_2_02AD7439

            Boot Survival

            barindex
            Creates an undocumented autostart registry key
            Source: C:\Windows\SysWOW64\findstr.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run XXVLVHS08HJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run XXVLVHS08HJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run XXVLVHS08HJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run XXVLVHS08HJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: INVOICE.exe PID: 5892, type: MEMORYSTR
            Switches to a custom stack to bypass stack traces
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI/Special instruction interceptor: Address: 7FF8C88F0774
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI/Special instruction interceptor: Address: 7FF8C88ED8A4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
            Source: C:\Windows\SysWOW64\findstr.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
            Source: C:\Windows\SysWOW64\findstr.exeAPI/Special instruction interceptor: Address: 7FF8C88F0774
            Source: C:\Windows\SysWOW64\findstr.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: 2851F090000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: 285389B0000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8D1C0 rdtsc 5_2_03B8D1C0
            Source: C:\Windows\SysWOW64\findstr.exeWindow / User API: threadDelayed 9722Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 872Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 879Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\findstr.exeAPI coverage: 1.1 %
            Source: C:\Windows\SysWOW64\findstr.exe TID: 1084Thread sleep count: 252 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\findstr.exe TID: 1084Thread sleep time: -504000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exe TID: 1084Thread sleep count: 9722 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\findstr.exe TID: 1084Thread sleep time: -19444000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\findstr.exeLast function: Thread delayed
            Source: Amcache.hve.8.drBinary or memory string: VMware
            Source: explorer.exe, 0000000E.00000002.4526405649.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0r
            Source: explorer.exe, 0000000E.00000000.3842035324.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: explorer.exe, 0000000E.00000002.4522017851.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
            Source: Amcache.hve.8.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
            Source: explorer.exe, 0000000E.00000000.3842035324.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009B2C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
            Source: Amcache.hve.8.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
            Source: Amcache.hve.8.drBinary or memory string: vmci.sys
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
            Source: explorer.exe, 0000000E.00000003.3857515555.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
            Source: Amcache.hve.8.drBinary or memory string: VMware20,1
            Source: Amcache.hve.8.drBinary or memory string: Microsoft Hyper-V Generation Counter
            Source: Amcache.hve.8.drBinary or memory string: NECVMWar VMware SATA CD00
            Source: Amcache.hve.8.drBinary or memory string: VMware Virtual disk SCSI Disk Device
            Source: Amcache.hve.8.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
            Source: Amcache.hve.8.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
            Source: Amcache.hve.8.drBinary or memory string: VMware PCI VMCI Bus Device
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
            Source: explorer.exe, 0000000E.00000000.3838930768.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
            Source: Amcache.hve.8.drBinary or memory string: VMware VMCI Bus Device
            Source: Amcache.hve.8.drBinary or memory string: VMware Virtual RAM
            Source: Amcache.hve.8.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
            Source: explorer.exe, 0000000E.00000000.3842035324.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
            Source: explorer.exe, 0000000E.00000000.3840035493.000000000769A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: Amcache.hve.8.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
            Source: explorer.exe, 0000000E.00000003.3857515555.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
            Source: Amcache.hve.8.drBinary or memory string: VMware Virtual USB Mouse
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: Amcache.hve.8.drBinary or memory string: vmci.syshbin
            Source: Amcache.hve.8.drBinary or memory string: VMware, Inc.
            Source: findstr.exe, 0000000C.00000002.3915719106.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllN
            Source: Amcache.hve.8.drBinary or memory string: VMware20,1hbin@
            Source: Amcache.hve.8.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
            Source: Amcache.hve.8.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
            Source: Amcache.hve.8.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
            Source: Amcache.hve.8.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
            Source: Amcache.hve.8.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
            Source: Amcache.hve.8.drBinary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
            Source: Amcache.hve.8.drBinary or memory string: vmci.syshbin`
            Source: Amcache.hve.8.drBinary or memory string: \driver\vmci,\driver\pci
            Source: INVOICE.exe, 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
            Source: explorer.exe, 0000000E.00000000.3838930768.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 d9 2e dc 89 72 dX
            Source: Amcache.hve.8.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
            Source: Amcache.hve.8.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
            Source: explorer.exe, 0000000E.00000000.3838930768.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware,p
            Source: explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
            Source: explorer.exe, 0000000E.00000002.4522017851.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
            Source: C:\Windows\SysWOW64\findstr.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeProcess queried: DebugPortJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8D1C0 rdtsc 5_2_03B8D1C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_004175F3 LdrLoadDll,5_2_004175F3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B433A0 mov eax, dword ptr fs:[00000030h]5_2_03B433A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B433A0 mov eax, dword ptr fs:[00000030h]5_2_03B433A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B333A5 mov eax, dword ptr fs:[00000030h]5_2_03B333A5
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE539D mov eax, dword ptr fs:[00000030h]5_2_03BE539D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B08397 mov eax, dword ptr fs:[00000030h]5_2_03B08397
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B08397 mov eax, dword ptr fs:[00000030h]5_2_03B08397
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B08397 mov eax, dword ptr fs:[00000030h]5_2_03B08397
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B6739A mov eax, dword ptr fs:[00000030h]5_2_03B6739A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B6739A mov eax, dword ptr fs:[00000030h]5_2_03B6739A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0E388 mov eax, dword ptr fs:[00000030h]5_2_03B0E388
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0E388 mov eax, dword ptr fs:[00000030h]5_2_03B0E388
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0E388 mov eax, dword ptr fs:[00000030h]5_2_03B0E388
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3438F mov eax, dword ptr fs:[00000030h]5_2_03B3438F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3438F mov eax, dword ptr fs:[00000030h]5_2_03B3438F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE53FC mov eax, dword ptr fs:[00000030h]5_2_03BE53FC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E3F0 mov eax, dword ptr fs:[00000030h]5_2_03B2E3F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E3F0 mov eax, dword ptr fs:[00000030h]5_2_03B2E3F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E3F0 mov eax, dword ptr fs:[00000030h]5_2_03B2E3F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B463FF mov eax, dword ptr fs:[00000030h]5_2_03B463FF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF3E6 mov eax, dword ptr fs:[00000030h]5_2_03BCF3E6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B203E9 mov eax, dword ptr fs:[00000030h]5_2_03B203E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCB3D0 mov ecx, dword ptr fs:[00000030h]5_2_03BCB3D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCC3CD mov eax, dword ptr fs:[00000030h]5_2_03BCC3CD
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A3C0 mov eax, dword ptr fs:[00000030h]5_2_03B1A3C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A3C0 mov eax, dword ptr fs:[00000030h]5_2_03B1A3C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A3C0 mov eax, dword ptr fs:[00000030h]5_2_03B1A3C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A3C0 mov eax, dword ptr fs:[00000030h]5_2_03B1A3C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A3C0 mov eax, dword ptr fs:[00000030h]5_2_03B1A3C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A3C0 mov eax, dword ptr fs:[00000030h]5_2_03B1A3C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B183C0 mov eax, dword ptr fs:[00000030h]5_2_03B183C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B183C0 mov eax, dword ptr fs:[00000030h]5_2_03B183C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B183C0 mov eax, dword ptr fs:[00000030h]5_2_03B183C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B183C0 mov eax, dword ptr fs:[00000030h]5_2_03B183C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B07330 mov eax, dword ptr fs:[00000030h]5_2_03B07330
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD132D mov eax, dword ptr fs:[00000030h]5_2_03BD132D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD132D mov eax, dword ptr fs:[00000030h]5_2_03BD132D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3F32A mov eax, dword ptr fs:[00000030h]5_2_03B3F32A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0C310 mov ecx, dword ptr fs:[00000030h]5_2_03B0C310
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B30310 mov ecx, dword ptr fs:[00000030h]5_2_03B30310
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9930B mov eax, dword ptr fs:[00000030h]5_2_03B9930B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9930B mov eax, dword ptr fs:[00000030h]5_2_03B9930B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9930B mov eax, dword ptr fs:[00000030h]5_2_03B9930B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4A30B mov eax, dword ptr fs:[00000030h]5_2_03B4A30B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4A30B mov eax, dword ptr fs:[00000030h]5_2_03B4A30B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4A30B mov eax, dword ptr fs:[00000030h]5_2_03B4A30B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B17370 mov eax, dword ptr fs:[00000030h]5_2_03B17370
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B17370 mov eax, dword ptr fs:[00000030h]5_2_03B17370
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B17370 mov eax, dword ptr fs:[00000030h]5_2_03B17370
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BB437C mov eax, dword ptr fs:[00000030h]5_2_03BB437C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF367 mov eax, dword ptr fs:[00000030h]5_2_03BCF367
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09353 mov eax, dword ptr fs:[00000030h]5_2_03B09353
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09353 mov eax, dword ptr fs:[00000030h]5_2_03B09353
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9035C mov eax, dword ptr fs:[00000030h]5_2_03B9035C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9035C mov eax, dword ptr fs:[00000030h]5_2_03B9035C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9035C mov eax, dword ptr fs:[00000030h]5_2_03B9035C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9035C mov ecx, dword ptr fs:[00000030h]5_2_03B9035C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9035C mov eax, dword ptr fs:[00000030h]5_2_03B9035C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9035C mov eax, dword ptr fs:[00000030h]5_2_03B9035C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDA352 mov eax, dword ptr fs:[00000030h]5_2_03BDA352
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B92349 mov eax, dword ptr fs:[00000030h]5_2_03B92349
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0D34C mov eax, dword ptr fs:[00000030h]5_2_03B0D34C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0D34C mov eax, dword ptr fs:[00000030h]5_2_03B0D34C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE5341 mov eax, dword ptr fs:[00000030h]5_2_03BE5341
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B992BC mov eax, dword ptr fs:[00000030h]5_2_03B992BC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B992BC mov eax, dword ptr fs:[00000030h]5_2_03B992BC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B992BC mov ecx, dword ptr fs:[00000030h]5_2_03B992BC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B992BC mov ecx, dword ptr fs:[00000030h]5_2_03B992BC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B202A0 mov eax, dword ptr fs:[00000030h]5_2_03B202A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B202A0 mov eax, dword ptr fs:[00000030h]5_2_03B202A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B252A0 mov eax, dword ptr fs:[00000030h]5_2_03B252A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B252A0 mov eax, dword ptr fs:[00000030h]5_2_03B252A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B252A0 mov eax, dword ptr fs:[00000030h]5_2_03B252A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B252A0 mov eax, dword ptr fs:[00000030h]5_2_03B252A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA72A0 mov eax, dword ptr fs:[00000030h]5_2_03BA72A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA72A0 mov eax, dword ptr fs:[00000030h]5_2_03BA72A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA62A0 mov eax, dword ptr fs:[00000030h]5_2_03BA62A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA62A0 mov ecx, dword ptr fs:[00000030h]5_2_03BA62A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA62A0 mov eax, dword ptr fs:[00000030h]5_2_03BA62A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA62A0 mov eax, dword ptr fs:[00000030h]5_2_03BA62A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA62A0 mov eax, dword ptr fs:[00000030h]5_2_03BA62A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA62A0 mov eax, dword ptr fs:[00000030h]5_2_03BA62A0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD92A6 mov eax, dword ptr fs:[00000030h]5_2_03BD92A6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD92A6 mov eax, dword ptr fs:[00000030h]5_2_03BD92A6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD92A6 mov eax, dword ptr fs:[00000030h]5_2_03BD92A6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD92A6 mov eax, dword ptr fs:[00000030h]5_2_03BD92A6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4329E mov eax, dword ptr fs:[00000030h]5_2_03B4329E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4329E mov eax, dword ptr fs:[00000030h]5_2_03B4329E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4E284 mov eax, dword ptr fs:[00000030h]5_2_03B4E284
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4E284 mov eax, dword ptr fs:[00000030h]5_2_03B4E284
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B90283 mov eax, dword ptr fs:[00000030h]5_2_03B90283
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B90283 mov eax, dword ptr fs:[00000030h]5_2_03B90283
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B90283 mov eax, dword ptr fs:[00000030h]5_2_03B90283
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE5283 mov eax, dword ptr fs:[00000030h]5_2_03BE5283
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF2F8 mov eax, dword ptr fs:[00000030h]5_2_03BCF2F8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B092FF mov eax, dword ptr fs:[00000030h]5_2_03B092FF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC12ED mov eax, dword ptr fs:[00000030h]5_2_03BC12ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B202E1 mov eax, dword ptr fs:[00000030h]5_2_03B202E1
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B202E1 mov eax, dword ptr fs:[00000030h]5_2_03B202E1
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B202E1 mov eax, dword ptr fs:[00000030h]5_2_03B202E1
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE52E2 mov eax, dword ptr fs:[00000030h]5_2_03BE52E2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3F2D0 mov eax, dword ptr fs:[00000030h]5_2_03B3F2D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3F2D0 mov eax, dword ptr fs:[00000030h]5_2_03B3F2D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B2D3 mov eax, dword ptr fs:[00000030h]5_2_03B0B2D3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B2D3 mov eax, dword ptr fs:[00000030h]5_2_03B0B2D3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B2D3 mov eax, dword ptr fs:[00000030h]5_2_03B0B2D3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A2C3 mov eax, dword ptr fs:[00000030h]5_2_03B1A2C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A2C3 mov eax, dword ptr fs:[00000030h]5_2_03B1A2C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A2C3 mov eax, dword ptr fs:[00000030h]5_2_03B1A2C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A2C3 mov eax, dword ptr fs:[00000030h]5_2_03B1A2C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1A2C3 mov eax, dword ptr fs:[00000030h]5_2_03B1A2C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B2C0 mov eax, dword ptr fs:[00000030h]5_2_03B3B2C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B192C5 mov eax, dword ptr fs:[00000030h]5_2_03B192C5
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B192C5 mov eax, dword ptr fs:[00000030h]5_2_03B192C5
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0823B mov eax, dword ptr fs:[00000030h]5_2_03B0823B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE5227 mov eax, dword ptr fs:[00000030h]5_2_03BE5227
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B47208 mov eax, dword ptr fs:[00000030h]5_2_03B47208
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B47208 mov eax, dword ptr fs:[00000030h]5_2_03B47208
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B51270 mov eax, dword ptr fs:[00000030h]5_2_03B51270
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B51270 mov eax, dword ptr fs:[00000030h]5_2_03B51270
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B39274 mov eax, dword ptr fs:[00000030h]5_2_03B39274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC0274 mov eax, dword ptr fs:[00000030h]5_2_03BC0274
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B14260 mov eax, dword ptr fs:[00000030h]5_2_03B14260
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B14260 mov eax, dword ptr fs:[00000030h]5_2_03B14260
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B14260 mov eax, dword ptr fs:[00000030h]5_2_03B14260
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDD26B mov eax, dword ptr fs:[00000030h]5_2_03BDD26B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BDD26B mov eax, dword ptr fs:[00000030h]5_2_03BDD26B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0826B mov eax, dword ptr fs:[00000030h]5_2_03B0826B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0A250 mov eax, dword ptr fs:[00000030h]5_2_03B0A250
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B16259 mov eax, dword ptr fs:[00000030h]5_2_03B16259
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCB256 mov eax, dword ptr fs:[00000030h]5_2_03BCB256
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCB256 mov eax, dword ptr fs:[00000030h]5_2_03BCB256
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09240 mov eax, dword ptr fs:[00000030h]5_2_03B09240
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09240 mov eax, dword ptr fs:[00000030h]5_2_03B09240
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4724D mov eax, dword ptr fs:[00000030h]5_2_03B4724D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2B1B0 mov eax, dword ptr fs:[00000030h]5_2_03B2B1B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC11A4 mov eax, dword ptr fs:[00000030h]5_2_03BC11A4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC11A4 mov eax, dword ptr fs:[00000030h]5_2_03BC11A4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC11A4 mov eax, dword ptr fs:[00000030h]5_2_03BC11A4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BC11A4 mov eax, dword ptr fs:[00000030h]5_2_03BC11A4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9019F mov eax, dword ptr fs:[00000030h]5_2_03B9019F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9019F mov eax, dword ptr fs:[00000030h]5_2_03B9019F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9019F mov eax, dword ptr fs:[00000030h]5_2_03B9019F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9019F mov eax, dword ptr fs:[00000030h]5_2_03B9019F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B67190 mov eax, dword ptr fs:[00000030h]5_2_03B67190
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0A197 mov eax, dword ptr fs:[00000030h]5_2_03B0A197
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0A197 mov eax, dword ptr fs:[00000030h]5_2_03B0A197
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0A197 mov eax, dword ptr fs:[00000030h]5_2_03B0A197
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B50185 mov eax, dword ptr fs:[00000030h]5_2_03B50185
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCC188 mov eax, dword ptr fs:[00000030h]5_2_03BCC188
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCC188 mov eax, dword ptr fs:[00000030h]5_2_03BCC188
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B401F8 mov eax, dword ptr fs:[00000030h]5_2_03B401F8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE61E5 mov eax, dword ptr fs:[00000030h]5_2_03BE61E5
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B351EF mov eax, dword ptr fs:[00000030h]5_2_03B351EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B151ED mov eax, dword ptr fs:[00000030h]5_2_03B151ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4D1D0 mov eax, dword ptr fs:[00000030h]5_2_03B4D1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4D1D0 mov ecx, dword ptr fs:[00000030h]5_2_03B4D1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E1D0 mov eax, dword ptr fs:[00000030h]5_2_03B8E1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E1D0 mov eax, dword ptr fs:[00000030h]5_2_03B8E1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E1D0 mov ecx, dword ptr fs:[00000030h]5_2_03B8E1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E1D0 mov eax, dword ptr fs:[00000030h]5_2_03B8E1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E1D0 mov eax, dword ptr fs:[00000030h]5_2_03B8E1D0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE51CB mov eax, dword ptr fs:[00000030h]5_2_03BE51CB
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD61C3 mov eax, dword ptr fs:[00000030h]5_2_03BD61C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD61C3 mov eax, dword ptr fs:[00000030h]5_2_03BD61C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B11131 mov eax, dword ptr fs:[00000030h]5_2_03B11131
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B11131 mov eax, dword ptr fs:[00000030h]5_2_03B11131
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B136 mov eax, dword ptr fs:[00000030h]5_2_03B0B136
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B136 mov eax, dword ptr fs:[00000030h]5_2_03B0B136
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B136 mov eax, dword ptr fs:[00000030h]5_2_03B0B136
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B136 mov eax, dword ptr fs:[00000030h]5_2_03B0B136
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B40124 mov eax, dword ptr fs:[00000030h]5_2_03B40124
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBA118 mov ecx, dword ptr fs:[00000030h]5_2_03BBA118
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBA118 mov eax, dword ptr fs:[00000030h]5_2_03BBA118
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBA118 mov eax, dword ptr fs:[00000030h]5_2_03BBA118
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BBA118 mov eax, dword ptr fs:[00000030h]5_2_03BBA118
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD0115 mov eax, dword ptr fs:[00000030h]5_2_03BD0115
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F172 mov eax, dword ptr fs:[00000030h]5_2_03B0F172
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA9179 mov eax, dword ptr fs:[00000030h]5_2_03BA9179
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B17152 mov eax, dword ptr fs:[00000030h]5_2_03B17152
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B16154 mov eax, dword ptr fs:[00000030h]5_2_03B16154
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B16154 mov eax, dword ptr fs:[00000030h]5_2_03B16154
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0C156 mov eax, dword ptr fs:[00000030h]5_2_03B0C156
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE5152 mov eax, dword ptr fs:[00000030h]5_2_03BE5152
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09148 mov eax, dword ptr fs:[00000030h]5_2_03B09148
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09148 mov eax, dword ptr fs:[00000030h]5_2_03B09148
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09148 mov eax, dword ptr fs:[00000030h]5_2_03B09148
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09148 mov eax, dword ptr fs:[00000030h]5_2_03B09148
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA4144 mov eax, dword ptr fs:[00000030h]5_2_03BA4144
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA4144 mov eax, dword ptr fs:[00000030h]5_2_03BA4144
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA4144 mov ecx, dword ptr fs:[00000030h]5_2_03BA4144
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA4144 mov eax, dword ptr fs:[00000030h]5_2_03BA4144
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA4144 mov eax, dword ptr fs:[00000030h]5_2_03BA4144
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD60B8 mov eax, dword ptr fs:[00000030h]5_2_03BD60B8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD60B8 mov ecx, dword ptr fs:[00000030h]5_2_03BD60B8
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3D090 mov eax, dword ptr fs:[00000030h]5_2_03B3D090
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3D090 mov eax, dword ptr fs:[00000030h]5_2_03B3D090
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B15096 mov eax, dword ptr fs:[00000030h]5_2_03B15096
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4909C mov eax, dword ptr fs:[00000030h]5_2_03B4909C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1208A mov eax, dword ptr fs:[00000030h]5_2_03B1208A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0D08D mov eax, dword ptr fs:[00000030h]5_2_03B0D08D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0C0F0 mov eax, dword ptr fs:[00000030h]5_2_03B0C0F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B520F0 mov ecx, dword ptr fs:[00000030h]5_2_03B520F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0A0E3 mov ecx, dword ptr fs:[00000030h]5_2_03B0A0E3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B350E4 mov eax, dword ptr fs:[00000030h]5_2_03B350E4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B350E4 mov ecx, dword ptr fs:[00000030h]5_2_03B350E4
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B180E9 mov eax, dword ptr fs:[00000030h]5_2_03B180E9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B920DE mov eax, dword ptr fs:[00000030h]5_2_03B920DE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE50D9 mov eax, dword ptr fs:[00000030h]5_2_03BE50D9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B390DB mov eax, dword ptr fs:[00000030h]5_2_03B390DB
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov ecx, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov ecx, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov ecx, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov ecx, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B270C0 mov eax, dword ptr fs:[00000030h]5_2_03B270C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8D0C0 mov eax, dword ptr fs:[00000030h]5_2_03B8D0C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8D0C0 mov eax, dword ptr fs:[00000030h]5_2_03B8D0C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD903E mov eax, dword ptr fs:[00000030h]5_2_03BD903E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD903E mov eax, dword ptr fs:[00000030h]5_2_03BD903E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD903E mov eax, dword ptr fs:[00000030h]5_2_03BD903E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD903E mov eax, dword ptr fs:[00000030h]5_2_03BD903E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0A020 mov eax, dword ptr fs:[00000030h]5_2_03B0A020
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0C020 mov eax, dword ptr fs:[00000030h]5_2_03B0C020
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E016 mov eax, dword ptr fs:[00000030h]5_2_03B2E016
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E016 mov eax, dword ptr fs:[00000030h]5_2_03B2E016
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E016 mov eax, dword ptr fs:[00000030h]5_2_03B2E016
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E016 mov eax, dword ptr fs:[00000030h]5_2_03B2E016
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B94000 mov ecx, dword ptr fs:[00000030h]5_2_03B94000
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3C073 mov eax, dword ptr fs:[00000030h]5_2_03B3C073
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov ecx, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B21070 mov eax, dword ptr fs:[00000030h]5_2_03B21070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8D070 mov ecx, dword ptr fs:[00000030h]5_2_03B8D070
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9106E mov eax, dword ptr fs:[00000030h]5_2_03B9106E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE5060 mov eax, dword ptr fs:[00000030h]5_2_03BE5060
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B12050 mov eax, dword ptr fs:[00000030h]5_2_03B12050
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3B052 mov eax, dword ptr fs:[00000030h]5_2_03B3B052
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BB705E mov ebx, dword ptr fs:[00000030h]5_2_03BB705E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BB705E mov eax, dword ptr fs:[00000030h]5_2_03BB705E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3D7B0 mov eax, dword ptr fs:[00000030h]5_2_03B3D7B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE37B6 mov eax, dword ptr fs:[00000030h]5_2_03BE37B6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F7BA mov eax, dword ptr fs:[00000030h]5_2_03B0F7BA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B997A9 mov eax, dword ptr fs:[00000030h]5_2_03B997A9
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9F7AF mov eax, dword ptr fs:[00000030h]5_2_03B9F7AF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9F7AF mov eax, dword ptr fs:[00000030h]5_2_03B9F7AF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9F7AF mov eax, dword ptr fs:[00000030h]5_2_03B9F7AF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9F7AF mov eax, dword ptr fs:[00000030h]5_2_03B9F7AF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9F7AF mov eax, dword ptr fs:[00000030h]5_2_03B9F7AF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B107AF mov eax, dword ptr fs:[00000030h]5_2_03B107AF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF78A mov eax, dword ptr fs:[00000030h]5_2_03BCF78A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B147FB mov eax, dword ptr fs:[00000030h]5_2_03B147FB
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B147FB mov eax, dword ptr fs:[00000030h]5_2_03B147FB
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1D7E0 mov ecx, dword ptr fs:[00000030h]5_2_03B1D7E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B327ED mov eax, dword ptr fs:[00000030h]5_2_03B327ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B327ED mov eax, dword ptr fs:[00000030h]5_2_03B327ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B327ED mov eax, dword ptr fs:[00000030h]5_2_03B327ED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1C7C0 mov eax, dword ptr fs:[00000030h]5_2_03B1C7C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B157C0 mov eax, dword ptr fs:[00000030h]5_2_03B157C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B157C0 mov eax, dword ptr fs:[00000030h]5_2_03B157C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B157C0 mov eax, dword ptr fs:[00000030h]5_2_03B157C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B907C3 mov eax, dword ptr fs:[00000030h]5_2_03B907C3
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09730 mov eax, dword ptr fs:[00000030h]5_2_03B09730
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B09730 mov eax, dword ptr fs:[00000030h]5_2_03B09730
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B45734 mov eax, dword ptr fs:[00000030h]5_2_03B45734
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BEB73C mov eax, dword ptr fs:[00000030h]5_2_03BEB73C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BEB73C mov eax, dword ptr fs:[00000030h]5_2_03BEB73C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BEB73C mov eax, dword ptr fs:[00000030h]5_2_03BEB73C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BEB73C mov eax, dword ptr fs:[00000030h]5_2_03BEB73C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4273C mov eax, dword ptr fs:[00000030h]5_2_03B4273C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4273C mov ecx, dword ptr fs:[00000030h]5_2_03B4273C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4273C mov eax, dword ptr fs:[00000030h]5_2_03B4273C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8C730 mov eax, dword ptr fs:[00000030h]5_2_03B8C730
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1973A mov eax, dword ptr fs:[00000030h]5_2_03B1973A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1973A mov eax, dword ptr fs:[00000030h]5_2_03B1973A
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B13720 mov eax, dword ptr fs:[00000030h]5_2_03B13720
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2F720 mov eax, dword ptr fs:[00000030h]5_2_03B2F720
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2F720 mov eax, dword ptr fs:[00000030h]5_2_03B2F720
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2F720 mov eax, dword ptr fs:[00000030h]5_2_03B2F720
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF72E mov eax, dword ptr fs:[00000030h]5_2_03BCF72E
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4C720 mov eax, dword ptr fs:[00000030h]5_2_03B4C720
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4C720 mov eax, dword ptr fs:[00000030h]5_2_03B4C720
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD972B mov eax, dword ptr fs:[00000030h]5_2_03BD972B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B10710 mov eax, dword ptr fs:[00000030h]5_2_03B10710
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B40710 mov eax, dword ptr fs:[00000030h]5_2_03B40710
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4F71F mov eax, dword ptr fs:[00000030h]5_2_03B4F71F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4F71F mov eax, dword ptr fs:[00000030h]5_2_03B4F71F
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B17703 mov eax, dword ptr fs:[00000030h]5_2_03B17703
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B15702 mov eax, dword ptr fs:[00000030h]5_2_03B15702
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B15702 mov eax, dword ptr fs:[00000030h]5_2_03B15702
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4C700 mov eax, dword ptr fs:[00000030h]5_2_03B4C700
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B18770 mov eax, dword ptr fs:[00000030h]5_2_03B18770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B20770 mov eax, dword ptr fs:[00000030h]5_2_03B20770
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B765 mov eax, dword ptr fs:[00000030h]5_2_03B0B765
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B765 mov eax, dword ptr fs:[00000030h]5_2_03B0B765
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B765 mov eax, dword ptr fs:[00000030h]5_2_03B0B765
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0B765 mov eax, dword ptr fs:[00000030h]5_2_03B0B765
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B10750 mov eax, dword ptr fs:[00000030h]5_2_03B10750
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52750 mov eax, dword ptr fs:[00000030h]5_2_03B52750
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52750 mov eax, dword ptr fs:[00000030h]5_2_03B52750
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B94755 mov eax, dword ptr fs:[00000030h]5_2_03B94755
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B23740 mov eax, dword ptr fs:[00000030h]5_2_03B23740
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B23740 mov eax, dword ptr fs:[00000030h]5_2_03B23740
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B23740 mov eax, dword ptr fs:[00000030h]5_2_03B23740
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE3749 mov eax, dword ptr fs:[00000030h]5_2_03BE3749
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4674D mov esi, dword ptr fs:[00000030h]5_2_03B4674D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4674D mov eax, dword ptr fs:[00000030h]5_2_03B4674D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4674D mov eax, dword ptr fs:[00000030h]5_2_03B4674D
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B076B2 mov eax, dword ptr fs:[00000030h]5_2_03B076B2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B076B2 mov eax, dword ptr fs:[00000030h]5_2_03B076B2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B076B2 mov eax, dword ptr fs:[00000030h]5_2_03B076B2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B466B0 mov eax, dword ptr fs:[00000030h]5_2_03B466B0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4C6A6 mov eax, dword ptr fs:[00000030h]5_2_03B4C6A6
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0D6AA mov eax, dword ptr fs:[00000030h]5_2_03B0D6AA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0D6AA mov eax, dword ptr fs:[00000030h]5_2_03B0D6AA
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B14690 mov eax, dword ptr fs:[00000030h]5_2_03B14690
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B14690 mov eax, dword ptr fs:[00000030h]5_2_03B14690
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9368C mov eax, dword ptr fs:[00000030h]5_2_03B9368C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9368C mov eax, dword ptr fs:[00000030h]5_2_03B9368C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9368C mov eax, dword ptr fs:[00000030h]5_2_03B9368C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B9368C mov eax, dword ptr fs:[00000030h]5_2_03B9368C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B906F1 mov eax, dword ptr fs:[00000030h]5_2_03B906F1
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B906F1 mov eax, dword ptr fs:[00000030h]5_2_03B906F1
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E6F2 mov eax, dword ptr fs:[00000030h]5_2_03B8E6F2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E6F2 mov eax, dword ptr fs:[00000030h]5_2_03B8E6F2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E6F2 mov eax, dword ptr fs:[00000030h]5_2_03B8E6F2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E6F2 mov eax, dword ptr fs:[00000030h]5_2_03B8E6F2
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCD6F0 mov eax, dword ptr fs:[00000030h]5_2_03BCD6F0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3D6E0 mov eax, dword ptr fs:[00000030h]5_2_03B3D6E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B3D6E0 mov eax, dword ptr fs:[00000030h]5_2_03B3D6E0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA36EE mov eax, dword ptr fs:[00000030h]5_2_03BA36EE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA36EE mov eax, dword ptr fs:[00000030h]5_2_03BA36EE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA36EE mov eax, dword ptr fs:[00000030h]5_2_03BA36EE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA36EE mov eax, dword ptr fs:[00000030h]5_2_03BA36EE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA36EE mov eax, dword ptr fs:[00000030h]5_2_03BA36EE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BA36EE mov eax, dword ptr fs:[00000030h]5_2_03BA36EE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B436EF mov eax, dword ptr fs:[00000030h]5_2_03B436EF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1B6C0 mov eax, dword ptr fs:[00000030h]5_2_03B1B6C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1B6C0 mov eax, dword ptr fs:[00000030h]5_2_03B1B6C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1B6C0 mov eax, dword ptr fs:[00000030h]5_2_03B1B6C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1B6C0 mov eax, dword ptr fs:[00000030h]5_2_03B1B6C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1B6C0 mov eax, dword ptr fs:[00000030h]5_2_03B1B6C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1B6C0 mov eax, dword ptr fs:[00000030h]5_2_03B1B6C0
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD16CC mov eax, dword ptr fs:[00000030h]5_2_03BD16CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD16CC mov eax, dword ptr fs:[00000030h]5_2_03BD16CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD16CC mov eax, dword ptr fs:[00000030h]5_2_03BD16CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BD16CC mov eax, dword ptr fs:[00000030h]5_2_03BD16CC
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4A6C7 mov ebx, dword ptr fs:[00000030h]5_2_03B4A6C7
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4A6C7 mov eax, dword ptr fs:[00000030h]5_2_03B4A6C7
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BCF6C7 mov eax, dword ptr fs:[00000030h]5_2_03BCF6C7
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B416CF mov eax, dword ptr fs:[00000030h]5_2_03B416CF
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03BE5636 mov eax, dword ptr fs:[00000030h]5_2_03BE5636
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B46620 mov eax, dword ptr fs:[00000030h]5_2_03B46620
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B48620 mov eax, dword ptr fs:[00000030h]5_2_03B48620
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2E627 mov eax, dword ptr fs:[00000030h]5_2_03B2E627
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B0F626 mov eax, dword ptr fs:[00000030h]5_2_03B0F626
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B1262C mov eax, dword ptr fs:[00000030h]5_2_03B1262C
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B13616 mov eax, dword ptr fs:[00000030h]5_2_03B13616
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B13616 mov eax, dword ptr fs:[00000030h]5_2_03B13616
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B52619 mov eax, dword ptr fs:[00000030h]5_2_03B52619
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B8E609 mov eax, dword ptr fs:[00000030h]5_2_03B8E609
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B41607 mov eax, dword ptr fs:[00000030h]5_2_03B41607
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B4F603 mov eax, dword ptr fs:[00000030h]5_2_03B4F603
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2260B mov eax, dword ptr fs:[00000030h]5_2_03B2260B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2260B mov eax, dword ptr fs:[00000030h]5_2_03B2260B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2260B mov eax, dword ptr fs:[00000030h]5_2_03B2260B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2260B mov eax, dword ptr fs:[00000030h]5_2_03B2260B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2260B mov eax, dword ptr fs:[00000030h]5_2_03B2260B
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 5_2_03B2260B mov eax, dword ptr fs:[00000030h]5_2_03B2260B
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            .NET source code references suspicious native API functions
            Source: INVOICE.exe, ---.csReference to suspicious API methods: LoadLibrary(_FDCF_FDE4_0657_0616_FD49(_0653_FDEE._FD45_FBD0_FDE4))
            Source: INVOICE.exe, ---.csReference to suspicious API methods: GetProcAddress(intPtr, _FDCF_FDE4_0657_0616_FD49(_0653_FDEE._FD44))
            Source: INVOICE.exe, ---.csReference to suspicious API methods: VirtualProtect(procAddress, (uint)array.ToArray().Length, 64u, out var _FBCF_FD41_FD4F_065B_FDFC_0611_065C)
            Allocates memory in foreign processes
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: C:\Windows\System32\notepad.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: C:\Windows\System32\calc.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: C:\Windows\System32\cmd.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory allocated: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 400000 protect: page execute and read and writeJump to behavior
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Users\user\Desktop\INVOICE.exeNtResumeThread: Indirect: 0x27B038FJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeNtMapViewOfSection: Indirect: 0x27B0252Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeNtMapViewOfSection: Indirect: 0x27B0296Jump to behavior
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\notepad.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\calc.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\cmd.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 400000 value starts with: 4D5AJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: NULL target: C:\Program Files (x86)\Internet Explorer\iexplore.exe protection: execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeSection loaded: NULL target: C:\Windows\SysWOW64\findstr.exe protection: execute and read and writeJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeSection loaded: NULL target: C:\Users\user\Desktop\INVOICE.exe protection: execute and read and writeJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeSection loaded: NULL target: C:\Users\user\Desktop\INVOICE.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeSection loaded: NULL target: C:\Users\user\Desktop\INVOICE.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\findstr.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeThread register set: target process: 5892Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeThread register set: target process: 5892Jump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\notepad.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\notepad.exe base: 401000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\calc.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\calc.exe base: 401000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\cmd.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Windows\System32\cmd.exe base: 401000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 401000Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 3199008Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\calc.exe "C:\Windows\System32\calc.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"Jump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeProcess created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"Jump to behavior
            Source: explorer.exe, 0000000E.00000003.3855253684.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009BA1000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd=
            Source: explorer.exe, 0000000E.00000002.4522583879.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.3838495627.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: explorer.exe, 0000000E.00000002.4522583879.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.4524153690.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3838495627.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: explorer.exe, 0000000E.00000002.4522583879.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.3838495627.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: explorer.exe, 0000000E.00000002.4522583879.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.3838495627.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: explorer.exe, 0000000E.00000002.4522017851.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3837886482.0000000000EF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PProgman
            Source: C:\Users\user\Desktop\INVOICE.exeQueries volume information: C:\Users\user\Desktop\INVOICE.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\INVOICE.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: Amcache.hve.8.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
            Source: Amcache.hve.8.drBinary or memory string: msmpeng.exe
            Source: Amcache.hve.8.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
            Source: Amcache.hve.8.drBinary or memory string: MsMpEng.exe

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Native API            		1
            Registry Run Keys / Startup Folder            		512
            Process Injection            		3
            Virtualization/Sandbox Evasion            		OS Credential Dumping231
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		1
            Disable or Modify Tools            		LSASS Memory3
            Virtualization/Sandbox Evasion            		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            Registry Run Keys / Startup Folder            		512
            Process Injection            		Security Account Manager2
            Process Discovery            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Abuse Elevation Control Mechanism            		LSA Secrets112
            System Information Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
            Obfuscated Files or Information            		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            INVOICE.exe53%ReversingLabsByteCode-MSIL.Trojan.CrypterX
            INVOICE.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://upx.sf.net0%URL Reputationsafe
            https://api.msn.com/0%URL Reputationsafe
            https://excel.office.com0%URL Reputationsafe
            http://schemas.micro0%URL Reputationsafe
            https://outlook.com0%URL Reputationsafe
            https://android.notify.windows.com/iOS0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://word.office.comonexplorer.exe, 0000000E.00000002.4526405649.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
              		unknown
              http://upx.sf.netAmcache.hve.8.drfalse
              • URL Reputation: safe
              		unknown
              https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exeexplorer.exe, 0000000E.00000003.3858159922.000000000C549000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4530113471.000000000C549000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3844621759.000000000C549000.00000004.00000001.00020000.00000000.sdmpfalse
                		unknown
                https://api.msn.com/explorer.exe, 0000000E.00000003.3851770477.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4526405649.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://excel.office.comexplorer.exe, 0000000E.00000003.3855253684.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://schemas.microexplorer.exe, 0000000E.00000000.3841643921.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.4525411811.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.3841607303.0000000008870000.00000002.00000001.00040000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://crl.vexplorer.exe, 0000000E.00000000.3837886482.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4522017851.0000000000F13000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  https://outlook.comexplorer.exe, 0000000E.00000003.3855253684.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.0000000009BA1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4527362496.0000000009BB2000.00000004.00000001.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://android.notify.windows.com/iOSexplorer.exe, 0000000E.00000002.4524366956.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3840035493.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3857515555.00000000076F8000.00000004.00000001.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://powerpoint.office.comcemberexplorer.exe, 0000000E.00000000.3844621759.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4530113471.000000000C460000.00000004.00000001.00020000.00000000.sdmpfalse
                    		unknown
                    https://wns.windows.com/)sexplorer.exe, 0000000E.00000002.4526405649.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3851770477.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.3842035324.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                      		unknown

                      World Map of Contacted IPs

                      ⊘No contacted IP infos

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1520625
                      Start date and time:2024-09-27 17:21:08 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 10m 10s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:14
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:1
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:INVOICE.exe
                      Detection:MAL
                      Classification:mal100.troj.expl.evad.winEXE@14/5@0/0
                      EGA Information:
                      • Successful, ratio: 100%
                      HCA Information:
                      • Successful, ratio: 80%
                      • Number of executed functions: 43
                      • Number of non-executed functions: 222
                      Cookbook Comments:
                      • Found application associated with file extension: .exe
                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                      Warnings

                      • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 52.168.117.173
                      • Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • Report creation exceeded maximum time and may have missing disassembly code information.
                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                      • Report size getting too big, too many NtEnumerateKey calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Report size getting too big, too many NtSetInformationFile calls found.
                      • VT rate limit hit for: INVOICE.exe

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      11:22:25API Interceptor1x Sleep call for process: WerFault.exe modified
                      11:23:17API Interceptor5741428x Sleep call for process: findstr.exe modified
                      11:25:01API Interceptor563x Sleep call for process: explorer.exe modified

                      Joe Sandbox View / Context

                      IPs

                      ⊘No context

                      Domains

                      ⊘No context

                      ASNs

                      ⊘No context

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_INVOICE.exe_fec790ac7eb5905e17bf10e44999f63291b7bd7_55fdea1e_25f9db32-c290-45ae-a857-99396b3e14f3\Report.wer

                      Download File
                      Process:C:\Windows\System32\WerFault.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):65536
                      Entropy (8bit):0.9933155099148052
                      Encrypted:false
                      SSDEEP:192:DuvMBqzOFPIi0XcnuaWxUUozuiFuZ24lO8E:iv3OFP+XcnuaGUhzuiFuY4lO8E
                      MD5:18BEE07616C5AC88F01572F9DA9CDC4E
                      SHA1:09FDAD8A3F57EA0C4F5FBFD98A189A223628B3ED
                      SHA-256:185C077E44A9A6CF35E1DB59DFCB62B583CDFECDF2EE5D5E94C3AE2D864F3CDA
                      SHA-512:0AD443D9258565BFD22F0ACBF934B0E65C46C83ECEEB80A58394B47AA6DA39ABFC2C15AD933A9C7D52592BA488D5237B2C980DEB8FD38028D8173BA1D597A0A0
                      Malicious:true
                      Reputation:low
                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.9.2.4.1.2.5.8.2.3.6.9.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.9.2.4.1.2.7.0.4.2.4.5.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.f.9.d.b.3.2.-.c.2.9.0.-.4.5.a.e.-.a.8.5.7.-.9.9.3.9.6.b.3.e.1.4.f.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.7.8.4.c.1.d.d.-.b.1.4.a.-.4.d.2.f.-.a.f.e.2.-.2.3.a.5.c.6.a.a.8.3.5.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.I.N.V.O.I.C.E...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.p.o.n.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.0.4.-.0.0.0.1.-.0.0.1.4.-.0.f.9.1.-.9.6.0.0.f.1.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.8.7.8.5.3.e.9.0.f.6.0.5.6.a.0.6.1.c.8.9.8.f.b.9.d.3.d.a.1.c.a.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.8.5.f.0.3.e.0.a.5.6.7.8.2.d.3.d.7.8.0.c.5.d.f.3.0.7.9.a.f.7.2.3.e.6.0.9.3.b.!.I.N.V.O.I.C.E...e.x.e...

                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D5C.tmp.dmp

                      Download File
                      Process:C:\Windows\System32\WerFault.exe
                      File Type:Mini DuMP crash report, 16 streams, Fri Sep 27 15:22:06 2024, 0x1205a4 type
                      Category:dropped
                      Size (bytes):389439
                      Entropy (8bit):3.260036892412381
                      Encrypted:false
                      SSDEEP:3072:/ik71z8P1CCqvlz3+vQhX4RuoXulhLcS8TF8hLk0W3d:asA/qtz3Q6WXg/c86
                      MD5:528147348C21DE2294A82E28382D5DF9
                      SHA1:95C9E3B51A133DB2DBC2531C1D792FCB07B17A35
                      SHA-256:59BC818EA4D9AADDC9209D4A4BF55EFCB22862E57B25F91BDB2FCD36DF26A53D
                      SHA-512:95197186879FEF908DD4D2CAE94E699D712C2F9F96379EC47DA86D1AE857AEA27C860781230DE531B71B86857AE5AAE5BE038AAE95738D81B358243DE935447E
                      Malicious:false
                      Reputation:low
                      Preview:MDMP..a..... ..........f....................................$...............(........I...t..........l.......8...........T............*.._............7...........9..............................................................................eJ......<:......Lw......................T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EC4.tmp.WERInternalMetadata.xml

                      Download File
                      Process:C:\Windows\System32\WerFault.exe
                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):8608
                      Entropy (8bit):3.707657838244589
                      Encrypted:false
                      SSDEEP:192:R6l7wVeJOVU6YEIYPsNXgmfZnjprr89b4itfQom:R6lXJUU6YEXPsNgmf5C44fW
                      MD5:C02D0C79011816EC5930C22FD5A0DF21
                      SHA1:0A7B69E20C630C08F030CF225A54150B47A72D7D
                      SHA-256:9F6D6C727C27EC01A4753C0D0BE9BBAB72156D8B68824C585BECAE4CA70A684A
                      SHA-512:D18479FF48165EA9DC3291BB8FB81087129E063982E6E537455B2BC7338CEBF0CEAD14DC81E6118130E421A68955801A4359B585BC733ADFCF7EF4CFE8472F6A
                      Malicious:false
                      Reputation:low
                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.9.2.<./.P.i.

                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EF4.tmp.xml

                      Download File
                      Process:C:\Windows\System32\WerFault.exe
                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):4798
                      Entropy (8bit):4.510534465757653
                      Encrypted:false
                      SSDEEP:48:cvIwWl8zspJg771I9EnWpW8VYjk5Ym8M4JTE6FGJyq8veEFczX8ipZd:uIjf7I7/W7VLoJIHWPKvpZd
                      MD5:888AA66BC2777C1BA6AECDB4F161D6F9
                      SHA1:442F29CFFDC3B82658D5157CB6E532A640F0FE12
                      SHA-256:69301A1FBB504B341D0C37BA4FEEF7CB86BE9A6CC53AE8CA8C562CAFDC5B7F11
                      SHA-512:1D85AD2EA8E3255CDE0AE32B99CBE5F3DC531C7B59022C703C0C5B6CD133F229C92785139A760C990C2824C93EF21A774B8073A8FA7670D630FAC5BA4E1CB3E7
                      Malicious:false
                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="518784" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                      C:\Windows\appcompat\Programs\Amcache.hve

                      Download File
                      Process:C:\Windows\System32\WerFault.exe
                      File Type:MS Windows registry file, NT/2000 or above
                      Category:dropped
                      Size (bytes):1835008
                      Entropy (8bit):4.421671361343157
                      Encrypted:false
                      SSDEEP:6144:WSvfpi6ceLP/9skLmb0OTFWSPHaJG8nAgeMZMMhA2fX4WABlEnNj0uhiTw:1vloTFW+EZMM6DFyh03w
                      MD5:CD965BA1E31548162D082CD3FFBDD995
                      SHA1:51E53E4B6E257AE8E0E47C9B271EA2B4C8A007F1
                      SHA-256:487CAC59A068658CC2CFDB308800D42C2237E85B0C4AC2AD20A43CAECF88DB40
                      SHA-512:B71087903A2568D9E00A49F1A1A4AF6F32400FBDC891622102A9A7ED775E6F98F597E6C19841D012C3D90CAFF6B752C043CCF9C29356E9859BA3FDB51E9E8515
                      Malicious:false
                      Preview:regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....................................................................................................................................................................................................................................................................................................................................................I.6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      Static File Info

                      General

                      File type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                      Entropy (8bit):4.459584919757143
                      TrID:
                      • Win64 Executable GUI Net Framework (217006/5) 49.88%
                      • Win64 Executable GUI (202006/5) 46.43%
                      • Win64 Executable (generic) (12005/4) 2.76%
                      • Generic Win/DOS Executable (2004/3) 0.46%
                      • DOS Executable Generic (2002/1) 0.46%
                      File name:INVOICE.exe
                      File size:3'255'839 bytes
                      MD5:a008e7dd0417d4b3122820c73bf6631a
                      SHA1:9085f03e0a56782d3d780c5df3079af723e6093b
                      SHA256:175063717f1764ce13bf928d3f25133299ed5d61f241d63e02d29f6b2d67f4f4
                      SHA512:195c321da592c9ca65c374af3987e4ac4d9dd6048c4c68c2159d35d4649f0fce88f0652cee3f3aa44094d33a24d91f66a03d36e174a092004b590b1b0ba7a903
                      SSDEEP:12288:ir8+YoJmKYyMeuejswGz5Mj8JO6pdnW5DhQtv2MQDDN0HLpoJmhssP:48EUYMefswGzqjUpsQ1YDayJmhH
                      TLSH:E6E51280B81B4E23FCA14238C9D57AF49AFDDE4373FA196FDF090D90645417CA1A297A
                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...h..f.........."...0.p8............... ....@...... ....................................`................................

                      File Icon

                      Icon Hash:00928e8e8686b000

                      Static PE Info

                      General

                      Entrypoint:0x400000
                      Entrypoint Section:
                      Digitally signed:false
                      Imagebase:0x400000
                      Subsystem:windows gui
                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Time Stamp:0x66F2A468 [Tue Sep 24 11:37:12 2024 UTC]
                      TLS Callbacks:
                      CLR (.Net) Version:
                      OS Version Major:4
                      OS Version Minor:0
                      File Version Major:4
                      File Version Minor:0
                      Subsystem Version Major:4
                      Subsystem Version Minor:0
                      Import Hash:

                      Entrypoint Preview

                      Instruction
                      dec ebp
                      pop edx
                      nop
                      add byte ptr [ebx], al
                      add byte ptr [eax], al
                      add byte ptr [eax+eax], al
                      add byte ptr [eax], al

                      Data Directories

                      NameVirtual AddressVirtual Size Is in Section
                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x60000x5ea.rsrc
                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20000x48.text
                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                      Sections

                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                      .text0x20000x38700x3a00be0ea92cce63d1b1aeebcf0377a7a76aFalse0.6355064655172413data6.204514838689041IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      .rsrc0x60000x5ea0x60057d280fb4b749a5ff5990ae311254c9eFalse0.4212239583333333data4.1460215092223IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                      Resources

                      NameRVASizeTypeLanguageCountryZLIB Complexity
                      RT_VERSION0x60a00x360data0.41087962962962965
                      RT_MANIFEST0x64000x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                      Network Behavior

                      ⊘No network behavior found

                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:11:22:02
                      Start date:27/09/2024
                      Path:C:\Users\user\Desktop\INVOICE.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Users\user\Desktop\INVOICE.exe"
                      Imagebase:0x2851ed60000
                      File size:3'255'839 bytes
                      MD5 hash:A008E7DD0417D4B3122820C73BF6631A
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2539757329.0000028520D19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      Reputation:low
                      Has exited:true

                      General

                      Target ID:2
                      Start time:11:22:04
                      Start date:27/09/2024
                      Path:C:\Windows\System32\notepad.exe
                      Wow64 process (32bit):
                      Commandline:"C:\Windows\System32\notepad.exe"
                      Imagebase:
                      File size:201'216 bytes
                      MD5 hash:27F71B12CB585541885A31BE22F61C83
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:false

                      General

                      Target ID:3
                      Start time:11:22:04
                      Start date:27/09/2024
                      Path:C:\Windows\System32\calc.exe
                      Wow64 process (32bit):
                      Commandline:"C:\Windows\System32\calc.exe"
                      Imagebase:
                      File size:27'648 bytes
                      MD5 hash:5DA8C98136D98DFEC4716EDD79C7145F
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:false

                      General

                      Target ID:4
                      Start time:11:22:04
                      Start date:27/09/2024
                      Path:C:\Windows\System32\cmd.exe
                      Wow64 process (32bit):
                      Commandline:"C:\Windows\System32\cmd.exe"
                      Imagebase:
                      File size:289'792 bytes
                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      General

                      Target ID:5
                      Start time:11:22:05
                      Start date:27/09/2024
                      Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                      Imagebase:0x230000
                      File size:828'368 bytes
                      MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2478613557.0000000009CF0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:8
                      Start time:11:22:05
                      Start date:27/09/2024
                      Path:C:\Windows\System32\WerFault.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Windows\system32\WerFault.exe -u -p 5892 -s 1088
                      Imagebase:0x7ff761550000
                      File size:570'736 bytes
                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:11
                      Start time:11:22:25
                      Start date:27/09/2024
                      Path:C:\Windows\SysWOW64\findstr.exe
                      Wow64 process (32bit):
                      Commandline:"C:\Windows\SysWOW64\findstr.exe"
                      Imagebase:
                      File size:29'696 bytes
                      MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:false

                      General

                      Target ID:12
                      Start time:11:22:35
                      Start date:27/09/2024
                      Path:C:\Windows\SysWOW64\findstr.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Windows\SysWOW64\findstr.exe"
                      Imagebase:0x290000
                      File size:29'696 bytes
                      MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3915579259.0000000002600000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3915619214.0000000002650000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:14
                      Start time:11:24:59
                      Start date:27/09/2024
                      Path:C:\Windows\explorer.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Windows\Explorer.EXE
                      Imagebase:0x7ff674740000
                      File size:5'141'208 bytes
                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      Disassembly

                      Reset < >

                        Execution Graph

                        Execution Coverage:8.3%
                        Dynamic/Decrypted Code Coverage:16.7%
                        Signature Coverage:0%
                        Total number of Nodes:18
                        Total number of Limit Nodes:0
                        execution_graph 17967 27b443b 17969 27b4440 17967->17969 17968 27b4548 17969->17968 17971 27b02c7 17969->17971 17974 27b02ef 17971->17974 17972 27b0310 17972->17968 17973 27b0387 NtResumeThread 17973->17972 17974->17972 17974->17973 17975 27b00ba 17978 27b00de 17975->17978 17976 27b0147 SleepEx 17977 27b019e NtCreateSection 17976->17977 17976->17978 17979 27b01f9 17977->17979 17980 27b0174 17977->17980 17978->17976 17978->17980 17979->17980 17981 27b0215 NtMapViewOfSection 17979->17981 17981->17980 17982 27b025a NtMapViewOfSection 17981->17982 17982->17980 17987 7ff848ce31b9 17988 7ff848ce31c5 VirtualProtect 17987->17988 17990 7ff848ce3271 17988->17990

                        Executed Functions

                        Function 027B00A9 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 159COMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        • SleepEx.KERNELBASE(43026C93), ref: 027B014D
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID: Sleep
                        • String ID: 0$@$@
                        • API String ID: 3472027048-3221051908
                        • Opcode ID: f40bd148e809920cad0eb00b381bc2e2293bd00291099b4f68325f9689aedc61
                        • Instruction ID: cfccf3b55cbe04e0e594669abbb6b49d261d613283a0fc014447445a53c65e7e
                        • Opcode Fuzzy Hash: f40bd148e809920cad0eb00b381bc2e2293bd00291099b4f68325f9689aedc61
                        • Instruction Fuzzy Hash: 4F515770A18B488FDB19DF18D8857DEBBE5FF88704F10066EE94A97240DB31E545CB86
                        Function 00007FF848CEE865 Relevance: 3.2, Strings: 1, Instructions: 1985COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: QM_H
                        • API String ID: 0-1871913329
                        • Opcode ID: a9d6060f09f34f8e84888a1bc32177588b7432ba08ed15ca7c03498a0343188d
                        • Instruction ID: 19c434e8fb3672d0f1a36916ccb4f4e4bef61d231725e3a2fe581af8887101b9
                        • Opcode Fuzzy Hash: a9d6060f09f34f8e84888a1bc32177588b7432ba08ed15ca7c03498a0343188d
                        • Instruction Fuzzy Hash: F2D24631A1CB494FD399EB2884814B5B7E1FF95341F1446BEE48AC7296DF38E846C781
                        Function 00007FF848CE8B30 Relevance: 2.8, Strings: 1, Instructions: 1559COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: -M_H
                        • API String ID: 0-1316634197
                        • Opcode ID: 1eea66477e8eb01e6b60982e18b28f78f6bb95abde44fd097b154bf4a285dd81
                        • Instruction ID: 0f0ac9bd7f5e71aebae0731950475f0602d21ebf9197f58d499f5aa5ffd370a6
                        • Opcode Fuzzy Hash: 1eea66477e8eb01e6b60982e18b28f78f6bb95abde44fd097b154bf4a285dd81
                        • Instruction Fuzzy Hash: B7B2B030A0DA4A8FEB99EB28D4956B977E1FF59340F1400BAD14EC72D2DF28AC45CB45
                        Function 00007FF848CE33D0 Relevance: 2.0, Strings: 1, Instructions: 737COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 866 7ff848ce33d0-7ff848ce4ae1 call 7ff848ce49a0 873 7ff848ce4b04-7ff848ce4b13 866->873 874 7ff848ce4b15-7ff848ce4b2f call 7ff848ce49a0 call 7ff848ce49f0 873->874 875 7ff848ce4ae3-7ff848ce4af9 call 7ff848ce49a0 call 7ff848ce49f0 873->875 884 7ff848ce4b30-7ff848ce4b80 875->884 885 7ff848ce4afb-7ff848ce4b02 875->885 890 7ff848ce4b82-7ff848ce4b87 call 7ff848ce35c0 884->890 891 7ff848ce4b8c-7ff848ce4bc3 884->891 885->873 890->891 894 7ff848ce4dbf-7ff848ce4e29 891->894 895 7ff848ce4bc9-7ff848ce4bd4 891->895 926 7ff848ce4e46-7ff848ce4e53 894->926 927 7ff848ce4e2b-7ff848ce4e31 894->927 896 7ff848ce4bd6-7ff848ce4be4 895->896 897 7ff848ce4c48-7ff848ce4c4d 895->897 896->894 899 7ff848ce4bea-7ff848ce4bf9 896->899 900 7ff848ce4cc0-7ff848ce4cca 897->900 901 7ff848ce4c4f-7ff848ce4c5b 897->901 903 7ff848ce4c2d-7ff848ce4c38 899->903 904 7ff848ce4bfb-7ff848ce4c2b 899->904 905 7ff848ce4cec-7ff848ce4cf4 900->905 906 7ff848ce4ccc-7ff848ce4cd9 call 7ff848ce35e0 900->906 901->894 907 7ff848ce4c61-7ff848ce4c74 901->907 903->894 909 7ff848ce4c3e-7ff848ce4c46 903->909 904->903 912 7ff848ce4c79-7ff848ce4c7c 904->912 910 7ff848ce4cf7-7ff848ce4d02 905->910 921 7ff848ce4cde-7ff848ce4cea 906->921 907->910 909->896 909->897 910->894 914 7ff848ce4d08-7ff848ce4d18 910->914 917 7ff848ce4c92-7ff848ce4c9a 912->917 918 7ff848ce4c7e-7ff848ce4c8e 912->918 914->894 919 7ff848ce4d1e-7ff848ce4d2b 914->919 917->894 920 7ff848ce4ca0-7ff848ce4cbf 917->920 918->917 919->894 922 7ff848ce4d31-7ff848ce4d4e 919->922 921->905 929 7ff848ce4d4f 922->929 935 7ff848ce4e54-7ff848ce4e70 926->935 930 7ff848ce4e71-7ff848ce4e88 927->930 931 7ff848ce4e33-7ff848ce4e44 927->931 933 7ff848ce4d51 929->933 934 7ff848ce4d59-7ff848ce4d62 929->934 930->935 942 7ff848ce4e8a-7ff848ce4ec5 930->942 931->926 931->927 933->894 936 7ff848ce4d53-7ff848ce4d57 933->936 938 7ff848ce4d64-7ff848ce4d6f 934->938 939 7ff848ce4dad-7ff848ce4dbe 934->939 936->934 938->939 945 7ff848ce4d71-7ff848ce4d88 938->945 947 7ff848ce4ec7-7ff848ce4ed7 942->947 948 7ff848ce4ed9-7ff848ce4f11 942->948 945->929 952 7ff848ce4d8a-7ff848ce4da8 call 7ff848ce35e0 945->952 947->947 947->948 954 7ff848ce4f13-7ff848ce4f19 948->954 955 7ff848ce4f68-7ff848ce4f6f 948->955 952->939 954->955 959 7ff848ce4f1b-7ff848ce4f1c 954->959 957 7ff848ce4f71-7ff848ce4f72 955->957 958 7ff848ce4fb2-7ff848ce4fdb 955->958 961 7ff848ce4f75-7ff848ce4f78 957->961 962 7ff848ce4f1f-7ff848ce4f22 959->962 963 7ff848ce4fdc-7ff848ce4ff1 961->963 964 7ff848ce4f7a-7ff848ce4f8b 961->964 962->963 966 7ff848ce4f28-7ff848ce4f35 962->966 975 7ff848ce4ff3-7ff848ce4ffa 963->975 976 7ff848ce4ffb-7ff848ce5081 963->976 969 7ff848ce4f8d-7ff848ce4f93 964->969 970 7ff848ce4fa9-7ff848ce4fb0 964->970 967 7ff848ce4f37-7ff848ce4f5e 966->967 968 7ff848ce4f61-7ff848ce4f66 966->968 967->968 968->955 968->962 969->963 973 7ff848ce4f95-7ff848ce4fa5 969->973 970->958 970->961 973->970 975->976
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: d
                        • API String ID: 0-2564639436
                        • Opcode ID: 579de7b5c2c23832604bd70d553150bd8745696518a9f836c5aa00bca877c21e
                        • Instruction ID: 72ffd8dde01562a5433d057cdcca966e0d2f6f49705c014824164e2bda5c9bd7
                        • Opcode Fuzzy Hash: 579de7b5c2c23832604bd70d553150bd8745696518a9f836c5aa00bca877c21e
                        • Instruction Fuzzy Hash: 34223230A1CE4A4FE799EB2894855B1B7E1FF45350F1442BAD48AC7197EF2CE842C785
                        Function 00007FF848CE45F0 Relevance: 1.7, Strings: 1, Instructions: 458COMMON
                        Download Yara Rule

                        Control-flow Graph

                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: fish
                        • API String ID: 0-1064584243
                        • Opcode ID: 300b909241cd5007e42432f6b78d76311e005c0aaa7e4492dfa7b8850b158795
                        • Instruction ID: 77b6107b2ed8a1dc1b72d9f81a03c6cfd8ed9121d78a98a049358c2719004e80
                        • Opcode Fuzzy Hash: 300b909241cd5007e42432f6b78d76311e005c0aaa7e4492dfa7b8850b158795
                        • Instruction Fuzzy Hash: FBC12631A1CE4A4FE79DFB2898555B673E1EF96350F0441BED48BC7292DF2CA8028785
                        Function 027B02BB Relevance: 1.6, APIs: 1, Instructions: 97nativethreadCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 2274 27b02bb-27b02e8 2275 27b02ef-27b030e call 27bc9c7 2274->2275 2276 27b02ea call 27ac487 2274->2276 2279 27b0318-27b031d 2275->2279 2280 27b0310-27b0316 2275->2280 2276->2275 2281 27b031f-27b0329 2279->2281 2282 27b033f-27b0354 2280->2282 2284 27b032b-27b0330 2281->2284 2285 27b0355-27b035a 2281->2285 2284->2281 2286 27b0332-27b0338 2284->2286 2287 27b035c-27b0385 call 27ac527 call 27bc9c7 2285->2287 2288 27b0387-27b0391 NtResumeThread 2285->2288 2289 27b033a-27b033b 2286->2289 2287->2286 2287->2288 2288->2286 2291 27b0393-27b039e 2288->2291 2289->2282 2291->2289
                        APIs
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID: ResumeThread
                        • String ID:
                        • API String ID: 947044025-0
                        • Opcode ID: 2dbbd65ed7825d2bd23a16506ff5fd274587efec03f01863b6c70060da8051df
                        • Instruction ID: 539e488d24a7160cd062df6494b14bd9a2758a99d281c05227439f319fdc98e8
                        • Opcode Fuzzy Hash: 2dbbd65ed7825d2bd23a16506ff5fd274587efec03f01863b6c70060da8051df
                        • Instruction Fuzzy Hash: 7221817061CB4D8FDB46EF6884583AEB7E1FB98314F50462ED85AD3290DB74D8418B85
                        Function 00007FF848CE8B28 Relevance: .9, Instructions: 866COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 47c2128d79084ee666f651b3f62899d0bfa0e08536f5d7103328aa5323f33907
                        • Instruction ID: 7795280e54749e96f2a3f94b47bc5c2103d0825a6fe40e78c2a249fde711cd6c
                        • Opcode Fuzzy Hash: 47c2128d79084ee666f651b3f62899d0bfa0e08536f5d7103328aa5323f33907
                        • Instruction Fuzzy Hash: F842A630A1CA498FDBA8EB2C985567977E2FF59341F1401BDE44EC7292DF28AC42CB45
                        Function 00007FF848CE0909 Relevance: .4, Instructions: 394COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 409eca3b2922e1ffe67ef18022c6140ac5ed29f2e24f185dbe9daba0476ff34e
                        • Instruction ID: 5bb0cebf1a0835d045347304d4509ac02aa11824d74f0756dd2840d35b218b04
                        • Opcode Fuzzy Hash: 409eca3b2922e1ffe67ef18022c6140ac5ed29f2e24f185dbe9daba0476ff34e
                        • Instruction Fuzzy Hash: CFC16D21A1DA4D4FE7D8F76894263B9A6D2FF88790F0401BAE40DD36C7DE2C6C418799
                        Function 00007FF848CF4A5C Relevance: .2, Instructions: 172COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0446b3cbc1388ccdae2730e6c2b833a2846ed80fe022b4ff7cdc3d5175f96545
                        • Instruction ID: 12d374cd5c639941d8d0e751605e4546c48833b7077201a7e3fbb8bcfb8a897e
                        • Opcode Fuzzy Hash: 0446b3cbc1388ccdae2730e6c2b833a2846ed80fe022b4ff7cdc3d5175f96545
                        • Instruction Fuzzy Hash: 0941587150D7494FE31EDB3888111B67BE5EB83320F0582BFD186C76A7DE28A846C796
                        Function 00007FF848CF4ABF Relevance: .1, Instructions: 147COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 926772717d02db4a2f86b98cf312621313cbb34cfa1b36bab1e4fde7c8919d8d
                        • Instruction ID: 50110bcbce9f8f7b9a109f2b047f1d6dc5186eb1ef583ece58d2ccedeffab46d
                        • Opcode Fuzzy Hash: 926772717d02db4a2f86b98cf312621313cbb34cfa1b36bab1e4fde7c8919d8d
                        • Instruction Fuzzy Hash: BA41677150D3894FE71EDB3488111B63BE5EB83320F1582BFD586C71D7EE28980683A6
                        Function 00007FF848DB026B Relevance: 2.0, Strings: 1, Instructions: 794COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 734 7ff848db026b-7ff848db026d 735 7ff848db03b1-7ff848db03b7 734->735 736 7ff848db026e-7ff848db027c 734->736 739 7ff848db03b9-7ff848db03c8 735->739 738 7ff848db0284-7ff848db0286 736->738 740 7ff848db02f7-7ff848db0306 738->740 741 7ff848db0288-7ff848db0289 738->741 743 7ff848db03c9-7ff848db0427 739->743 742 7ff848db0307-7ff848db0309 740->742 744 7ff848db028b 741->744 745 7ff848db024f-7ff848db026a 741->745 742->735 747 7ff848db030a-7ff848db0348 742->747 755 7ff848db0429-7ff848db0440 743->755 756 7ff848db045c-7ff848db0474 743->756 744->742 749 7ff848db028d 744->749 745->734 747->739 773 7ff848db034a-7ff848db034d 747->773 751 7ff848db02d4 749->751 752 7ff848db028f-7ff848db02a0 749->752 751->735 753 7ff848db02da-7ff848db02f5 751->753 759 7ff848db02a2-7ff848db02b8 752->759 760 7ff848db0235-7ff848db023b 752->760 753->740 762 7ff848db0442-7ff848db045a 755->762 763 7ff848db04b1-7ff848db04d0 755->763 759->735 764 7ff848db02be-7ff848db02d1 759->764 760->735 766 7ff848db0241-7ff848db024e 760->766 762->756 765 7ff848db04d1-7ff848db04e7 762->765 763->765 764->751 774 7ff848db04e9-7ff848db0500 765->774 775 7ff848db051c-7ff848db0534 765->775 766->745 773->743 776 7ff848db034f 773->776 777 7ff848db0502-7ff848db051a 774->777 778 7ff848db0571-7ff848db0590 774->778 780 7ff848db0351-7ff848db035f 776->780 781 7ff848db0396-7ff848db03b0 776->781 777->775 784 7ff848db0592-7ff848db0595 778->784 785 7ff848db0597-7ff848db05a7 778->785 780->781 784->785 789 7ff848db05a9-7ff848db05c0 785->789 790 7ff848db05dc-7ff848db05f4 785->790 791 7ff848db05c2-7ff848db05da 789->791 792 7ff848db0631-7ff848db0668 789->792 791->790 798 7ff848db066a-7ff848db067a 792->798 799 7ff848db069d-7ff848db06a8 792->799 800 7ff848db06eb-7ff848db06f8 798->800 801 7ff848db067c-7ff848db067e 798->801 805 7ff848db06aa-7ff848db06b9 799->805 806 7ff848db06bc-7ff848db06c5 799->806 803 7ff848db06fa-7ff848db073c 800->803 801->803 804 7ff848db0680 801->804 813 7ff848db0786-7ff848db078b 803->813 814 7ff848db073e-7ff848db0772 803->814 808 7ff848db06c6-7ff848db06c7 804->808 810 7ff848db0682-7ff848db069c 804->810 805->806 806->808 810->799 815 7ff848db0a42-7ff848db0a56 813->815 817 7ff848db078c-7ff848db079e 813->817 814->815 816 7ff848db0778-7ff848db0784 814->816 822 7ff848db0a57-7ff848db0a6f 815->822 818 7ff848db0785 816->818 819 7ff848db079f-7ff848db07bd 817->819 818->813 819->815 823 7ff848db07c3-7ff848db07d6 819->823 825 7ff848db0847-7ff848db0856 823->825 826 7ff848db07d8-7ff848db07d9 823->826 828 7ff848db0857-7ff848db0859 825->828 826->819 827 7ff848db07db 826->827 827->828 829 7ff848db07dd 827->829 828->815 830 7ff848db085a-7ff848db0872 828->830 831 7ff848db0824 829->831 832 7ff848db07df-7ff848db07f0 829->832 836 7ff848db08e3-7ff848db08f0 830->836 837 7ff848db0874-7ff848db0877 830->837 831->815 834 7ff848db082a-7ff848db0845 831->834 832->818 838 7ff848db07f2-7ff848db0808 832->838 834->825 840 7ff848db08f3 836->840 837->840 841 7ff848db0879 837->841 838->815 842 7ff848db080e-7ff848db0821 838->842 840->815 846 7ff848db08f9-7ff848db090c 840->846 844 7ff848db08c0 841->844 845 7ff848db087b-7ff848db08a2 841->845 842->831 848 7ff848db08c2 844->848 849 7ff848db08c3-7ff848db08e1 844->849 845->815 850 7ff848db08a8-7ff848db08be 845->850 853 7ff848db090e-7ff848db0912 846->853 854 7ff848db097d-7ff848db0990 846->854 848->849 849->836 850->815 850->844 855 7ff848db0993 853->855 856 7ff848db0914 853->856 854->855 855->815 858 7ff848db0999-7ff848db09b5 855->858 857 7ff848db0974-7ff848db097b 856->857 857->854 861 7ff848db09d2-7ff848db09e6 858->861 862 7ff848db09b7-7ff848db09cc 858->862 861->822 863 7ff848db09e8-7ff848db09ed 861->863 862->861 863->857 865 7ff848db09ef 863->865 865->815
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2556269104.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848db0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: A
                        • API String ID: 0-3554254475
                        • Opcode ID: 55062c19c3dbafed08326a6ff380ca76ac93976918bfc3e21460cfe58539617e
                        • Instruction ID: 5ebf86d964e9fee22748a9b0caa665d3ccf0dcf00c2640daa10d266fd39fdb24
                        • Opcode Fuzzy Hash: 55062c19c3dbafed08326a6ff380ca76ac93976918bfc3e21460cfe58539617e
                        • Instruction Fuzzy Hash: CD42083180EA8A8FEB55FB28C8556A9BBE0FF65340F1405FDD049CB196DB24AC4AC745
                        Function 00007FF848CE31B9 Relevance: 1.6, APIs: 1, Instructions: 124memoryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1964 7ff848ce31b9-7ff848ce31c3 1965 7ff848ce3205-7ff848ce326f VirtualProtect 1964->1965 1966 7ff848ce31c5-7ff848ce3202 1964->1966 1969 7ff848ce3277-7ff848ce329f 1965->1969 1970 7ff848ce3271 1965->1970 1966->1965 1970->1969
                        APIs
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID: ProtectVirtual
                        • String ID:
                        • API String ID: 544645111-0
                        • Opcode ID: 4fdc98ec1e11da5486ec2b279b870481976f993c49f99d7893a322fda9c2aadd
                        • Instruction ID: b4ab9721aa0d7c17e63acf2702206bf875bd93d809a56451efde430c6d1d1921
                        • Opcode Fuzzy Hash: 4fdc98ec1e11da5486ec2b279b870481976f993c49f99d7893a322fda9c2aadd
                        • Instruction Fuzzy Hash: EC31463190CA4C8FDB08EFACA8456F97BF1EF95321F04022FD049C3192CB246846CB95
                        Function 00007FF848CE96D3 Relevance: 1.6, APIs: 1, Instructions: 123memoryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1971 7ff848ce96d3-7ff848cf84cf VirtualProtect 1976 7ff848cf84d7-7ff848cf84ff 1971->1976 1977 7ff848cf84d1 1971->1977 1977->1976
                        APIs
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID: ProtectVirtual
                        • String ID:
                        • API String ID: 544645111-0
                        • Opcode ID: d610ce719b608a8e33da1b1af093b3b5cb514a48b08f9da31a861072ea298f41
                        • Instruction ID: b4f95a14a968dd95bcc00aca0c8ddee9d9bf0af9c2ac72c8b5ad81fcac1d6417
                        • Opcode Fuzzy Hash: d610ce719b608a8e33da1b1af093b3b5cb514a48b08f9da31a861072ea298f41
                        • Instruction Fuzzy Hash: 99310831A0CA1C8FEB18EF9C98496F97BE1EB65311F00427FD04AD3252CB206846CB95
                        Function 027B00BA Relevance: 1.6, APIs: 1, Instructions: 86COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 2295 27b00ba-27b00dd 2296 27b00de-27b00fc 2295->2296 2296->2296 2297 27b00fe-27b0142 2296->2297 2298 27b0147-27b0153 SleepEx 2297->2298 2299 27b019e-27b01f3 NtCreateSection 2298->2299 2300 27b0155-27b0159 2298->2300 2303 27b01f9-27b020f 2299->2303 2304 27b0174-27b017b 2299->2304 2301 27b015b-27b0168 call 27bd3e7 2300->2301 2302 27b016d-27b0172 2300->2302 2301->2302 2302->2298 2302->2304 2303->2304 2308 27b0215-27b0254 NtMapViewOfSection 2303->2308 2306 27b017d-27b019d 2304->2306 2308->2304 2309 27b025a-27b0298 NtMapViewOfSection 2308->2309 2309->2304 2310 27b029e-27b02b6 2309->2310 2310->2306
                        APIs
                        • SleepEx.KERNELBASE(43026C93), ref: 027B014D
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID: Sleep
                        • String ID:
                        • API String ID: 3472027048-0
                        • Opcode ID: 96c733a083ceb1b9aad9182dec89e21659a84b859dff1d23ecb4c8ca714fa14e
                        • Instruction ID: f69b43ec7bb631c0128c3865abfdfb10ce6da78dd226f6cb61b3e488e14a1daa
                        • Opcode Fuzzy Hash: 96c733a083ceb1b9aad9182dec89e21659a84b859dff1d23ecb4c8ca714fa14e
                        • Instruction Fuzzy Hash: E5210832905B49CFDB1A9F68C8457EE7BE2FF45354F14466DC48A8B1A3CA328156CBC1
                        Function 00007FF848DB0A72 Relevance: 1.2, Instructions: 1198COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2556269104.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848db0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: fecbe30cad6d60484c9fb7daa5a2359dadc6b1aea304dac2deb087c5523ba33c
                        • Instruction ID: 74d0d4894749902ded061aa23e506c07d34cbb2c76374c495a6621c25e36290b
                        • Opcode Fuzzy Hash: fecbe30cad6d60484c9fb7daa5a2359dadc6b1aea304dac2deb087c5523ba33c
                        • Instruction Fuzzy Hash: 3B821B7190EBC58FEB56EB2888556A47FE0FF66340F0805FEC089CB1A7DB28584AC755
                        Function 00007FF848DB10C9 Relevance: .3, Instructions: 268COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2556269104.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848db0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 064e9e7b7625a3f6f31f07b3117564d5657a2b02de9e83c1aa5dfab99d811830
                        • Instruction ID: 8526ff1398a59c792a1ebc55460ad4054d318665c9fd6f7d14c92f0f56a2cb71
                        • Opcode Fuzzy Hash: 064e9e7b7625a3f6f31f07b3117564d5657a2b02de9e83c1aa5dfab99d811830
                        • Instruction Fuzzy Hash: 39812A3190EBC94FDB56EB6888556A57BE0FF6A340F0501FBD049C7197EB28A849C345
                        Function 00007FF848DB1210 Relevance: .1, Instructions: 119COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2556269104.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848db0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d5a1c854c55a14220417ee23eea41889659759e930151c2f07fb334a28152bbc
                        • Instruction ID: 81789e3858c10624337fab51e03e5446c6b5b8c12707fce84de20030a8361d4d
                        • Opcode Fuzzy Hash: d5a1c854c55a14220417ee23eea41889659759e930151c2f07fb334a28152bbc
                        • Instruction Fuzzy Hash: 5731D731D0D94E8FEF59EE58D85A6B877E0FF68340F14027AD00AD7699EF25A805C784

                        Non-executed Functions

                        Function 00007FF848CF4379 Relevance: 1.4, Strings: 1, Instructions: 185COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2555012491.00007FF848CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CE0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ff848ce0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: gfff
                        • API String ID: 0-1553575800
                        • Opcode ID: 2d820ac84b4008d13e08fcbebe263c90eb57523aa14b7acda08750e7a577ccf2
                        • Instruction ID: 444696ed28b7e69fc3769d317631dc5a472622f965e2df13e38a7f53d0094fb9
                        • Opcode Fuzzy Hash: 2d820ac84b4008d13e08fcbebe263c90eb57523aa14b7acda08750e7a577ccf2
                        • Instruction Fuzzy Hash: E2512832A0D6950FD30EDA3D5C564A17FA5DB87220B1982BFE186CF1E7E915AC0BC385
                        Function 027BA547 Relevance: 1.4, Strings: 1, Instructions: 117COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID: jO
                        • API String ID: 0-950586835
                        • Opcode ID: 0d1405d904a8ec9a21b48b585199f95bed78d4f7b19f6abedbf54b658fcfe87e
                        • Instruction ID: 5e25a4e9aebbacc679d08ba0510ae07f94560a7dafe9607e421ffcf6b622e7c7
                        • Opcode Fuzzy Hash: 0d1405d904a8ec9a21b48b585199f95bed78d4f7b19f6abedbf54b658fcfe87e
                        • Instruction Fuzzy Hash: 72319171B201054BD70CCE2DD89137637D6EB85309B24D17DDE87C638AEA34D913DA85
                        Function 027B9A67 Relevance: .5, Instructions: 513COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
                        • Instruction ID: 2e442980f171ca7f8ddc6489970a2a771c2881c4287d0999c9eadb4b8ab36f2d
                        • Opcode Fuzzy Hash: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
                        • Instruction Fuzzy Hash: D6E1F472BA86404BC70CDE18DCC26B973DAE7CA30AF19943DE4C7C7247EA29D5038949
                        Function 027C14FB Relevance: .5, Instructions: 509COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 4d2ddfa642b6eaee61030a3cf01379ab019366d0bb5d1dcbce6741d76115933b
                        • Instruction ID: 5056a1277221fe1719d823cf1b00aaeacf1c7eb53a46bc5768f4b403ccf66a51
                        • Opcode Fuzzy Hash: 4d2ddfa642b6eaee61030a3cf01379ab019366d0bb5d1dcbce6741d76115933b
                        • Instruction Fuzzy Hash: 3912697244E3C29FD3538B709C655917FB0AE13228B5E85EFC4C08F4A3E26D895AC762
                        Function 027B8D17 Relevance: .2, Instructions: 200COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: fb693a61039c7200c0fd3da71c84167eb36bb6ef9edf26f62202f146ad5de7b0
                        • Instruction ID: 4240f2ee5a821425ebc70d41f000fd10aeebfd97df419d5e65505cd915dcfb51
                        • Opcode Fuzzy Hash: fb693a61039c7200c0fd3da71c84167eb36bb6ef9edf26f62202f146ad5de7b0
                        • Instruction Fuzzy Hash: B5513B34628A488FDF5BEF7880AC73AB7D6FF99205B448A2F549AC7654DF3488418F05
                        Function 027AC66D Relevance: .2, Instructions: 151COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a5cef0fb1a016c2edbd8968b13218fd752b8b1bb6ff675cd57e188178d151749
                        • Instruction ID: 6342e6e4cf06f36d5e074c0e2cb75c2ec27819fa2afc477e08fdec8cdd429374
                        • Opcode Fuzzy Hash: a5cef0fb1a016c2edbd8968b13218fd752b8b1bb6ff675cd57e188178d151749
                        • Instruction Fuzzy Hash: 60410A7051CB0D4FC329EF6890917B6B3E6FF85310F50062ED99AC3252EB71E4428685
                        Function 027BA9FB Relevance: .2, Instructions: 150COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: eab6162bafe367217c00bd5ee54cbb029d6c6c994dd016d671bafc92b112c7f5
                        • Instruction ID: d7a6e64d2405f3cf49315049fb0abafd92fa07df2d9a747c9c7462bdb1546711
                        • Opcode Fuzzy Hash: eab6162bafe367217c00bd5ee54cbb029d6c6c994dd016d671bafc92b112c7f5
                        • Instruction Fuzzy Hash: AE41CE717187454BC74CDA2D949136A77D6EBCD308F14863EF68BC3381DA34EA028B96
                        Function 027BA662 Relevance: .1, Instructions: 140COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.2460877669.00000000023F0000.00000040.80000000.00040000.00000000.sdmp, Offset: 023F0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_23f0000_INVOICE.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d75244279129b03b2d46ca7731f1933120e41d3437fcbaf93283566a2e8782d0
                        • Instruction ID: caa887d5fe79881ff709050e539be3c2a0feeff202521ffec61370a1cee64e57
                        • Opcode Fuzzy Hash: d75244279129b03b2d46ca7731f1933120e41d3437fcbaf93283566a2e8782d0
                        • Instruction Fuzzy Hash: BC41E4717286454BC74CD92C989176A77D6E7CC308F24863DF58BC3391DA34D9038B86

                        Execution Graph

                        Execution Coverage:1.2%
                        Dynamic/Decrypted Code Coverage:0%
                        Signature Coverage:3%
                        Total number of Nodes:133
                        Total number of Limit Nodes:11
                        execution_graph 87603 424863 87604 42487f 87603->87604 87605 4248a7 87604->87605 87606 4248bb 87604->87606 87607 42c483 NtClose 87605->87607 87613 42c483 87606->87613 87609 4248b0 87607->87609 87610 4248c4 87616 42e663 RtlAllocateHeap 87610->87616 87612 4248cf 87614 42c4a0 87613->87614 87615 42c4b1 NtClose 87614->87615 87615->87610 87616->87612 87617 42e623 87620 42c7a3 87617->87620 87619 42e63e 87621 42c7bd 87620->87621 87622 42c7ce RtlAllocateHeap 87621->87622 87622->87619 87737 42ba73 87738 42ba90 87737->87738 87741 3b52df0 LdrInitializeThunk 87738->87741 87739 42bab8 87741->87739 87742 424bf3 87743 424c0c 87742->87743 87744 424c54 87743->87744 87747 424c97 87743->87747 87749 424c9c 87743->87749 87745 42e543 RtlFreeHeap 87744->87745 87746 424c64 87745->87746 87748 42e543 RtlFreeHeap 87747->87748 87748->87749 87750 428a93 87751 428af8 87750->87751 87752 428b2f 87751->87752 87755 4242a3 87751->87755 87754 428b11 87757 4242ac 87755->87757 87756 424266 87756->87754 87757->87756 87758 424433 87757->87758 87759 424448 87757->87759 87761 42c483 NtClose 87758->87761 87760 42c483 NtClose 87759->87760 87764 424451 87760->87764 87762 42443c 87761->87762 87762->87754 87763 424488 87763->87754 87764->87763 87765 42e543 RtlFreeHeap 87764->87765 87766 42447c 87765->87766 87766->87754 87623 413e43 87624 413e5d 87623->87624 87629 4175f3 87624->87629 87626 413e7b 87627 413ec0 87626->87627 87628 413eaf PostThreadMessageW 87626->87628 87628->87627 87630 417617 87629->87630 87631 417653 LdrLoadDll 87630->87631 87632 41761e 87630->87632 87631->87632 87632->87626 87767 3b52b60 LdrInitializeThunk 87633 418bc8 87634 42c483 NtClose 87633->87634 87635 418bd2 87634->87635 87636 401ba9 87637 401bb0 87636->87637 87640 42fbd3 87637->87640 87643 42e0f3 87640->87643 87644 42e119 87643->87644 87655 407403 87644->87655 87646 42e12f 87654 401c3d 87646->87654 87658 41af83 87646->87658 87648 42e163 87669 428143 87648->87669 87649 42e14e 87649->87648 87673 42c843 87649->87673 87652 42e17d 87653 42c843 ExitProcess 87652->87653 87653->87654 87657 407410 87655->87657 87676 4162b3 87655->87676 87657->87646 87659 41afaf 87658->87659 87691 41ae73 87659->87691 87662 41aff4 87665 41b010 87662->87665 87667 42c483 NtClose 87662->87667 87663 41afdc 87664 41afe7 87663->87664 87666 42c483 NtClose 87663->87666 87664->87649 87665->87649 87666->87664 87668 41b006 87667->87668 87668->87649 87670 4281a5 87669->87670 87672 4281b2 87670->87672 87702 418473 87670->87702 87672->87652 87674 42c860 87673->87674 87675 42c871 ExitProcess 87674->87675 87675->87648 87677 4162d0 87676->87677 87679 4162e9 87677->87679 87680 42ced3 87677->87680 87679->87657 87682 42ceed 87680->87682 87681 42cf1c 87681->87679 87682->87681 87685 42e543 87682->87685 87688 42c7f3 87685->87688 87687 42cf95 87687->87679 87689 42c810 87688->87689 87690 42c821 RtlFreeHeap 87689->87690 87690->87687 87692 41af69 87691->87692 87693 41ae8d 87691->87693 87692->87662 87692->87663 87697 42bb63 87693->87697 87696 42c483 NtClose 87696->87692 87698 42bb80 87697->87698 87701 3b535c0 LdrInitializeThunk 87698->87701 87699 41af5d 87699->87696 87701->87699 87703 41849d 87702->87703 87709 4189ab 87703->87709 87710 413ab3 87703->87710 87705 4185ca 87706 42e543 RtlFreeHeap 87705->87706 87705->87709 87707 4185e2 87706->87707 87708 42c843 ExitProcess 87707->87708 87707->87709 87708->87709 87709->87672 87714 413ad3 87710->87714 87712 413b3c 87712->87705 87713 413b32 87713->87705 87714->87712 87715 41b293 87714->87715 87716 41b2b8 87715->87716 87722 4298e3 87716->87722 87718 41b2f6 87718->87713 87719 41b43e 87719->87713 87720 41b2e9 87720->87718 87720->87719 87721 42e543 RtlFreeHeap 87720->87721 87721->87720 87724 429947 87722->87724 87723 42997a 87723->87720 87724->87723 87727 413913 87724->87727 87726 42995c 87726->87720 87728 4138e1 87727->87728 87729 413927 87727->87729 87732 42c703 87728->87732 87733 42c71d 87732->87733 87736 3b52c70 LdrInitializeThunk 87733->87736 87734 4138f5 87734->87726 87736->87734

                        Executed Functions

                        Function 004175F3 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 220 4175f3-41760f 221 417617-41761c 220->221 222 417612 call 42f243 220->222 223 417622-417630 call 42f843 221->223 224 41761e-417621 221->224 222->221 228 417640-417651 call 42dbc3 223->228 229 417632-41763d call 42fae3 223->229 234 417653-417667 LdrLoadDll 228->234 235 41766a-41766d 228->235 229->228 234->235
                        APIs
                        • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417665
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: Load
                        • String ID:
                        • API String ID: 2234796835-0
                        • Opcode ID: 89db293b298fe0c12458df407a44d2f821da8a9ce99c989979f984b8acfd5efa
                        • Instruction ID: 4be1445ae13f8ce7bab1f871638c103c642be7339a48cc4eb758298bec24da69
                        • Opcode Fuzzy Hash: 89db293b298fe0c12458df407a44d2f821da8a9ce99c989979f984b8acfd5efa
                        • Instruction Fuzzy Hash: 070175B5E0020DABDF10DBE5DC42FDEB7789B14308F4041A6E90897240F635EB488B55
                        Function 0042C483 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 241 42c483-42c4bf call 404783 call 42d6c3 NtClose
                        APIs
                        • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042C4BA
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: Close
                        • String ID:
                        • API String ID: 3535843008-0
                        • Opcode ID: ac97b4c43902d33c4ec92173f30c2d26f5861e0743695127f772d8a548054a39
                        • Instruction ID: 30474918492498bb91211670a29ff49fdc253e9dfa5896dcd6875afdeb4a427d
                        • Opcode Fuzzy Hash: ac97b4c43902d33c4ec92173f30c2d26f5861e0743695127f772d8a548054a39
                        • Instruction Fuzzy Hash: A0E04F353402147BC610BA6AEC41F97775CDFC5B14F10441EFE5C67142C6B5B90186A5
                        Function 03B535C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 653b11319d66dc93a4e4d7d0577f427b3ed36c47dde8b80aef47cba11358581e
                        • Instruction ID: 57caba725c71164a82402d0019f84854edefbcdf82366b70f481dc8060f5b46c
                        • Opcode Fuzzy Hash: 653b11319d66dc93a4e4d7d0577f427b3ed36c47dde8b80aef47cba11358581e
                        • Instruction Fuzzy Hash: 0190027260550802D100B1584914706100587D0205F65C461A4428569E87998A5165A2
                        Function 03B52B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 251 3b52b60-3b52b6c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 9ead42fcc2c7f88674c3128c2e8433d6be3643386ba7bf7be63d8e9a50c29bee
                        • Instruction ID: 3f0e745d86526690cde8d8b6cfa017408a4d8877316823d0fca6fea07f7f650a
                        • Opcode Fuzzy Hash: 9ead42fcc2c7f88674c3128c2e8433d6be3643386ba7bf7be63d8e9a50c29bee
                        • Instruction Fuzzy Hash: 159002A2202404034105B1584814616400A87E0205B55C071E5018591EC62989916125
                        Function 03B52DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 253 3b52df0-3b52dfc LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 9d8f411943b9a5f26ed5880e97bb7631e2a35f65f14fe5d74ade55647b6e6188
                        • Instruction ID: d478c98f11f75bd0d766da6aa61c074699cd851391d5c716714b2d5f508e2f50
                        • Opcode Fuzzy Hash: 9d8f411943b9a5f26ed5880e97bb7631e2a35f65f14fe5d74ade55647b6e6188
                        • Instruction Fuzzy Hash: 8990027220140813D111B1584904707000987D0245F95C462A4428559E975A8A52A121
                        Function 03B52C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 252 3b52c70-3b52c7c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 8334a1eb90e867944282392dbf542e1808084382943981f888d48bc9cb0e592e
                        • Instruction ID: c62c746799fc13be05385243270e5e96d7d7ed52067f3675202620117d931da3
                        • Opcode Fuzzy Hash: 8334a1eb90e867944282392dbf542e1808084382943981f888d48bc9cb0e592e
                        • Instruction Fuzzy Hash: 6390027220148C02D110B158880474A000587D0305F59C461A8428659E879989917121
                        Function 00413E3B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61threadwindowCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        • PostThreadMessageW.USER32(6z95F416,00000111,00000000,00000000), ref: 00413EBA
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: MessagePostThread
                        • String ID: 6z95F416$6z95F416$U
                        • API String ID: 1836367815-1488886442
                        • Opcode ID: e1141bcc19d14026d44e04504ffaa5eabbf50b348636554287f31f6c5b809c23
                        • Instruction ID: 77b8f06ecf4c598e9117fb0ad244738258d9e5b9aeae9413597ef242356a2757
                        • Opcode Fuzzy Hash: e1141bcc19d14026d44e04504ffaa5eabbf50b348636554287f31f6c5b809c23
                        • Instruction Fuzzy Hash: 9501E5B1D0121CBAEB10ABE19C81DEF7B3CEF41694F048069FA046B240E6794F068BB5
                        Function 00413CD5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 14 413cd5-413d02 15 413d03-413d08 14->15 16 413d09-413d0b 15->16 16->15 17 413d0d-413d10 16->17 17->16 18 413d12-413d1a 17->18 19 413d1c 18->19 20 413d3f-413d95 18->20 19->20 22 413d97-413d9d 20->22 23 413ded-413e29 20->23 24 413dbb-413dbd 22->24 25 413e2a-413e2b 23->25 24->25 26 413dbf-413dce 24->26 27 413e47-413ead call 42e5e3 call 42eff3 call 4175f3 call 4046f3 call 424d13 25->27 28 413e2d-413e2e 25->28 40 413ecd-413ed3 27->40 41 413eaf-413ebe PostThreadMessageW 27->41 28->24 29 413e30-413e3a 28->29 41->40 42 413ec0-413eca 41->42 42->40
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: 6z95F416$6z95F416
                        • API String ID: 0-1711006443
                        • Opcode ID: 5916660ccd5641919a1c29a873cf93e9faeb33e0c742dc781745e6c8ab64a584
                        • Instruction ID: dc8aa834b5320529191e24cc97722c6782054caa585890ef7fba371710979100
                        • Opcode Fuzzy Hash: 5916660ccd5641919a1c29a873cf93e9faeb33e0c742dc781745e6c8ab64a584
                        • Instruction Fuzzy Hash: 5351EF72A04294AFDB05CF69DC81EEFBBB8EF4235470445AEE4509B202D3298E42C7D9
                        Function 00413E43 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60threadwindowCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 43 413e43-413e55 44 413e5d-413ead call 42eff3 call 4175f3 call 4046f3 call 424d13 43->44 45 413e58 call 42e5e3 43->45 54 413ecd-413ed3 44->54 55 413eaf-413ebe PostThreadMessageW 44->55 45->44 55->54 56 413ec0-413eca 55->56 56->54
                        APIs
                        • PostThreadMessageW.USER32(6z95F416,00000111,00000000,00000000), ref: 00413EBA
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: MessagePostThread
                        • String ID: 6z95F416$6z95F416
                        • API String ID: 1836367815-1711006443
                        • Opcode ID: 247c2cb7c5c52ffb5eb69ca6dc854c34289a0b52efc5148f43d6751407cdbf8d
                        • Instruction ID: f10270625e5dc92c68258f0232b3cd4dcae614a49ba2bf94f5ecb21f47ad6814
                        • Opcode Fuzzy Hash: 247c2cb7c5c52ffb5eb69ca6dc854c34289a0b52efc5148f43d6751407cdbf8d
                        • Instruction Fuzzy Hash: 4E01C4B1D0021CBAEB10AAE19C81DEF7B7CEF41698F048069FA04A7241E67D5F0647B5
                        Function 0042C7F3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 57 42c7f3-42c837 call 404783 call 42d6c3 RtlFreeHeap
                        APIs
                        • RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4), ref: 0042C832
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: FreeHeap
                        • String ID: AcA
                        • API String ID: 3298025750-3239212935
                        • Opcode ID: 1e96225afe08b9273e61a5852ac3e22411838b467e08afe5843f7510d07b2ee8
                        • Instruction ID: dc65de1a7714ddc9f0030df07a1b9deac78c7594a76851e62b9ed2031c6aeccf
                        • Opcode Fuzzy Hash: 1e96225afe08b9273e61a5852ac3e22411838b467e08afe5843f7510d07b2ee8
                        • Instruction Fuzzy Hash: 3BE06DB17042087BC610EE59DC45F9B77ACDFC5B14F000419FD08A7241D6B1B9118AB9
                        Function 0042C7A3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 236 42c7a3-42c7e4 call 404783 call 42d6c3 RtlAllocateHeap
                        APIs
                        • RtlAllocateHeap.NTDLL(?,0041E434,?,?,00000000,?,0041E434,?,?,?), ref: 0042C7DF
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: AllocateHeap
                        • String ID:
                        • API String ID: 1279760036-0
                        • Opcode ID: 64c00d02f523502eb1660e3799242fc5495c015b61913834d372ac60d948e997
                        • Instruction ID: 7acd433c533aab11e6ed9c04a21891b5126a1552eec8437867cece84375c4076
                        • Opcode Fuzzy Hash: 64c00d02f523502eb1660e3799242fc5495c015b61913834d372ac60d948e997
                        • Instruction Fuzzy Hash: 50E06DB22002047BC610EF59EC45E9B77ADDFC5710F000419F918A7241D771B9108BB9
                        Function 0042C843 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 246 42c843-42c87f call 404783 call 42d6c3 ExitProcess
                        APIs
                        • ExitProcess.KERNEL32(?,00000000,00000000,?,D2355E8B,?,?,D2355E8B), ref: 0042C87A
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452558116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_400000_iexplore.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExitProcess
                        • String ID:
                        • API String ID: 621844428-0
                        • Opcode ID: 70dbe3668ed7c10ea1d60b24a3b03d86c8d677dc8f3fa783b2cedd13162d6288
                        • Instruction ID: 4b5b47a976eb51f8b15a2b04cdfb5a9708e7c412ba6db9b18aef733ca89ee91a
                        • Opcode Fuzzy Hash: 70dbe3668ed7c10ea1d60b24a3b03d86c8d677dc8f3fa783b2cedd13162d6288
                        • Instruction Fuzzy Hash: ECE086352006147BD110FB5ADC41F97776CDFC5B24F408419FA08A7141CA717901C7F4

                        Non-executed Functions

                        Function 03B92349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                        • API String ID: 0-2160512332
                        • Opcode ID: f3e10f4de21179a3ce74c558d470315626324e7460e818540293bdacaa515a72
                        • Instruction ID: 8068820be5da7e99753af7d8e1d020c1278d4530bb53613dd154ba381bf659f1
                        • Opcode Fuzzy Hash: f3e10f4de21179a3ce74c558d470315626324e7460e818540293bdacaa515a72
                        • Instruction Fuzzy Hash: 14925D75A04345AFEB24DE24C880B6AB7E8FB84758F044DBEFA94DB250D774E844CB52
                        Function 03B48620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                        Download Yara Rule
                        Strings
                        • Thread identifier, xrefs: 03B8553A
                        • Critical section address, xrefs: 03B85425, 03B854BC, 03B85534
                        • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 03B8540A, 03B85496, 03B85519
                        • Thread is in a state in which it cannot own a critical section, xrefs: 03B85543
                        • undeleted critical section in freed memory, xrefs: 03B8542B
                        • corrupted critical section, xrefs: 03B854C2
                        • Critical section debug info address, xrefs: 03B8541F, 03B8552E
                        • double initialized or corrupted critical section, xrefs: 03B85508
                        • Invalid debug info address of this critical section, xrefs: 03B854B6
                        • 8, xrefs: 03B852E3
                        • Critical section address., xrefs: 03B85502
                        • Address of the debug info found in the active list., xrefs: 03B854AE, 03B854FA
                        • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 03B854CE
                        • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 03B854E2
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                        • API String ID: 0-2368682639
                        • Opcode ID: 41030042cc0da67f4768a0ff254c840f32090e3f0cb67623ad5a8836d38a0ac2
                        • Instruction ID: 783e69dde74491d4371c2117355482ba1434987d5b4514a6c7c7b9a924e52d0b
                        • Opcode Fuzzy Hash: 41030042cc0da67f4768a0ff254c840f32090e3f0cb67623ad5a8836d38a0ac2
                        • Instruction Fuzzy Hash: 3481B0B1A01348BFDF20DF99C841BAEBBB9FB09708F1441AAF514BB241C375A940CB50
                        Function 03BC12ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                        • API String ID: 0-3591852110
                        • Opcode ID: d7282570b71f9da3b3671ee9f994ee1b78be12cb425a959545ccd81703d7888b
                        • Instruction ID: 138c65aaed9501fe83099c3e0c90b6b91b9cd061bd3d75b37fce26ecaf02fc95
                        • Opcode Fuzzy Hash: d7282570b71f9da3b3671ee9f994ee1b78be12cb425a959545ccd81703d7888b
                        • Instruction Fuzzy Hash: 5912AD34614681EFD735CF2CC445BBABBE5FF09618F1884ADE496AB682D734E881CB50
                        Function 03B0D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                        • API String ID: 0-3532704233
                        • Opcode ID: 0c1ce0c4a80d0e8f78b3ff34f7cc92e71ef9d90e9d74df519facb52897a6dc69
                        • Instruction ID: 88333cbba3430b9337c409c24c432dfe9eb09eb100b0bcba832094e8177c4984
                        • Opcode Fuzzy Hash: 0c1ce0c4a80d0e8f78b3ff34f7cc92e71ef9d90e9d74df519facb52897a6dc69
                        • Instruction Fuzzy Hash: E3B17D715083559FCB21DFA4C440B6FBBE8EB88758F0549BEF889EB290D734D9448B92
                        Function 03BA9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                        • API String ID: 0-3063724069
                        • Opcode ID: a5ad413313971921903ae352008187ee9b5240ee5c45d504b061953db56c1acd
                        • Instruction ID: a8d7e06dbf24c46a7a6a232f2404a634d0ae7d3bbb96dea25ec7172fdf68660b
                        • Opcode Fuzzy Hash: a5ad413313971921903ae352008187ee9b5240ee5c45d504b061953db56c1acd
                        • Instruction Fuzzy Hash: DCD1D1B280CF19AFDB21DE5CC841B6BB7E8AFC4758F044AB9FA849B150D774C9049792
                        Function 03BC0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                        • API String ID: 0-1700792311
                        • Opcode ID: 54e3bef9fef1032404a7e40fb3e79e476901cf8d703df9589313d3722ba37531
                        • Instruction ID: 464d44f658026f1481597dfd20cb4acdcf6e32164224ea9661da10b7ea72a0b0
                        • Opcode Fuzzy Hash: 54e3bef9fef1032404a7e40fb3e79e476901cf8d703df9589313d3722ba37531
                        • Instruction Fuzzy Hash: 61D1AE35A206C5DFCB25EF68C440AAEFBF1FF4A618F0980ADE4959B252C735D941CB10
                        Function 03B0D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON
                        Download Yara Rule
                        Strings
                        • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 03B0D262
                        • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 03B0D146
                        • Control Panel\Desktop\LanguageConfiguration, xrefs: 03B0D196
                        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 03B0D2C3
                        • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 03B0D0CF
                        • @, xrefs: 03B0D313
                        • @, xrefs: 03B0D2AF
                        • @, xrefs: 03B0D0FD
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                        • API String ID: 0-1356375266
                        • Opcode ID: 140360fea835633735d1d1d734635844b049a1707a0e817b1203b3e9f93b7c3d
                        • Instruction ID: 1b5b48167a838a8e26aae38ba0552e08a60aa78196cb90ace6384f6c7c9cc4f5
                        • Opcode Fuzzy Hash: 140360fea835633735d1d1d734635844b049a1707a0e817b1203b3e9f93b7c3d
                        • Instruction Fuzzy Hash: 95A15AB19083459FD721DF64C480B6BFBE8BB84719F0049BEF9989A280D774D908CF92
                        Function 03B0F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                        • API String ID: 0-523794902
                        • Opcode ID: 3af2d5cecc3bba4b561b7711a6adf417471ada49faa49620d6a4f79731934404
                        • Instruction ID: f4b7243e12891d413f1a84a3c64896c028896963b51890afd38740a35126861d
                        • Opcode Fuzzy Hash: 3af2d5cecc3bba4b561b7711a6adf417471ada49faa49620d6a4f79731934404
                        • Instruction Fuzzy Hash: 5642CF397083819FC725DF28C594A2AFBE5FF84608F0849FDE4968B292D738D945CB51
                        Function 03B2B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                        • API String ID: 0-122214566
                        • Opcode ID: 8b8e63d2648979c63c22aebe8929383851597afb11c77b6bc34ffe60a62e9ba6
                        • Instruction ID: a46f3215267bb6d73017048fd467aa26eeb8fedea40028412de345b77e0fabb2
                        • Opcode Fuzzy Hash: 8b8e63d2648979c63c22aebe8929383851597afb11c77b6bc34ffe60a62e9ba6
                        • Instruction Fuzzy Hash: DAC1E831A003259ADB24DB68C895B7EBF65EF8531CF1842F9E81ADF281DBB49944C391
                        Function 03B463FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                        • API String ID: 0-792281065
                        • Opcode ID: 717b518d7ef2e622c6b8bb56f94362d3478570db98031bb2b8e58200d12fd47e
                        • Instruction ID: 191e66d9ca55c63c0bdd07b65859e748d1a1d1395c75f1445f4cfc2de12d92fb
                        • Opcode Fuzzy Hash: 717b518d7ef2e622c6b8bb56f94362d3478570db98031bb2b8e58200d12fd47e
                        • Instruction Fuzzy Hash: 0C913734B043559FDF24FF59E944BAEB7A4EB82B1CF0501FAE910AB281D7708801DB94
                        Function 03B4C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                        Download Yara Rule
                        Strings
                        • Loading import redirection DLL: '%wZ', xrefs: 03B88170
                        • minkernel\ntdll\ldrinit.c, xrefs: 03B4C6C3
                        • LdrpInitializeProcess, xrefs: 03B4C6C4
                        • minkernel\ntdll\ldrredirect.c, xrefs: 03B88181, 03B881F5
                        • Unable to build import redirection Table, Status = 0x%x, xrefs: 03B881E5
                        • LdrpInitializeImportRedirection, xrefs: 03B88177, 03B881EB
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                        • API String ID: 0-475462383
                        • Opcode ID: 83458f43ad28ec284c8ed7fe812df011bf3cf7df0f8f7255de4e49d5214fb65d
                        • Instruction ID: 79505395ad70ad95a9a75822e69081304b96824acaa70d763988be3b5e5dca58
                        • Opcode Fuzzy Hash: 83458f43ad28ec284c8ed7fe812df011bf3cf7df0f8f7255de4e49d5214fb65d
                        • Instruction Fuzzy Hash: E931F379744345AFC610FF2CD946E2AB799EFC4B18F0505B8F941AF291EA20EC04C7A2
                        Function 03B351EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON
                        Download Yara Rule
                        Strings
                        • Kernel-MUI-Language-Allowed, xrefs: 03B3527B
                        • Kernel-MUI-Number-Allowed, xrefs: 03B35247
                        • WindowsExcludedProcs, xrefs: 03B3522A
                        • Kernel-MUI-Language-SKU, xrefs: 03B3542B
                        • Kernel-MUI-Language-Disallowed, xrefs: 03B35352
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                        • API String ID: 0-258546922
                        • Opcode ID: f7c37deb33bec910bdd2ffe6b6954f24daf9fb6bde4e8f4cb19a4365f31870f5
                        • Instruction ID: 07b46af2b7cb003919a3e7f5c7a550418a2b2f2f804aed07059be8f445153baf
                        • Opcode Fuzzy Hash: f7c37deb33bec910bdd2ffe6b6954f24daf9fb6bde4e8f4cb19a4365f31870f5
                        • Instruction Fuzzy Hash: 27F14F76D00228EFCB25DFA4C980ADEBBF9FF4A654F1541AAE505EB210D7749E018B90
                        Function 03B3D7B0 Relevance: 6.4, Strings: 5, Instructions: 151COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                        • API String ID: 0-1975516107
                        • Opcode ID: cadbc6f7a4cf90f96217e4c2a11254f76cb1af4fbeace510b320710a4d974e6b
                        • Instruction ID: 4ae9f1d211c237a86850565fd5aa93e82a6d8df7c6701c2d2a84ce885e3fc12b
                        • Opcode Fuzzy Hash: cadbc6f7a4cf90f96217e4c2a11254f76cb1af4fbeace510b320710a4d974e6b
                        • Instruction Fuzzy Hash: F951FC75A04395DFDB14EFA8C5847ADBBB1FF4A30CF2942ADD411AB2A5D770A841CB80
                        Function 03B076B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                        • API String ID: 0-3061284088
                        • Opcode ID: 6c3b8d8bfb5198b1c49dfa67243b7f6c9c20636bd16c6e89c056b252fe5ff49f
                        • Instruction ID: 90b9af7be645980d04b787aa843d62927af67c0cbb7495c84a5edbde8c956fd3
                        • Opcode Fuzzy Hash: 6c3b8d8bfb5198b1c49dfa67243b7f6c9c20636bd16c6e89c056b252fe5ff49f
                        • Instruction Fuzzy Hash: D001F036144780EED22DD71DE409F56BFE4EB43A38F1980FAE054CB592CAA8DC84C560
                        Function 03B270C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                        • API String ID: 0-3178619729
                        • Opcode ID: 5bd13395a01d76c2f7ef8464c5695cf101b43f6764acbdcdf51858a176af0e43
                        • Instruction ID: 515d45d843020c9d78077fcaa055d0e88afee4815a3107e1a0d4c71962f18cd3
                        • Opcode Fuzzy Hash: 5bd13395a01d76c2f7ef8464c5695cf101b43f6764acbdcdf51858a176af0e43
                        • Instruction Fuzzy Hash: FB139C70A006659FDB25CF68C4907A9FBF1FF49308F1882E9D859AB386D734A945CF90
                        Function 03B21070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                        • API String ID: 0-3570731704
                        • Opcode ID: 2d12d5b3ba11d7925f178eaa7d53ee58b1186eaa3c321c19ef401598ad73cbe6
                        • Instruction ID: 178c916e6d98374a4c40d1eb73bb87f562a774ac544a260a7b1dd069afb1ca09
                        • Opcode Fuzzy Hash: 2d12d5b3ba11d7925f178eaa7d53ee58b1186eaa3c321c19ef401598ad73cbe6
                        • Instruction Fuzzy Hash: 34922B75A01268CFEB24CF18C840BA9BBB5EF45318F1982FAD95DAB251D7349E80CF51
                        Function 03B1A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                        • API String ID: 0-379654539
                        • Opcode ID: 20f1b770840305be4eb79b6a207017773bf7d65f1f86e9758de15735695b25dc
                        • Instruction ID: f878d0c4bdd2deb15ac9278d5917979e91b050ed548d90850c6769d3dbb12252
                        • Opcode Fuzzy Hash: 20f1b770840305be4eb79b6a207017773bf7d65f1f86e9758de15735695b25dc
                        • Instruction Fuzzy Hash: D0C17874509382CFC721CF68C040B6AB7E4FF85708F4449BAF8969B254E734EA59CB62
                        Function 03B4273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                        Download Yara Rule
                        Strings
                        • .Local, xrefs: 03B428D8
                        • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 03B821D9, 03B822B1
                        • SXS: %s() passed the empty activation context, xrefs: 03B821DE
                        • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 03B822B6
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                        • API String ID: 0-1239276146
                        • Opcode ID: 22a5a82e5b2abcb94994f8caf3671714e74da9f5073057c21a51207187f5032c
                        • Instruction ID: b00d9f5e70f8ecb8a5d5dc33faa6e8997d5dc18128860525b3a1acf042f3b02d
                        • Opcode Fuzzy Hash: 22a5a82e5b2abcb94994f8caf3671714e74da9f5073057c21a51207187f5032c
                        • Instruction Fuzzy Hash: 0DA16D35D012299BDB24DF64D884BA9B3B5FF58318F1949FAE808AB251D730DE80DF94
                        Function 03B0F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                        • API String ID: 0-2586055223
                        • Opcode ID: a9c890359ee9d2fb8ead980789e96405149c246d5d67978822dee48bd1f42fdd
                        • Instruction ID: b939799d94b5704acf266b9a63c48ee75f840f607b2fa785d6b6a56ce46e7a69
                        • Opcode Fuzzy Hash: a9c890359ee9d2fb8ead980789e96405149c246d5d67978822dee48bd1f42fdd
                        • Instruction Fuzzy Hash: 4861043A204380AFD721DB68C944F6BBBE9EF80758F0804F9F9558B292D738D945CB61
                        Function 03BC11A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                        • API String ID: 0-336120773
                        • Opcode ID: 237bdb86ab69db0e7d15beca7a8fad3e283b51cf14eb0454c387f7094fa096df
                        • Instruction ID: d8a557cf2639b5e46c81941a47915e359ca93d1ce9fe734f5863449708504946
                        • Opcode Fuzzy Hash: 237bdb86ab69db0e7d15beca7a8fad3e283b51cf14eb0454c387f7094fa096df
                        • Instruction Fuzzy Hash: 7831A239A20290EFD720DB9CC885F6AB7E8EF0566CF1841F9E451EF292D670DC41CA65
                        Function 03B09148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                        • API String ID: 0-1391187441
                        • Opcode ID: 5e139bebd96a102a03597f0d01466534a77c63b86e2d6f8a14e74e1fce854a82
                        • Instruction ID: c2792251aba7777294492196b82a7425447b8eeb7bb0cbaf068abee5906f8b5d
                        • Opcode Fuzzy Hash: 5e139bebd96a102a03597f0d01466534a77c63b86e2d6f8a14e74e1fce854a82
                        • Instruction Fuzzy Hash: E1318536B40204FFCB11DB59CC85F9EBBB9EF45668F1440B5E924AB292D774D940CA60
                        Function 03B20770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                        • API String ID: 0-4253913091
                        • Opcode ID: 91dcac0dd158626475c100031770d768ca496df805e714d452e7a3ac0248b7bd
                        • Instruction ID: 060b966cb904b88c367e92f589c1868cca9f59b77eb79e6f7f790998a5d7e6f8
                        • Opcode Fuzzy Hash: 91dcac0dd158626475c100031770d768ca496df805e714d452e7a3ac0248b7bd
                        • Instruction Fuzzy Hash: D3F19A74A00605DFDB25DF68C884B6ABBB5FF45308F1882F9E41A9B391D734E981CB90
                        Function 03B1B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
                        • API String ID: 0-1145731471
                        • Opcode ID: b13ab7763c9ff0bb57399ac084645bfa2e4076ac165915c3f604585070623789
                        • Instruction ID: d4433e1d6ea28e8320c3667ad5a39dd2e7277c88783dff1e5a053ed1e2f10e58
                        • Opcode Fuzzy Hash: b13ab7763c9ff0bb57399ac084645bfa2e4076ac165915c3f604585070623789
                        • Instruction Fuzzy Hash: DBB1AF3AA046549FCB25CF69C980BADB7F5EF44718F1885B9E465EB380D730E850CB90
                        Function 03B9368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                        • API String ID: 0-2391371766
                        • Opcode ID: 2414a11de7ea1b9f62ad7299582a1c2763f5f5fddbd93ac751472bc007a75fa7
                        • Instruction ID: 3a05464f4556dabdf18fc520680ef4cec10ce0378906770d6d3f64a0a8e63218
                        • Opcode Fuzzy Hash: 2414a11de7ea1b9f62ad7299582a1c2763f5f5fddbd93ac751472bc007a75fa7
                        • Instruction Fuzzy Hash: FFB19C7A604345AFEB11DF54C880F6BB7E8EB44718F0509BAFA489B290D774EC14CB92
                        Function 03B0A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: FilterFullPath$UseFilter$\??\
                        • API String ID: 0-2779062949
                        • Opcode ID: fa0037f97ac821d0b681648a163bdc3fa99f378e040acf1dd634390624acbd0e
                        • Instruction ID: 2ded8e2b1f0515b20a3d5eb1152fd8664c9bccffb669b54e70465de112e3ca7e
                        • Opcode Fuzzy Hash: fa0037f97ac821d0b681648a163bdc3fa99f378e040acf1dd634390624acbd0e
                        • Instruction Fuzzy Hash: A1A17E75D012299BDB31DF64CC88BA9BBB8EF44708F1405FAE909AB251D7399E84CF50
                        Function 03BA36EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                        • API String ID: 0-318774311
                        • Opcode ID: 143d8736a7180ca465e665b98881fc65b03c105c016427df5384f6cb998ec1ca
                        • Instruction ID: 88149271645c0132f6b530f91bbf14d315bfc79ff68152be76191a00533c5a46
                        • Opcode Fuzzy Hash: 143d8736a7180ca465e665b98881fc65b03c105c016427df5384f6cb998ec1ca
                        • Instruction Fuzzy Hash: 2F818C7960CB40AFE711DF18C844F6AB7E8EF85758F0809B9B9899B390D774D904CB52
                        Function 03B4909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: %$&$@
                        • API String ID: 0-1537733988
                        • Opcode ID: 90a158a58e4f915327ebd5cb11290af80228d3d5a7231db0b474ecb613bdf850
                        • Instruction ID: b43dafeb5b75a2c95dde503e2e92b4305b8e396f60eba2cc7d85509756d89ec0
                        • Opcode Fuzzy Hash: 90a158a58e4f915327ebd5cb11290af80228d3d5a7231db0b474ecb613bdf850
                        • Instruction Fuzzy Hash: 9B71BF746093419FC724DF24C580A2BBBE9FF8961CF1489BEE49A8B250D730D905DF5A
                        Function 03BEB73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                        Download Yara Rule
                        Strings
                        • GlobalizationUserSettings, xrefs: 03BEB834
                        • TargetNtPath, xrefs: 03BEB82F
                        • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 03BEB82A
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                        • API String ID: 0-505981995
                        • Opcode ID: 0f4ce72e5ffbe646375a46f820d4cc8d6bec239fb222a05cda1eec2df67c492a
                        • Instruction ID: 03dff79a22cd9164dbbec3250084cf5c29c59cb2bce3708c447ec3be477774a2
                        • Opcode Fuzzy Hash: 0f4ce72e5ffbe646375a46f820d4cc8d6bec239fb222a05cda1eec2df67c492a
                        • Instruction Fuzzy Hash: 41615076945229ABDB31DF58DC88BDAB7B8EF04718F0502F9A508AB250D774DE84CF90
                        Function 03B0F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                        Download Yara Rule
                        Strings
                        • HEAP: , xrefs: 03B6E6B3
                        • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 03B6E6C6
                        • HEAP[%wZ]: , xrefs: 03B6E6A6
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                        • API String ID: 0-1340214556
                        • Opcode ID: 8180bd74ad311ab935830e721916d426099d1b82f07894b812999562df900c44
                        • Instruction ID: 672b7a004c5a6e6cc8df03a12583ebfbfab2ea634703f19b7d24688da595d718
                        • Opcode Fuzzy Hash: 8180bd74ad311ab935830e721916d426099d1b82f07894b812999562df900c44
                        • Instruction Fuzzy Hash: CA51C439704784EFD722DBA8C994BA6BBF8EF05348F0840F5E5458B692D778E950CB10
                        Function 03B4C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                        Download Yara Rule
                        Strings
                        • minkernel\ntdll\ldrinit.c, xrefs: 03B882E8
                        • LdrpInitializePerUserWindowsDirectory, xrefs: 03B882DE
                        • Failed to reallocate the system dirs string !, xrefs: 03B882D7
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                        • API String ID: 0-1783798831
                        • Opcode ID: 000041e4a7a84c6b26003b03e8a4c3bc3f1033b2b8fb6cf2a76eb45609ca93aa
                        • Instruction ID: a168f5c9f6bb5177950911a855dd387224c97fbdaebe85b8cefdf77a4fb49c94
                        • Opcode Fuzzy Hash: 000041e4a7a84c6b26003b03e8a4c3bc3f1033b2b8fb6cf2a76eb45609ca93aa
                        • Instruction Fuzzy Hash: 614125B5545350ABC720FF68D940B5B7BE8EF44B58F0549BAB988CB260EB70EC00CB95
                        Function 03B416CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                        Download Yara Rule
                        Strings
                        • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 03B81B39
                        • LdrpAllocateTls, xrefs: 03B81B40
                        • minkernel\ntdll\ldrtls.c, xrefs: 03B81B4A
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                        • API String ID: 0-4274184382
                        • Opcode ID: f194b203023db8023b4abb06f6df2e225806249300f61272760791d6033c6f81
                        • Instruction ID: 121f87796a5d42c903340000eaf43590d242e86b04aab8334c4c7fca6355041c
                        • Opcode Fuzzy Hash: f194b203023db8023b4abb06f6df2e225806249300f61272760791d6033c6f81
                        • Instruction Fuzzy Hash: 1F419DB9E01708AFCB15DFA8C941BADFBF5FF48708F0481A9E415AB240D774A941DB94
                        Function 03BCC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                        Download Yara Rule
                        Strings
                        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 03BCC1C5
                        • PreferredUILanguages, xrefs: 03BCC212
                        • @, xrefs: 03BCC1F1
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                        • API String ID: 0-2968386058
                        • Opcode ID: 7c54c587f3a9963f323e130e5ca1eecb4e3a39b1aeb25fbff04b25ee12c7e9ca
                        • Instruction ID: ae3137c7a55df2380dc754cead008498679e45fb61013619e24f54e8fc1621c6
                        • Opcode Fuzzy Hash: 7c54c587f3a9963f323e130e5ca1eecb4e3a39b1aeb25fbff04b25ee12c7e9ca
                        • Instruction Fuzzy Hash: F7417175E10259ABDF20DFD8C851BEEBBBCEB14708F0441BEE909AB290D7749A45CB50
                        Function 03BA4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                        • API String ID: 0-1373925480
                        • Opcode ID: c725c4ed54c8c52cb9197abfca98e68e9cebebbd8079b12103a1712caabe4d98
                        • Instruction ID: 9339296b39634adfe2e6438036989f1ae3318f4eba6a6095d8faa780652be4f8
                        • Opcode Fuzzy Hash: c725c4ed54c8c52cb9197abfca98e68e9cebebbd8079b12103a1712caabe4d98
                        • Instruction Fuzzy Hash: 0D41E635918F588BEB21DBAAC8407ADBBB8EF45348F1805FAD905EF791D7B48901CB10
                        Function 03B94755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                        Download Yara Rule
                        Strings
                        • minkernel\ntdll\ldrredirect.c, xrefs: 03B94899
                        • LdrpCheckRedirection, xrefs: 03B9488F
                        • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 03B94888
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                        • API String ID: 0-3154609507
                        • Opcode ID: c54caa8a23fa6c5f831ea6a57b32cc60678ef24459900d404b96897f9422d2be
                        • Instruction ID: 9337a7668c375e0ea2fa6c3812c82661d94c92e2c99772b830eb5cac91aa92b8
                        • Opcode Fuzzy Hash: c54caa8a23fa6c5f831ea6a57b32cc60678ef24459900d404b96897f9422d2be
                        • Instruction Fuzzy Hash: 1F41D232A043559FDF21CF6AD880A26B7E8EF49658F0A05FAEC48DB211D730DC02CB91
                        Function 03B433A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                        Download Yara Rule
                        Strings
                        • Actx , xrefs: 03B433AC
                        • RtlCreateActivationContext, xrefs: 03B829F9
                        • SXS: %s() passed the empty activation context data, xrefs: 03B829FE
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                        • API String ID: 0-859632880
                        • Opcode ID: 9bcf1dbae6e47e8b38ff3c1cd19e2b9f653c2d033769babeea69902b850d9a56
                        • Instruction ID: 473d6dfc655b24ecf3457ebb2705534f8420d4bd9b132922c5a5be8105c51c72
                        • Opcode Fuzzy Hash: 9bcf1dbae6e47e8b38ff3c1cd19e2b9f653c2d033769babeea69902b850d9a56
                        • Instruction Fuzzy Hash: E431033A6003059FDB26EF68E890BD6B7E4EF84728F0944B9E9099F282D770D951C790
                        Function 03B41607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                        Download Yara Rule
                        Strings
                        • LdrpInitializeTls, xrefs: 03B81A47
                        • minkernel\ntdll\ldrtls.c, xrefs: 03B81A51
                        • DLL "%wZ" has TLS information at %p, xrefs: 03B81A40
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                        • API String ID: 0-931879808
                        • Opcode ID: 4b63e51ee85ab30c38c780f2df81e88d38bf63924b68b78f3cad16693a09fefe
                        • Instruction ID: 90032d1be3a822de4fc6c2634d25ca813d707864725afd7614c7afa4e60c0f1e
                        • Opcode Fuzzy Hash: 4b63e51ee85ab30c38c780f2df81e88d38bf63924b68b78f3cad16693a09fefe
                        • Instruction Fuzzy Hash: 2231E1B1E04344ABDB10EB5CC989FAA72A8EB4674CF0501BAE505EB180D770ED849BA4
                        Function 03B51270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON
                        Download Yara Rule
                        Strings
                        • BuildLabEx, xrefs: 03B5130F
                        • \Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 03B5127B
                        • @, xrefs: 03B512A5
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                        • API String ID: 0-3051831665
                        • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                        • Instruction ID: 48deebd3c346e40ae845c8de00ec40d1d9e7530988a7f27869b5a8f207493772
                        • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                        • Instruction Fuzzy Hash: 26319E76A00218BBDF11EFA9CC44FAEBBBDEB84618F0044B5F904AB160D7309A05CB50
                        Function 03B920DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                        Download Yara Rule
                        Strings
                        • Process initialization failed with status 0x%08lx, xrefs: 03B920F3
                        • minkernel\ntdll\ldrinit.c, xrefs: 03B92104
                        • LdrpInitializationFailure, xrefs: 03B920FA
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                        • API String ID: 0-2986994758
                        • Opcode ID: 302f337efab5e4062ea9c8b996a498f2ff565231da163fc92f894024a4a3ff4c
                        • Instruction ID: 914a23a11377ac8c8cece1a4d9b48331c93f949cf90a159caaef21deb0ad0e52
                        • Opcode Fuzzy Hash: 302f337efab5e4062ea9c8b996a498f2ff565231da163fc92f894024a4a3ff4c
                        • Instruction Fuzzy Hash: 4CF0A479A40358BFEA14E64CCD42F997768EB40B58F1504BAF600AB282D2B0A950CA91
                        Function 03B203E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: ___swprintf_l
                        • String ID: #%u
                        • API String ID: 48624451-232158463
                        • Opcode ID: 8187f3db44ca79c8a8fd110ec5bbdbc5b6fb8d1850b212a02826d5fc4abe211a
                        • Instruction ID: e2bc21b275f2b2ecfc048e4bb39ee94fcdaafb1f1644d6335d1978dd77a8f9be
                        • Opcode Fuzzy Hash: 8187f3db44ca79c8a8fd110ec5bbdbc5b6fb8d1850b212a02826d5fc4abe211a
                        • Instruction Fuzzy Hash: 0B717C75A002499FDB01DFA9C990BAEBBF8FF48308F1541A5E905EB251EB34ED01CB60
                        Function 03B252A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @$@
                        • API String ID: 0-149943524
                        • Opcode ID: 2fd13b435344ec6af95aa2107f57265c9b74ed2b012bfdb2d17e4b7577d52692
                        • Instruction ID: 87886e54fb29e418d90f8a6987a4053670a728c38f2d40ea00a366a2032a780c
                        • Opcode Fuzzy Hash: 2fd13b435344ec6af95aa2107f57265c9b74ed2b012bfdb2d17e4b7577d52692
                        • Instruction Fuzzy Hash: 91327C745087218BC734CF15C480B7AFBE5EF8A748F184AAEF9999B290E774D940CB52
                        Function 03BDA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: `$`
                        • API String ID: 0-197956300
                        • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                        • Instruction ID: 60c26db0167b2caf04da3b838e33f5c032ed348452a178fa4839628d4b15a203
                        • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                        • Instruction Fuzzy Hash: 82C18C312043429BDB24CE28C841B6BBBE5EFC471CF184ABDF995DA290E775E505CB92
                        Function 03B8E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID: Legacy$UEFI
                        • API String ID: 2994545307-634100481
                        • Opcode ID: 9f4817481074c43d2ab1dc75d978590f9d705e42514e45707cf39246b32a3c64
                        • Instruction ID: 93fab8a11a8eab6d4604645de0f3aa2b1b6d8ff26b7925c0fb75c205c1e987b2
                        • Opcode Fuzzy Hash: 9f4817481074c43d2ab1dc75d978590f9d705e42514e45707cf39246b32a3c64
                        • Instruction Fuzzy Hash: 2B614C75E003199FDB14EFA8C940BAEBBB9FB44708F1444B9E959EB251D731E940CB50
                        Function 03B2F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: $$$
                        • API String ID: 0-233714265
                        • Opcode ID: 163a6a44512dbf8e59087535abfb66d98cc917eaa3e4097c77428b60d93a7523
                        • Instruction ID: 75ccbf19eac581ec2f50f0cd8af9feae5642ac02e3c30289633faccbf994a600
                        • Opcode Fuzzy Hash: 163a6a44512dbf8e59087535abfb66d98cc917eaa3e4097c77428b60d93a7523
                        • Instruction Fuzzy Hash: 1C61A975A00759DBDB20EFA4C580BA9FBB1FB4430CF1842B9D919AF280CB74A945CB90
                        Function 03B1A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                        Download Yara Rule
                        Strings
                        • RtlpResUltimateFallbackInfo Exit, xrefs: 03B1A309
                        • RtlpResUltimateFallbackInfo Enter, xrefs: 03B1A2FB
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                        • API String ID: 0-2876891731
                        • Opcode ID: f19bd32867668f188f2174241e7902bbdaa83e686d6e7cac7687b0eb83ef21cd
                        • Instruction ID: 276c6bf4cd06f3c80fb80521c2ee122b61da0740655b884befe92ab781f57f30
                        • Opcode Fuzzy Hash: f19bd32867668f188f2174241e7902bbdaa83e686d6e7cac7687b0eb83ef21cd
                        • Instruction Fuzzy Hash: B441B874A05659DBDB21CF69D884B6AB7B4EF85708F2844FAEC14DF391E235EA00CB50
                        Function 03B4329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: .Local\$@
                        • API String ID: 0-380025441
                        • Opcode ID: b3e2ce25653b0642297a7e806d2e88e9ecfa95ab29c23a84ffebf4cefff51286
                        • Instruction ID: f7c5e8064fe234e03755641b850e6e52a6155f9aed661d00761fa2989eb83ca6
                        • Opcode Fuzzy Hash: b3e2ce25653b0642297a7e806d2e88e9ecfa95ab29c23a84ffebf4cefff51286
                        • Instruction Fuzzy Hash: F631B5795083049FC721DF28C480A5BBBE8FF84658F4C09BEF99987210EA34DE15DB96
                        Function 03B1C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: MUI
                        • API String ID: 0-1339004836
                        • Opcode ID: ca446dec2cbbeb33e3316a0141c2dce9ef4df415429932063bf348b2e0552f70
                        • Instruction ID: f1c385daec276bd324f3242abf9e19a690f60fd11329bd92bf5c94c9da930263
                        • Opcode Fuzzy Hash: ca446dec2cbbeb33e3316a0141c2dce9ef4df415429932063bf348b2e0552f70
                        • Instruction Fuzzy Hash: 4E825B75E402189BDB24CFA9C884BAEFBB5FF48318F5881B9D819EB254D730AD51CB50
                        Function 03B17370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 44c801276c2615db01c39dcc2e01024ecb276717ca777673ddc6354d0ba0ffde
                        • Instruction ID: 4a335fc56559b7645569932a0aebec696b7bb1551bf042ce54815e27acd0d511
                        • Opcode Fuzzy Hash: 44c801276c2615db01c39dcc2e01024ecb276717ca777673ddc6354d0ba0ffde
                        • Instruction Fuzzy Hash: E5A16D75608341CFD320DF28D480A2ABBE9FF88308F5449BDE5859B354EB30E955CB92
                        Function 03B4F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 681dcd6277b8275df5f662b9acf23b01f8552957dc013cf37c01e11271277642
                        • Instruction ID: 0b47c92d9396d46fb0a4282dc25c375d7f0067db7ce7478c5278a07d00e385a7
                        • Opcode Fuzzy Hash: 681dcd6277b8275df5f662b9acf23b01f8552957dc013cf37c01e11271277642
                        • Instruction Fuzzy Hash: BA414AB5D00288AFDB20DFA9C880AADFBF4FB49348F5441AEE499E7215D7309950DF64
                        Function 03B1973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @
                        • API String ID: 0-2766056989
                        • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                        • Instruction ID: 1ba487ef02b671f7cbcbe38b0c498d77ba5dc5ed90a1cc019702f81f3e84fc7e
                        • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                        • Instruction Fuzzy Hash: 66618C75D01259EBDF21DF95C840BEEBBB4FF84758F1805B9E820AB290D7719A11CBA0
                        Function 03B9F7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: @
                        • API String ID: 0-2766056989
                        • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                        • Instruction ID: 9d38a34225ffb5ba372e819f4c7a7ed0ec9cbd88c59b418dbd195a7f5cccfc7d
                        • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                        • Instruction Fuzzy Hash: 65517B72604305AFEB21DF54C880F6AB7E8FB84769F0409BAB984DB290D774ED14CB91
                        Function 03B2E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: EXT-
                        • API String ID: 0-1948896318
                        • Opcode ID: 6716ce85e7912067a2737cb62eeecd9ea226f27ed0d2cd9dfa6c9c40d5350c29
                        • Instruction ID: 81bc61ca32928475bbbf0e7929d9ee638c2b315eb6ae41bb4c0280d4d6a66fea
                        • Opcode Fuzzy Hash: 6716ce85e7912067a2737cb62eeecd9ea226f27ed0d2cd9dfa6c9c40d5350c29
                        • Instruction Fuzzy Hash: EE41A2765087219BD721DA76C840B6BBBE8EF8871CF080ABDF588DB150E674D904C793
                        Function 03BCB256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: PreferredUILanguages
                        • API String ID: 0-1884656846
                        • Opcode ID: 158d9142a501895c698ae88bce9b1c72a0593a6660b450a2c9aa92300d2f5ff2
                        • Instruction ID: 8dc91d89c53ede32bfc44a53e7e1f414bb6a3949786cbadd536766bf281e7607
                        • Opcode Fuzzy Hash: 158d9142a501895c698ae88bce9b1c72a0593a6660b450a2c9aa92300d2f5ff2
                        • Instruction Fuzzy Hash: DE419336D10259ABCF31DA94C841BEEB7B9EF84658F0901BEE911AB250D6B4DE40C7A0
                        Function 03B8C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: BinaryHash
                        • API String ID: 0-2202222882
                        • Opcode ID: 864fb98bd202f843f156abf69a0524ac17099514dbdd427ea7acd76d572e1fdb
                        • Instruction ID: 21d80de0b74b41b536c601d881e399b9684f3444a4badb34640018963ce6ba07
                        • Opcode Fuzzy Hash: 864fb98bd202f843f156abf69a0524ac17099514dbdd427ea7acd76d572e1fdb
                        • Instruction Fuzzy Hash: 2A4104F594162CAADF21EB50DC84FEEB77CAB45718F0045F5AA08AB140DB709E49CBA4
                        Function 03B997A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: verifier.dll
                        • API String ID: 0-3265496382
                        • Opcode ID: 1b08a91c82de07973f4a8b72e203510bf7b0419bfaebac0882d516738faa4041
                        • Instruction ID: adefbac23c4dd1bb82b5087160d85f1c62bbba5676666549f4d28df7c8ca103d
                        • Opcode Fuzzy Hash: 1b08a91c82de07973f4a8b72e203510bf7b0419bfaebac0882d516738faa4041
                        • Instruction Fuzzy Hash: 273193B57003019FEF64EF699890B26B6E5EB49758F5980FFE505DF280E7318C818BA0
                        Function 03BB705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: kLsE
                        • API String ID: 0-3058123920
                        • Opcode ID: c8cf40f5bdd4c2a3a7ef82a75d2a88ff59e955797457382373d62a318376a3b2
                        • Instruction ID: 3405be0b70f379ca4bc6a759df346874dea2fe7034b24b1dbf78bdcb3cc5df03
                        • Opcode Fuzzy Hash: c8cf40f5bdd4c2a3a7ef82a75d2a88ff59e955797457382373d62a318376a3b2
                        • Instruction Fuzzy Hash: FA4116316013D14AD721FF64D8867B97BA4EB8072CF5A05B9E990DF0C5CFB448A5C7A1
                        Function 03B436EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Flst
                        • API String ID: 0-2374792617
                        • Opcode ID: 6cd6269eb648147f1b1881e266c0c1077e912740619862e6523b332e8913d9bb
                        • Instruction ID: c0fff50cd86b2d222a4f238605c093ef43e6e94062060c9504879594202a5539
                        • Opcode Fuzzy Hash: 6cd6269eb648147f1b1881e266c0c1077e912740619862e6523b332e8913d9bb
                        • Instruction Fuzzy Hash: 3841ABB56053019FC714CF18C680A16FBE4EB49718F1885BEE499CF281DB31D942CB96
                        Function 03B15096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: Actx
                        • API String ID: 0-89312691
                        • Opcode ID: 42e115ab5f788374228a196fe652b40ad7f66d4a819fe1bc6a9582791825d7f1
                        • Instruction ID: a301e2d20aa93ab58a62e811f808b72450638933520914bd4453e110f1799892
                        • Opcode Fuzzy Hash: 42e115ab5f788374228a196fe652b40ad7f66d4a819fe1bc6a9582791825d7f1
                        • Instruction Fuzzy Hash: 3B1193707046028BDB75C95D8858676B399EBC722CFBD81BBE462CB390D671D8A1C380
                        Function 03B9106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: LdrCreateEnclave
                        • API String ID: 0-3262589265
                        • Opcode ID: 8dc31ee8a0d0bc8fb4eea4878cd23081e9f17b3f398f3192bcfcfdf962fc64b2
                        • Instruction ID: 813ef816eeebec3d509b257f083f8d7b54a7939cf21dd3e470f333b88560ed08
                        • Opcode Fuzzy Hash: 8dc31ee8a0d0bc8fb4eea4878cd23081e9f17b3f398f3192bcfcfdf962fc64b2
                        • Instruction Fuzzy Hash: 5E2134B5608384AFC710DF6AC844A5BFBE8EBD5B04F004A2FB9A087250D7B0D905CB92
                        Function 03B6739A Relevance: .7, Instructions: 705COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f0f09710a38656f5931eed21309daba379d8537f31514ab1b01792b81f9c98ac
                        • Instruction ID: 092ce99a4eb472790623463ef73c746bea7416bf4f60a799c8694a5c8ef89305
                        • Opcode Fuzzy Hash: f0f09710a38656f5931eed21309daba379d8537f31514ab1b01792b81f9c98ac
                        • Instruction Fuzzy Hash: A042AE75A006169FCB14CF59C491ABEF7B6FF8831CB1885E9D456AB341DB38E842CB90
                        Function 03B3B2C0 Relevance: .6, Instructions: 629COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 4c7a607012006ddb05b224d2d5f212a82c4c9b0ea79803c91729f6cade7185e4
                        • Instruction ID: d0749181bebfd55f7e3aff9e64bb357dc71da481b8469368b3a5a63190c3ee7f
                        • Opcode Fuzzy Hash: 4c7a607012006ddb05b224d2d5f212a82c4c9b0ea79803c91729f6cade7185e4
                        • Instruction Fuzzy Hash: 8132B476E00229DBCF14DF68C890BAEBBB5FF85718F1800B9E805AB355E7359911CB91
                        Function 03BBA118 Relevance: .6, Instructions: 591COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: ac797850180a61558d2943072e9a1a400eca792399b138ff743047c97a49ae25
                        • Instruction ID: 6d3c0e1adf3274d4b328817d1de9a0df16994a8f1ff9c9b3416b8da29a742d9c
                        • Opcode Fuzzy Hash: ac797850180a61558d2943072e9a1a400eca792399b138ff743047c97a49ae25
                        • Instruction Fuzzy Hash: 7A22BF74A046518FDB24CF29C0947F6B7F1EF45308F0884EAD8968F285EBB5E552DB60
                        Function 03BD16CC Relevance: .6, Instructions: 571COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: b63287aa91057f5052aa3076b399aef81b1a5df50145a6fa315677d5145d2818
                        • Instruction ID: babfc6b57f37665f3ac9021113100b068a5c1a48e15005a31622b9ac07ae8394
                        • Opcode Fuzzy Hash: b63287aa91057f5052aa3076b399aef81b1a5df50145a6fa315677d5145d2818
                        • Instruction Fuzzy Hash: DA229035A002168FCB59CF5DC480AAAF7B6FF88318F1885BDD456DB344EB34A942CB90
                        Function 03B08397 Relevance: .4, Instructions: 380COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: fd3d8c9178657ae83e6db67173618895d7fdb1ad5252ba8a42bbd6ba7b5ed922
                        • Instruction ID: 246c58ab2e082741200e6fe4f3d2abe41ef5ecc6df17058b7af3bfdf5fbdadeb
                        • Opcode Fuzzy Hash: fd3d8c9178657ae83e6db67173618895d7fdb1ad5252ba8a42bbd6ba7b5ed922
                        • Instruction Fuzzy Hash: B4D19075A007169BCF14DF65C890ABEBBB5EF4420CF0946B9E916DB2C1EB34EA41CB50
                        Function 03B1D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0526ad9ea8e0f2ecc169fb2cbe57b7530ddff24c6bd99707f4cac448992811b5
                        • Instruction ID: 4e56b010632dbf9a24cac36777794fe39f8ea803a1c763f27e358abec4b5451a
                        • Opcode Fuzzy Hash: 0526ad9ea8e0f2ecc169fb2cbe57b7530ddff24c6bd99707f4cac448992811b5
                        • Instruction Fuzzy Hash: 02C1A071F042159BDB28DF5AC840BAEFBB5EF44318F5882FDD925AB290D770A951CB80
                        Function 03B390DB Relevance: .3, Instructions: 287COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 976ce339639d4555d592a50f87bdef4e6d5b01f38b5f4b2e936bf6eafe871d5b
                        • Instruction ID: f40848b5b0d15ec17ac490d3d00dade8caedc14e376e9e19f58dd775204ee736
                        • Opcode Fuzzy Hash: 976ce339639d4555d592a50f87bdef4e6d5b01f38b5f4b2e936bf6eafe871d5b
                        • Instruction Fuzzy Hash: 19A15A75900715AFEB22EF64CC41BAE7BB8EF45758F0501A8F914AF2A0D7759C40CBA0
                        Function 03B183C0 Relevance: .3, Instructions: 281COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5862d342c4c2334ba6f062124dea03694563a4840af2adec57ef74d8c5430bae
                        • Instruction ID: f8850d1d8c943d860e93cc4d332d04e2506a6dd5e0a73f208b2cde9cbffa1d5e
                        • Opcode Fuzzy Hash: 5862d342c4c2334ba6f062124dea03694563a4840af2adec57ef74d8c5430bae
                        • Instruction Fuzzy Hash: 8AC13875508340CFD764CF19C494BAAB7E9FF88308F4849ADE9998B290D774E944CFA2
                        Function 03B50185 Relevance: .3, Instructions: 276COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: dd262b9874fe98bda4ba96286d84791c3edf9b8c93249d9054488bc978fa745e
                        • Instruction ID: 82044d71e50b3f8a7135e57936c8a25c34295e0bc5ee09670190299b1b2e6edd
                        • Opcode Fuzzy Hash: dd262b9874fe98bda4ba96286d84791c3edf9b8c93249d9054488bc978fa745e
                        • Instruction Fuzzy Hash: 27A1BE71A007169BDF24EF65C991BAAB7B5FF4431DF1840B9EE459B281DB34A802CB90
                        Function 03B2E3F0 Relevance: .3, Instructions: 261COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 179acdad48a8ac93de89f393ae292654bdb3ab5353738bc2eabf564f72ff3ff1
                        • Instruction ID: 581f89422f82b0f5c02a02064844608a09583dea5b77e1d58dd2aaa15582b1c3
                        • Opcode Fuzzy Hash: 179acdad48a8ac93de89f393ae292654bdb3ab5353738bc2eabf564f72ff3ff1
                        • Instruction Fuzzy Hash: EA91E335A006259FDB24DB6AC480B7DBBA5EF84718F0982F5E829DF380EB34D941C761
                        Function 03B11131 Relevance: .3, Instructions: 259COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5b9650097107503a0676e86993f30c9ee50a656bb785e321620b96e86aa1eecb
                        • Instruction ID: dd2ad5c47b6e215555edf3d351afe35d0737028fd1f4703cd65f75f6894d1ad5
                        • Opcode Fuzzy Hash: 5b9650097107503a0676e86993f30c9ee50a656bb785e321620b96e86aa1eecb
                        • Instruction Fuzzy Hash: A5B10375A093408FD354CF28C480A6AFBE1FB89308F5849AEF999DB352D375E945CB42
                        Function 03B3D090 Relevance: .2, Instructions: 217COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                        • Instruction ID: d97957078c9c63fbb7d2b381a43c0169cde4c967f2d08f2d58b10adb7f3ea49f
                        • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                        • Instruction Fuzzy Hash: 4D816B76E005298BDF14CF68C9817ADF7B2EF85308F1985FAD826BB344D631A941CB91
                        Function 03B4E284 Relevance: .2, Instructions: 212COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: c38247c1a7eccce9dcca4c886f6e15c39103e9f58c567553526bd4287ce41b3d
                        • Instruction ID: f4c9f598b523c3a2b833f695d1beb2eb67e2950620e34d82a14682a59b05e2e7
                        • Opcode Fuzzy Hash: c38247c1a7eccce9dcca4c886f6e15c39103e9f58c567553526bd4287ce41b3d
                        • Instruction Fuzzy Hash: FC816C71A00609AFDB26DFA8C880BEEB7B9FF48308F1444B9E555A7250E730ED05DB64
                        Function 03B2260B Relevance: .2, Instructions: 201COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 6f49a24580b19ddf367b02d47d0c9cfc181603ce26d9ea6d6f59db5b4d17501d
                        • Instruction ID: 187e56dbb2f89de5d56042b088f1b61ca5e4805d7287b1d1535c033b09349cec
                        • Opcode Fuzzy Hash: 6f49a24580b19ddf367b02d47d0c9cfc181603ce26d9ea6d6f59db5b4d17501d
                        • Instruction Fuzzy Hash: E471AF356046519FD352DF28C480B66BBE5FF84218F098AF9E859CF361DB34D845CB91
                        Function 03B9035C Relevance: .2, Instructions: 198COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                        • Instruction ID: bb9f799984861c4465f2eca1fe58e7ddbb3f713a931b64b99df5d9db0e735345
                        • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                        • Instruction Fuzzy Hash: FB716075A00619AFDF10DFA5C984A9EBBB8FF48704F1445BAE509EB250DB34EA41CB50
                        Function 03BA62A0 Relevance: .2, Instructions: 198COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a2ddffc361ef53ffd06376441ecb360c09a1207fe52acc068af434f8b83f00e0
                        • Instruction ID: 4d0d0aec8990db5ddad0e202a192b6e6cf589369adc36460e1349a9dd2af0f75
                        • Opcode Fuzzy Hash: a2ddffc361ef53ffd06376441ecb360c09a1207fe52acc068af434f8b83f00e0
                        • Instruction Fuzzy Hash: 3171D1B6204F01AFDB21DF1CC844F5AB7E5EF84728F1849B8E5168B2A0DB75E945CB50
                        Function 03BD132D Relevance: .2, Instructions: 188COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f7e540719033c9fe5e34b06db675bf3123479ce72efa729d366fc96fa1117d28
                        • Instruction ID: b76bca12c20e1c0358dc708eb8f4f5cb6bedaf0db7af33e1c512ad3d7fbd46a2
                        • Opcode Fuzzy Hash: f7e540719033c9fe5e34b06db675bf3123479ce72efa729d366fc96fa1117d28
                        • Instruction Fuzzy Hash: BA814E75A00245DFCB09CF58C490AAEBBF1FF88314F1581A9D859EB355E734EA51CBA0
                        Function 03BD903E Relevance: .2, Instructions: 186COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5f18bd4c03b540f5db9eb1b67e72af4413397da1547f40868957a4a299320387
                        • Instruction ID: 2fcb75a23d4f2e1edaffe794b4234222701de095c1fbbd071e540d24467d5f14
                        • Opcode Fuzzy Hash: 5f18bd4c03b540f5db9eb1b67e72af4413397da1547f40868957a4a299320387
                        • Instruction Fuzzy Hash: B861D076600715AFD715DF64C884BABBBA8FF88718F0446B9F859CB240EB30E905CB90
                        Function 03B17703 Relevance: .2, Instructions: 179COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 33e607493c0716e9297f4c8571e2549d2f169862d81d6af6714f9ba7fd238364
                        • Instruction ID: 17f413bd1da2b11f3cd4f9280aedbe2173008deab15dbc652c1d86977dc4ba34
                        • Opcode Fuzzy Hash: 33e607493c0716e9297f4c8571e2549d2f169862d81d6af6714f9ba7fd238364
                        • Instruction Fuzzy Hash: 05616475A00605AFDB18DF69C481AADFBB5FF48208F5882BAD519AB340DB70A951CBD0
                        Function 03BD92A6 Relevance: .2, Instructions: 174COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3d5c3692490541118ed6300a80159621a89142f72395858ddbff7f0fd2c73e6d
                        • Instruction ID: dc883237db56737d15d2e6986c9f7a25e2dc0a082135dbc4ecd8c305955098a5
                        • Opcode Fuzzy Hash: 3d5c3692490541118ed6300a80159621a89142f72395858ddbff7f0fd2c73e6d
                        • Instruction Fuzzy Hash: 5A61E1356087428BD315CF69C494B6AB7E0FF8071CF1844FCE8898B682EB75E905CB81
                        Function 03B0B2D3 Relevance: .2, Instructions: 161COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7ca8cb1839ca81995a34eedb9f18d57e132d083a2261bed9231fb397c1e435ac
                        • Instruction ID: feeea6c68405f48479a1d97a791dd48570cb07fbc27b10c4e96e03552829b906
                        • Opcode Fuzzy Hash: 7ca8cb1839ca81995a34eedb9f18d57e132d083a2261bed9231fb397c1e435ac
                        • Instruction Fuzzy Hash: DE413675200700AFCB25DF25C980B2ABFA9EF44768F1584F9E659DF291DB70DD008B90
                        Function 03B23740 Relevance: .2, Instructions: 159COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 850925233bd22d78146d0f6e985e5026ea20d519a11788e73806950d7907d3fa
                        • Instruction ID: 5a2540cf1456e43fc648546fad6e3a58466a56d9237fea14095135f7666abe14
                        • Opcode Fuzzy Hash: 850925233bd22d78146d0f6e985e5026ea20d519a11788e73806950d7907d3fa
                        • Instruction Fuzzy Hash: 6851BB79A10A65ABC711CF68C480A69BBB0FF04718F0986B5E85DDF350E739E991CB80
                        Function 03B17152 Relevance: .2, Instructions: 158COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f62f742b2d8dfac75fd12031e4326753385ad859cb92bc6cda0431901dd764da
                        • Instruction ID: 981b8b819c8cebf63f4867142f5955fa25c69d54f9b47f558ec77be13bb90302
                        • Opcode Fuzzy Hash: f62f742b2d8dfac75fd12031e4326753385ad859cb92bc6cda0431901dd764da
                        • Instruction Fuzzy Hash: B651EE75A00605EFEB15DF68C849BADB7B8FF04319F5441F9E41297290EB749921CB90
                        Function 03BDD26B Relevance: .2, Instructions: 153COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                        • Instruction ID: 516f3182df3c0a7db57bae4be24ef48d4412631dec63bad426498eee3a322f9b
                        • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                        • Instruction Fuzzy Hash: 09514B756083429FD710CF68C880B6ABBE6FFC8358F04896DF9949B241E734E945CB52
                        Function 03B151ED Relevance: .1, Instructions: 149COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 6c60a9ff94aa1457dd8ba6b1ab8029ebad54dace8d370e382eae5cef7caab500
                        • Instruction ID: 857250b6194c23729b7ef1d7603329a0010af41138cf7188abcfb6c91b4893af
                        • Opcode Fuzzy Hash: 6c60a9ff94aa1457dd8ba6b1ab8029ebad54dace8d370e382eae5cef7caab500
                        • Instruction Fuzzy Hash: FF518076A01314DFDF31DAA8D840BEDB7B4EB8531CF5400FAD812EB240D7B49A608BA4
                        Function 03B4F71F Relevance: .1, Instructions: 143COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3e5c7b613bc165e966274077f0d5e4eaea303709e4b3140434e622aeabed2d07
                        • Instruction ID: 3ffeaf6533ddef7d23f958af680e224fe54bf87b48c660592bafac298c218a5b
                        • Opcode Fuzzy Hash: 3e5c7b613bc165e966274077f0d5e4eaea303709e4b3140434e622aeabed2d07
                        • Instruction Fuzzy Hash: FF417976D05729ABCB11EB988984ABFB7BCEF04698F0505F6A914E7300D638DD0097E4
                        Function 03B401F8 Relevance: .1, Instructions: 138COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: ad4c26989715fd7156bd12a6a4108cf97e362b7d35de3fce9c6b2f7a5495bc5e
                        • Instruction ID: 33d3c54e584541dae6365165c07edc9e74916655dcd63b3c34f78d30870617ab
                        • Opcode Fuzzy Hash: ad4c26989715fd7156bd12a6a4108cf97e362b7d35de3fce9c6b2f7a5495bc5e
                        • Instruction Fuzzy Hash: 9D419F35E00219ABCB14EF98C440AEDF7B4FF58718F1881BAE915EB250E7359D41DBA8
                        Function 03B52750 Relevance: .1, Instructions: 137COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                        • Instruction ID: 7bc028510143c5655121ba0142713623c498862d94b86e37722f88710a2221f1
                        • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                        • Instruction Fuzzy Hash: 5F514B75A00615DFCB14DF99C580AAEF7B6FF84714F2881EAD815AB350D734AE42CB90
                        Function 03B8D1C0 Relevance: .1, Instructions: 135COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                        • Instruction ID: cc817b7fa9d2bbe0952bb838de568fa08ec443776e8d06c08915f1953dba915e
                        • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                        • Instruction Fuzzy Hash: D951F775E00206DFCB18DF69C581699FBF1FF48314B1885AED81997345D734EA90CB90
                        Function 03B16154 Relevance: .1, Instructions: 133COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: c585765628b564be7851d505e10827da949cce73076fbf0ce58fdd81983857a0
                        • Instruction ID: 01a60fe4d0c7d0f02e2c8b16e7d5292dda355c9cf9ee8e704ae26d43a1edac3c
                        • Opcode Fuzzy Hash: c585765628b564be7851d505e10827da949cce73076fbf0ce58fdd81983857a0
                        • Instruction Fuzzy Hash: A751A471A002569BDB25DF64CC40BA9B7B5EF0531CF1882F9D8299B2D1D73899A1CF80
                        Function 03B0B136 Relevance: .1, Instructions: 131COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 32cce0a1aeb5460db7d3101ed410b3efcf91a8420f6237c1c8faa210d754a04b
                        • Instruction ID: b15066fdc11a2ff4273562d65417631da47b956bf377ce289ffaf22a35aeb589
                        • Opcode Fuzzy Hash: 32cce0a1aeb5460db7d3101ed410b3efcf91a8420f6237c1c8faa210d754a04b
                        • Instruction Fuzzy Hash: DC41ABB5A40315AFCB21EF69C840B2ABFA8EF0079CF0484F9E555DB2A1D774E840CB90
                        Function 03B3D6E0 Relevance: .1, Instructions: 126COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 87da535f6833e0ae269cbbf79dd7aec39e59397c14fbef9a5bd0b394d954eda0
                        • Instruction ID: afd88aa8c0bfc1b98dbc6a6d6ad459ac4adf6afc19cbe98d6ab6f82e0936da87
                        • Opcode Fuzzy Hash: 87da535f6833e0ae269cbbf79dd7aec39e59397c14fbef9a5bd0b394d954eda0
                        • Instruction Fuzzy Hash: 1B41BF796053509FC724FF69C880B6BB7A8EB85328F0546BDF9258B290CB30E811CF95
                        Function 03B0A020 Relevance: .1, Instructions: 122COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                        • Instruction ID: 8c957075b70d8304c10016c99651faf048aba11dcadeee3f123b7fcf0303f68a
                        • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                        • Instruction Fuzzy Hash: EB414B31A00319DBDB10DF9685407BAFB79EB5075CF1984FAE945CB282E6398D40CB90
                        Function 03B40710 Relevance: .1, Instructions: 121COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                        • Instruction ID: a5b616f10105ae5bc544a2b3e57b4269f3bd0a2f0fec5aa97b1c5089138ed4f4
                        • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                        • Instruction Fuzzy Hash: 2E41F975A00705EFDB24DF98CA80AAAF7F8EF08704B1049BDE656DB650D330AA44DF55
                        Function 03B1262C Relevance: .1, Instructions: 119COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 1b7d307f7c6de2e095c478b994cd49ae3cc331b7f3b2f336a2c20bf20e334714
                        • Instruction ID: 32cd812a20b807aaf5426e5038cd852a562ff34e947068a4c5eeeffd01b4ed59
                        • Opcode Fuzzy Hash: 1b7d307f7c6de2e095c478b994cd49ae3cc331b7f3b2f336a2c20bf20e334714
                        • Instruction Fuzzy Hash: B4418B76901704CFCB21EF24D940B6ABBB5FF49318F548AF9C4169F2A1DB309961CB51
                        Function 03B907C3 Relevance: .1, Instructions: 114COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 029abe4b2fefc3ae3f2a54658ffb284e97c2d60b70e551fc7a18df3cbea65127
                        • Instruction ID: 002396f4460feaa86a316c96d05b3304ad3904c98985d9529afdc498b35dee4f
                        • Opcode Fuzzy Hash: 029abe4b2fefc3ae3f2a54658ffb284e97c2d60b70e551fc7a18df3cbea65127
                        • Instruction Fuzzy Hash: 35418D72608340AFD720EF29C844B9BBBE8FF88658F004A7EF598C7251D7709904CB92
                        Function 03B202E1 Relevance: .1, Instructions: 106COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                        • Instruction ID: 1ed30bb8fdcf9b9924e669d58a682f3a1d3cead1a3a2c74ce951f79ed392f007
                        • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                        • Instruction Fuzzy Hash: 9E31D532A04254ABDB21DB68CC44FAABFE9FF08358F0846F5E859DB251C674D944CBA4
                        Function 03B39274 Relevance: .1, Instructions: 105COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: baea0b04b1c2ea09a1f29e191becb7a0062a7c90a14fb2f03694ff50a777aaef
                        • Instruction ID: b4be927716567f96ec1af8d821ce2de1bbcd9ecad26d88fca8d0b3bb544d1ce6
                        • Opcode Fuzzy Hash: baea0b04b1c2ea09a1f29e191becb7a0062a7c90a14fb2f03694ff50a777aaef
                        • Instruction Fuzzy Hash: 6A3196B5A00338AFDB21DB24CC40B9AB7B5EF86314F1501E9A54CEB280DB709E44CF52
                        Function 03B15702 Relevance: .1, Instructions: 104COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 41be2339c885e279234862989feae60488b73a93bb87acd6f342b0b31b24802f
                        • Instruction ID: c9ce2a347dbb3f8bd2b77e1ed9d92e8241a48c7ebf0f9bdb11a69a1f3803bb79
                        • Opcode Fuzzy Hash: 41be2339c885e279234862989feae60488b73a93bb87acd6f342b0b31b24802f
                        • Instruction Fuzzy Hash: 4931B135201B06EFCB61EB64C980A99F7A9FF8521CF8451B6E80187A50DB70E830CBD0
                        Function 03B14260 Relevance: .1, Instructions: 102COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: ed1477f82059f247193a74f927d6f6ca30a7a2d6ee4a8740fda81743fa9f591d
                        • Instruction ID: 92f85c1e75ae36f4a9c471b180f2900a4dbfe5f00440b8d5e3c678bc31e4ee0a
                        • Opcode Fuzzy Hash: ed1477f82059f247193a74f927d6f6ca30a7a2d6ee4a8740fda81743fa9f591d
                        • Instruction Fuzzy Hash: A741CE36600B44DFC722DF29C480BDABBF8EB49358F4544BEE5698B260D734E910CBA0
                        Function 03B350E4 Relevance: .1, Instructions: 101COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                        • Instruction ID: 46fcb5d212ae5459ba1ff11ccf7e47d5cb1fc920b38cb4bd9a60dfc6beed3a99
                        • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                        • Instruction Fuzzy Hash: BD31C331708765ABD731DA188800766F6A9EB87758F4885FBF8958B380D774C841C792
                        Function 03BD61C3 Relevance: .1, Instructions: 97COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a4fa55fbda366febcbcae9167137dcdb156025e493f48a10e91f6edc4c8276ff
                        • Instruction ID: f694151a3be28e6439a016f36a08f4b1ef0e268e001f7788c57c9c43b4cc1d81
                        • Opcode Fuzzy Hash: a4fa55fbda366febcbcae9167137dcdb156025e493f48a10e91f6edc4c8276ff
                        • Instruction Fuzzy Hash: AE31E475E00219ABDB15DF98CC40BAEF7B9EB44748F4541B9E800EB244E774ED40CB94
                        Function 03B09730 Relevance: .1, Instructions: 96COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 373cc1853a18fdf0cd4cc098b4c131d00c92a4397cf6f4638c22e4342f231989
                        • Instruction ID: b01d8ac062be90f7c224cdbf0d89603bfdf81657f29c9821179019ce253713b7
                        • Opcode Fuzzy Hash: 373cc1853a18fdf0cd4cc098b4c131d00c92a4397cf6f4638c22e4342f231989
                        • Instruction Fuzzy Hash: 4621D37AA01754AFC722DF588440B1ABFB4FB84B58F1505B9A665DF3A2D730EC00CB90
                        Function 03BD60B8 Relevance: .1, Instructions: 95COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 52303d667e65f1538def80b7735f2db5b62b2df7c795dc89c2deb0b9d219b5fc
                        • Instruction ID: 303d7a19e8ea0b0f9894a7f6aa7e51b9be51af85d39d9fe0eea74a8faa739737
                        • Opcode Fuzzy Hash: 52303d667e65f1538def80b7735f2db5b62b2df7c795dc89c2deb0b9d219b5fc
                        • Instruction Fuzzy Hash: A631D175700615AFDB16DBA9C840B6EBBA9AF44758F4400F9E545EF341EB30DC008B90
                        Function 03B107AF Relevance: .1, Instructions: 95COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 10ce09a6d0c9ab58749b569ddfe4c03d238cc3dfdcade06022c424501fed274a
                        • Instruction ID: 4c904f61ec895340db96de1b45da6c97e968b238d928548d1831d8f49fadbf88
                        • Opcode Fuzzy Hash: 10ce09a6d0c9ab58749b569ddfe4c03d238cc3dfdcade06022c424501fed274a
                        • Instruction Fuzzy Hash: DE310836A08711DBCB11FE24C880A6BBBA5EF84258F4545F9FC559B350EA70DC6187D1
                        Function 03B0D6AA Relevance: .1, Instructions: 93COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                        • Instruction ID: 434efb95975385809ae1d974b011eeebc7d848446dcf265a516f4a504f63fee6
                        • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                        • Instruction Fuzzy Hash: 8631C376601204AFDB21DE94C880B6EBBA9DB84758F1D84FCED099B2C0D774DD40CB50
                        Function 03B157C0 Relevance: .1, Instructions: 92COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3e81b30347577164df6500156e8edd4dca68e7e7a12bc159ea72695e92b6036f
                        • Instruction ID: 5a1b247c8c9dd20df7e1e4f975249feac8bd4369e489b749b8a7e7bc7f7007ba
                        • Opcode Fuzzy Hash: 3e81b30347577164df6500156e8edd4dca68e7e7a12bc159ea72695e92b6036f
                        • Instruction Fuzzy Hash: 0C319239715A05FFDB51EB24CA80A99BBA5FF85318F8450B6E8118BB51D771E830CBC1
                        Function 03B4A6C7 Relevance: .1, Instructions: 92COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                        • Instruction ID: 99facb16c3f85dcd274065f3373fefb2b078750769c2741f80a74e6aa3926f6a
                        • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                        • Instruction Fuzzy Hash: A1312872B00B00AFD770DF69CE40B57B7F8EB08A54F0809BDA59AC3650E630E900DB64
                        Function 03B3438F Relevance: .1, Instructions: 89COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 1a14811bd348e70fe1791b83141e122cd8bbad7ddd02aa1075d81e6dab64058a
                        • Instruction ID: 54da6bb87c80c01dc7638068311880da5cd8221356c31478791603ce2fb8daa2
                        • Opcode Fuzzy Hash: 1a14811bd348e70fe1791b83141e122cd8bbad7ddd02aa1075d81e6dab64058a
                        • Instruction Fuzzy Hash: 7B31B136B003259FCB24EFA9C980B6AB7F9EB8570CF0085B9D556DB254DB34E941CB90
                        Function 03B192C5 Relevance: .1, Instructions: 89COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                        • Instruction ID: a89554e3047ec225bff8322eba449e49315cd035655e1f8ec4ebfd242da95d57
                        • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                        • Instruction Fuzzy Hash: 4F318AB56083499FCB11DF18D840A5ABBE9EF89358F0409BAFC559B3A1D730DD11CBA2
                        Function 03B67190 Relevance: .1, Instructions: 89COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                        • Instruction ID: 36d9a43eec0d4b60ebe9a901dee0b14cff5b92dd11a922ad41120b0fdd09c5a4
                        • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                        • Instruction Fuzzy Hash: E4315875704206CFC710CF19C480956FBF5FF89358B2986AAE9589B326EB34ED06CB91
                        Function 03BCC3CD Relevance: .1, Instructions: 88COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                        • Instruction ID: 23a5b6ef18e36a84f5696111c672bab43a54c427f5cc1a7f800bced23ed9d6a4
                        • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                        • Instruction Fuzzy Hash: 2C210E3E610B9166CB34DB958810AFAFBB4EF90618F40C0BEF95A8A991D634D951C360
                        Function 03B0C156 Relevance: .1, Instructions: 88COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 88c66f1347c4f4a424cf1db77553c86f3c8d3ca011ed2436016808455fd4045b
                        • Instruction ID: ec26cd4ffd97db28eb2f96c1a21386e0b3b67d608bacec1ba1ba017e306ee283
                        • Opcode Fuzzy Hash: 88c66f1347c4f4a424cf1db77553c86f3c8d3ca011ed2436016808455fd4045b
                        • Instruction Fuzzy Hash: C731B6756003109BCB20EF18C841B79B7B4EF4131CF9885FDD9499F386DA789986CB90
                        Function 03B0E388 Relevance: .1, Instructions: 86COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                        • Instruction ID: 0d76a82b4104e9170d41c3b2e2a7e50960a1c4225e4d987259193c39e1d933be
                        • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                        • Instruction Fuzzy Hash: 04318935600A44AFD721CF68C884F6ABBF9EF84358F1449F9E5168B291E734EA01CB50
                        Function 03B8E609 Relevance: .1, Instructions: 86COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0dc042e3f794d5765388c8f3833e41852825b11ea178b9acf064c94a3df72a09
                        • Instruction ID: 6dfe8edc7c5c539f63227809c5f9ebe997463f02d4a80ee2f20294237a869d16
                        • Opcode Fuzzy Hash: 0dc042e3f794d5765388c8f3833e41852825b11ea178b9acf064c94a3df72a09
                        • Instruction Fuzzy Hash: 6C318075A00246DFCB14EF1CC8849AEB7B6FF84308F1545A9E80ADB391E771EA51CB90
                        Function 03B13616 Relevance: .1, Instructions: 84COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0bc2c725f300cbbb39223ec55f489d6d7e8e7ee560dea16325f5056257ab7e43
                        • Instruction ID: ea85b24532acd3681ae152cab4616fa727d42e5ad2aa5a7ec1f6ef1ecaa71cb9
                        • Opcode Fuzzy Hash: 0bc2c725f300cbbb39223ec55f489d6d7e8e7ee560dea16325f5056257ab7e43
                        • Instruction Fuzzy Hash: 042109392193509FCBA1DF04C944B1ABBE4FF81B28F9945F9E8498B655D770EC24CB81
                        Function 03B3F32A Relevance: .1, Instructions: 79COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                        • Instruction ID: 2d2ed25b9abcdede6d0570d625a38bd21a1f3aee34bf39917622c3e4a1938c15
                        • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                        • Instruction Fuzzy Hash: FF219D726003109FCB19DF15C441B6ABBE9EF86369F1581BDE10A8B290EBB0ED01CB95
                        Function 03B906F1 Relevance: .1, Instructions: 79COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2db08a1ac9f7b0bfed32584d7344a0a7cfa2ad40356b1718c4507e7ff626d6d7
                        • Instruction ID: 535c2fe2e9cbd4d47bd325017cbff16a5baa3be6da13a7dca58e393e4145bb84
                        • Opcode Fuzzy Hash: 2db08a1ac9f7b0bfed32584d7344a0a7cfa2ad40356b1718c4507e7ff626d6d7
                        • Instruction Fuzzy Hash: 03217175A002299BCF14EF59C881ABEB7F4FF48754F5500AAF541EB250D778AD41CBA0
                        Function 03B9019F Relevance: .1, Instructions: 78COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7a51a060e7ccb86fb418e81c4e6ef06916c6bdc0665495fa25dd10660e60b267
                        • Instruction ID: 102e165a3a5e54b6cbe153be1ba2a2a3532e7cdf8ec07ca4de870b28d32867a7
                        • Opcode Fuzzy Hash: 7a51a060e7ccb86fb418e81c4e6ef06916c6bdc0665495fa25dd10660e60b267
                        • Instruction Fuzzy Hash: 1E219F75600654AFDB15EB68C940F6AB7E8FF48748F1401BAF908DB6A1D738ED40CB64
                        Function 03B90283 Relevance: .1, Instructions: 74COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d3eee32799e8c6b33247fc6417647949c1c55a7407e94582d7b8ca17e21d3788
                        • Instruction ID: 16ba42923f22998f7a1daec53bbaf6092bd93f78d6b3c85e866319ea3b6c0bfe
                        • Opcode Fuzzy Hash: d3eee32799e8c6b33247fc6417647949c1c55a7407e94582d7b8ca17e21d3788
                        • Instruction Fuzzy Hash: 9721C4719047459BDB11EF59C844B5BFBDCEF85248F0805B7B9888B251D734C604C6A1
                        Function 03B8D0C0 Relevance: .1, Instructions: 73COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                        • Instruction ID: 9ae98fdc6ee396dd02b385f67b65dfeed83c3aa2c6ab5e14bf8aae77e91f5c59
                        • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                        • Instruction Fuzzy Hash: 4C21AC72744704ABD321FF188841B5ABBA5EF89728F04067EF9499B3A0D734E800C7A9
                        Function 03B4A30B Relevance: .1, Instructions: 70COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 41b3e443c31c29c4f08e4de3acfcdff6fd6c89b8f2c21b9e1fe8f23ae8487546
                        • Instruction ID: 3f35ec3fb5f08860a717d2ba639200716594e0fb7a25d32d553c19e40af52f5d
                        • Opcode Fuzzy Hash: 41b3e443c31c29c4f08e4de3acfcdff6fd6c89b8f2c21b9e1fe8f23ae8487546
                        • Instruction Fuzzy Hash: 1921AC392417509FC725DF29C800B96B7F5EF08B08F1485A8A509CB761F331E942CB98
                        Function 03B0B765 Relevance: .1, Instructions: 69COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 5e7e1708f91d633dbcc957fd7d3f15c450cc59a582f8c169aa03fc63dbd0fc7c
                        • Instruction ID: ce51c36421d15488f345b5bea4d3f0b2e7b1a28739abd3d61b104e9ad1e34c48
                        • Opcode Fuzzy Hash: 5e7e1708f91d633dbcc957fd7d3f15c450cc59a582f8c169aa03fc63dbd0fc7c
                        • Instruction Fuzzy Hash: 24214636100740DFC722EF68CA41F59BBF5FB0861CF154AB8E10A9A6A1DB34E811CB44
                        Function 03B40124 Relevance: .1, Instructions: 68COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                        • Instruction ID: a2aafe3bbfd26dd874f3c02f438e52054e8f56cadd6f5177dcc0bb28c3c38cbe
                        • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                        • Instruction Fuzzy Hash: 9011DD76600704AFDB22EB55D840FAAFBB8EB80758F1400B9FA048F190D671ED44EB68
                        Function 03B18770 Relevance: .1, Instructions: 68COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 340e24844007a0efe410e34b50c12242b4bee6475b67d1857c3fc62d69eb2275
                        • Instruction ID: 88624457419f61400c7d1e0a7dd223ef3bcdc8a2c50c063409b399cba72ba662
                        • Opcode Fuzzy Hash: 340e24844007a0efe410e34b50c12242b4bee6475b67d1857c3fc62d69eb2275
                        • Instruction Fuzzy Hash: C5119D366006209BCB11CF59C4C0A2AB7E9FF8A758B9880B9ED08DF205D6B2D911CB90
                        Function 03B13720 Relevance: .1, Instructions: 67COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 1963d2d50050724ee3c12f97224e431b13c78b7bf3dc8fdb3fad770531d9bfcb
                        • Instruction ID: ab3518301713164e648e2f14399af125132b6a420b91a748e2f3b69cc742a4d5
                        • Opcode Fuzzy Hash: 1963d2d50050724ee3c12f97224e431b13c78b7bf3dc8fdb3fad770531d9bfcb
                        • Instruction Fuzzy Hash: 08210A799002098BE715DF5DC044BEDB7E4FB8831CF6D80B8D816972C0DBB899A4CB50
                        Function 03B180E9 Relevance: .1, Instructions: 66COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 6ea6c9a4b2a0fcc4eeb784a9da1daa804a2facad788c9a0fca17275e64849f03
                        • Instruction ID: dfe8ce3291e1a8fa7b38eab6385d47006c2bec840384cd56b33519e191759120
                        • Opcode Fuzzy Hash: 6ea6c9a4b2a0fcc4eeb784a9da1daa804a2facad788c9a0fca17275e64849f03
                        • Instruction Fuzzy Hash: FA214C76A00205DFCB14CF58C581B6EBBB5FB89318F6441ADD505AB314CB71AD26CBD0
                        Function 03B4674D Relevance: .1, Instructions: 65COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 4fd0d73892ab73a73e978ce5e4fb25d3e4885a7d9eb04b042a840682b0ee5252
                        • Instruction ID: 3f310298d1c6d16595f5683b1bf27696a6925ae31b1430ee585ac96c9c132506
                        • Opcode Fuzzy Hash: 4fd0d73892ab73a73e978ce5e4fb25d3e4885a7d9eb04b042a840682b0ee5252
                        • Instruction Fuzzy Hash: 41218C75600B00EFC720DF69C980B66B3E8FF85258F4488BDE99AC7250DB30A850DB64
                        Function 03B09240 Relevance: .1, Instructions: 64COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 4f218cc09bb57aaa34f2727546dde78739fbe92a059c92defd0453cc3e2889af
                        • Instruction ID: dea5fdf16d2e8bb5b4dac6267908e4a6900c9615e01b45a812f8091281cafd26
                        • Opcode Fuzzy Hash: 4f218cc09bb57aaa34f2727546dde78739fbe92a059c92defd0453cc3e2889af
                        • Instruction Fuzzy Hash: 4711223E0106C1AAC321EF16D900BB67BE8EB58A88F15416AEA04CB295D739DC11CB24
                        Function 03B466B0 Relevance: .1, Instructions: 61COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 642b5b38615277c3da56c7c17a6cf4505347b1ff59a431b2a2b0b34cd240f2df
                        • Instruction ID: 84913ffc94fbab1b3939e1d944522fbdcb7605c536def033f820ad4463af9151
                        • Opcode Fuzzy Hash: 642b5b38615277c3da56c7c17a6cf4505347b1ff59a431b2a2b0b34cd240f2df
                        • Instruction Fuzzy Hash: B311BC7AA012549FCB24DF59C680B5ABBE8EF85618F0A80BADD09DB310D634DD00DB98
                        Function 03B327ED Relevance: .1, Instructions: 58COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: ad46d2d321cd5387d011d4f68dd654cd739b58831756163ee78d942ab80aa521
                        • Instruction ID: 372e1a6431f21b919761b868b6760708a8ede7d7b197c9c22eafe5f2553bf747
                        • Opcode Fuzzy Hash: ad46d2d321cd5387d011d4f68dd654cd739b58831756163ee78d942ab80aa521
                        • Instruction Fuzzy Hash: DB01AD75606794AFE326E26DDC84F2BBB9CEF8179CF0904F5B8048F291DA64DC00C2A1
                        Function 03B3B052 Relevance: .1, Instructions: 57COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2fcf5b143dc4e3420f2a65c7bdad0eb54a222e44e6c0f9565b446fbf17ca4b3a
                        • Instruction ID: d955be01787c706a47b62ce8b1741650e0bd6f2f3f3aea1071ad6761129f9e3d
                        • Opcode Fuzzy Hash: 2fcf5b143dc4e3420f2a65c7bdad0eb54a222e44e6c0f9565b446fbf17ca4b3a
                        • Instruction Fuzzy Hash: D001F976B04710ABD710EB7A9C80FAFB7E8DF85218F0404B9E605DB141DB70E9008661
                        Function 03B14690 Relevance: .1, Instructions: 57COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7caecf2a5a327217eb72786c3d5dfe5ed8a0769b6da721a9b8c21f2c421dc802
                        • Instruction ID: 3d1768a583a7159c48c10cd96488f8405bd9269d94e45e8a1218824cb4b617a4
                        • Opcode Fuzzy Hash: 7caecf2a5a327217eb72786c3d5dfe5ed8a0769b6da721a9b8c21f2c421dc802
                        • Instruction Fuzzy Hash: 3511A036200754AFCB25DF5AD940F56B7B8EB86B6CF4441B6F8148B650C770E860CF60
                        Function 03BCD6F0 Relevance: .1, Instructions: 57COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                        • Instruction ID: 200cc399e1cf1c66bb7fdb26bbec683467b0f5a08675141318e6f8bd9b5415b4
                        • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                        • Instruction Fuzzy Hash: 50018879710249BBDB24DAA6D944DAFBBBDEFC5A48F0500BEA905D7110E730EE02D760
                        Function 03B46620 Relevance: .1, Instructions: 56COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5106486d8bbdc5f6c593bd03ce8fac872625938ec9f06d9fc832848144b34d8b
                        • Instruction ID: 827a719e7b13b5025eff6206c6f82e438ab7b66ba172b1c0326ecfd009be5333
                        • Opcode Fuzzy Hash: 5106486d8bbdc5f6c593bd03ce8fac872625938ec9f06d9fc832848144b34d8b
                        • Instruction Fuzzy Hash: 53110876A00715ABCB21DF59C9C0B9EF7B8EF89758F5400B5D905EB200C730AD05DB54
                        Function 03B07330 Relevance: .1, Instructions: 55COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a16265e4ece40b11db072ded9f555b5a08278474cbc1014c913241d331b9a693
                        • Instruction ID: 6b7ed828c2dbc25c4f7338e15c8b4788e241300001074402d7389c8251efa03d
                        • Opcode Fuzzy Hash: a16265e4ece40b11db072ded9f555b5a08278474cbc1014c913241d331b9a693
                        • Instruction Fuzzy Hash: A71170716007189FE721CF69C846B6BBBE8EB44358F0584B9E985CB250DB35FD018BA1
                        Function 03B3F2D0 Relevance: .1, Instructions: 54COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 6dcfef7bffaa6c24fb4bfba13acf05df6584f0fc8ee54c19087c26228deadf66
                        • Instruction ID: 1bdb8564ef7674749fe603b4271d22f95287dfd4334602269020b1001ff1ace6
                        • Opcode Fuzzy Hash: 6dcfef7bffaa6c24fb4bfba13acf05df6584f0fc8ee54c19087c26228deadf66
                        • Instruction Fuzzy Hash: 2111E575A00758ABC720EF69C884BAEB7E8FF45748F1800F6E905EB241DA79DE01C750
                        Function 03BA72A0 Relevance: .1, Instructions: 53COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                        • Instruction ID: 4c41ac790c466db41a67de5fed46568c5feb984c11081266b248fc56ee21ec5f
                        • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                        • Instruction Fuzzy Hash: AD01D27A240A09BFD711EF55CC81F92FB6EFF443A8F040975F1044A560CB21ACA1CAA4
                        Function 03B0A250 Relevance: .1, Instructions: 52COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                        • Instruction ID: 8c3e93fde1f73942818c2b078c1342dc17339ba7693fa8d9ed6ce291bfcddb61
                        • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                        • Instruction Fuzzy Hash: 0001D6719057159BCB30CF15D840A76BFA9EF457A47048ABDFC958B6C0D735D420CB60
                        Function 03B16259 Relevance: .1, Instructions: 51COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 54cc1a36504422807c325f485cc7cebe129554dca3e4dbc35eac244fc1522742
                        • Instruction ID: e9c1d8033611037ba6c6f2aacb07b7c88d5652c6511194cc70a35eede477215c
                        • Opcode Fuzzy Hash: 54cc1a36504422807c325f485cc7cebe129554dca3e4dbc35eac244fc1522742
                        • Instruction Fuzzy Hash: 97119E75902328ABDF25EF24CC41FE9B3B4EB04718F5045E4BB18AA0E0DA309E91CF84
                        Function 03B8E1D0 Relevance: .1, Instructions: 51COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: b38ab2f43aeb6f39f8c629d975d94939fbe0844a64a0e30add001c9d4914a8c5
                        • Instruction ID: 495b03766e0f48b49c76e087a9f2e5bcf1b0d82037d7c525abdca9ad65a9bcd8
                        • Opcode Fuzzy Hash: b38ab2f43aeb6f39f8c629d975d94939fbe0844a64a0e30add001c9d4914a8c5
                        • Instruction Fuzzy Hash: CC117C36641340EFCB15EF18C980F56B7B8FB44B58F1400B5E9059B661C335E901CA90
                        Function 03B1208A Relevance: .0, Instructions: 50COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                        • Instruction ID: a65c9319bf375f3d9e35a3babf7a22abb34c8e5ee41c38521fbc4b3e520be54e
                        • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                        • Instruction Fuzzy Hash: E201D8366002109BEF15DA19D884B62B76AFFC4708F994AF9ED05CF246DA71D891C790
                        Function 03B520F0 Relevance: .0, Instructions: 49COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7ec090365a06fda9c66613b8d500ea1fa8980fa5eb92c77a0dde15b9d9108178
                        • Instruction ID: 3edc9f9b0b4d9643c4c9509119b4cabfd5387d08bd9b0ce704d229c85d4193e7
                        • Opcode Fuzzy Hash: 7ec090365a06fda9c66613b8d500ea1fa8980fa5eb92c77a0dde15b9d9108178
                        • Instruction Fuzzy Hash: 00116935A0120CABDF05EFA4C850BAEBBB9EB44348F0040A9FD059B290DA35EE11CB90
                        Function 03B0C020 Relevance: .0, Instructions: 49COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                        • Instruction ID: 8e2a17be00c17bc7b3cb952a0a7c166914299835dd00a4d3db9427452c40fbf7
                        • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                        • Instruction Fuzzy Hash: 4E01F5322007449FDB22D66AC900AA7BBE9FFC5218F0845BDA9468F940EB74E801CB50
                        Function 03B09353 Relevance: .0, Instructions: 48COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                        • Instruction ID: 54bfc8ee60fd516ca470ccd08e71d0e6e8dba3bb204c947af314d81861799417
                        • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                        • Instruction Fuzzy Hash: F1113932911B119FD721DE25C880B22BBE4FB4476AF1988B9E4994A5E6C379E881CF50
                        Function 03B333A5 Relevance: .0, Instructions: 47COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                        • Instruction ID: 053e9e0cd417293fb250e7dd56adc8636cd51258f063d63b1503b757135e0578
                        • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                        • Instruction Fuzzy Hash: 2D01D67A700225A7CB12DBAADC00E5BFAECEFC5648B1544B9B909D7120EA30DD11C764
                        Function 03B4D1D0 Relevance: .0, Instructions: 47COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                        • Instruction ID: 59d646be55d8a9a9012080061297fbafca189c385d626aada4387f6d1b748cde
                        • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                        • Instruction Fuzzy Hash: E901D476E01204ABDB11DA58E800B6A73A9DB8462CF1441FAFE158F281DB35D941D79A
                        Function 03B0826B Relevance: .0, Instructions: 46COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2091c0d5fe7d09f675e50bf71cea1a39827fa7f1f5078024b474ed96cb704cbc
                        • Instruction ID: e2001c882bcb42fbf0aa3ec2b08d9c503677f708d5ed2290576f7998b2a000c0
                        • Opcode Fuzzy Hash: 2091c0d5fe7d09f675e50bf71cea1a39827fa7f1f5078024b474ed96cb704cbc
                        • Instruction Fuzzy Hash: 7701AC75B10A08DFD714EB79D8509AEBBB9EF84218F1940FA9901DB680DE30DE01C690
                        Function 03B2E016 Relevance: .0, Instructions: 46COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                        • Instruction ID: 42f21e3711f1712e6615ca25ba6aa5a13dd8afb97b21763420a03abece8b0971
                        • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                        • Instruction Fuzzy Hash: F7015A722006909BD326D61EC948F27BBE8EB84758F0D04F2E909CB6A2D738DD41C625
                        Function 03BCF367 Relevance: .0, Instructions: 45COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: bc9ae4671aa32c7a24ab8fd203b4505989b09aec55ff2cf9db83f62119199386
                        • Instruction ID: 155bc349c6aab6bf57cf0dd8e66a17803b17fdc23fd5b8b1a93e8e16e4c31fd1
                        • Opcode Fuzzy Hash: bc9ae4671aa32c7a24ab8fd203b4505989b09aec55ff2cf9db83f62119199386
                        • Instruction Fuzzy Hash: 21017175A10358ABDB14EBA5D845FAFBBB8EF84744F0440AAB905EB280D6B4DA00C794
                        Function 03BD972B Relevance: .0, Instructions: 44COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                        • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                        • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                        • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                        Function 03BE5636 Relevance: .0, Instructions: 44COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: fe5790485c48e6fdc79b015e9a66d35b93514c1982aaaaa3bb9af47e2b8b66d8
                        • Instruction ID: 3ad7f8a162f81f20198329cbde74e69be837ac4c1254dc38619170623e95766a
                        • Opcode Fuzzy Hash: fe5790485c48e6fdc79b015e9a66d35b93514c1982aaaaa3bb9af47e2b8b66d8
                        • Instruction Fuzzy Hash: B3118078D00259EFCB04DFA9D440A9EB7B4EF08308F1480AAB914EB341D774DA02CB54
                        Function 03B0C310 Relevance: .0, Instructions: 43COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                        • Instruction ID: 03f1e7d4667ee3811fb0c0de47db1479bce08e2d4301842e5049a38564771c7f
                        • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                        • Instruction Fuzzy Hash: 99F0C877214B229BC732D6694880B6BEE958FC5A6CF1902B5E1099F284CB74DD0166D1
                        Function 03BE5152 Relevance: .0, Instructions: 43COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 03b52259ce70aba07582ca8e08d8b5590f9cc2b39fc9c06e7d1fd2962155034b
                        • Instruction ID: 5649708d90d8cf8073900d7f795ec7e70adaa1a2ebb680be52b5d343143a3895
                        • Opcode Fuzzy Hash: 03b52259ce70aba07582ca8e08d8b5590f9cc2b39fc9c06e7d1fd2962155034b
                        • Instruction Fuzzy Hash: A0012175A10349ABDB04DF69D941ADEBBF8EF49348F14406AF904E7341D774DA018BA1
                        Function 03BE50D9 Relevance: .0, Instructions: 43COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 084dadc65fd665c5aae40923643e0b96c5f57294e29874914db080f6715173ab
                        • Instruction ID: 1e6826dfd4c8dacc034a1f8781fe29691a8ef39f59810f048e5d05590a7b77b6
                        • Opcode Fuzzy Hash: 084dadc65fd665c5aae40923643e0b96c5f57294e29874914db080f6715173ab
                        • Instruction Fuzzy Hash: FA011E79A0030DABCB04DFA9D941A9EB7F8EF49348F54406AF904E7341D674D9018BA1
                        Function 03B3C073 Relevance: .0, Instructions: 43COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                        • Instruction ID: 14412daab3aa31b816d3a6279c9e18bf7299a10b920815af8f30f360d592e898
                        • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                        • Instruction Fuzzy Hash: E4F0AFB2600624ABD324DF8DD840E67FBEADBC1A84F088179A509DB220EA31DD04CB90
                        Function 03BE5060 Relevance: .0, Instructions: 43COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 49f130c52e777a617669fd730e440634e3913f3e1728508b409c7fce41adc73a
                        • Instruction ID: ca5928313d838a20590d303fb7adb1f35e4b757a0782464cf8610ad5f3a08be2
                        • Opcode Fuzzy Hash: 49f130c52e777a617669fd730e440634e3913f3e1728508b409c7fce41adc73a
                        • Instruction Fuzzy Hash: 22017175A00308ABCB04DF69D941AEEB7F8EF48348F10406AF904EB341D774EA018BA0
                        Function 03B45734 Relevance: .0, Instructions: 43COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                        • Instruction ID: 216793065fca1d278bde59f7c4ee1833391196afdac1faeb0804b6426fb2f224
                        • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                        • Instruction Fuzzy Hash: 22F0F472501614AFE729CF5CC940F6AF7EDDB46654F0540BAD500DB230D671DE04CA98
                        Function 03BCF78A Relevance: .0, Instructions: 42COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7c4366cc669fe0aa9d2990d96ae947a89254239ceac749cce3bcb4da978626fb
                        • Instruction ID: d4b86c5f9f2278dc6f2a2b1788a2a47beee4c01aadb5b712ff4f9226107a3ca1
                        • Opcode Fuzzy Hash: 7c4366cc669fe0aa9d2990d96ae947a89254239ceac749cce3bcb4da978626fb
                        • Instruction Fuzzy Hash: 94014074E10349AFCB14DFA9D441AAEBBF5EF08304F1040AAB805EB341E674DA00CB51
                        Function 03BCF2F8 Relevance: .0, Instructions: 41COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3a53f6a0b320800ab6615d64e1f61258be3e2269b0948588961b8704e758200a
                        • Instruction ID: 9ed11214f36740e2856ad6cd24fe8679c0b20b77abfcb5affe43e6dfc5980e43
                        • Opcode Fuzzy Hash: 3a53f6a0b320800ab6615d64e1f61258be3e2269b0948588961b8704e758200a
                        • Instruction Fuzzy Hash: 0EF0A476E10348ABDB14DBB9C405AAEBBB8EF44714F0080AAF501EB280DA74DA018760
                        Function 03BE61E5 Relevance: .0, Instructions: 41COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 830f06ac48dc901602f612a885fdf2cc8d51f412e110fda905fe707da0e79886
                        • Instruction ID: 46251832304d3cfabf1358580ac5d866fe1ba9b6350e55e9d8c10669801fc81b
                        • Opcode Fuzzy Hash: 830f06ac48dc901602f612a885fdf2cc8d51f412e110fda905fe707da0e79886
                        • Instruction Fuzzy Hash: DF012175E002599BCB04DFA9D445B9EB7F4AF54354F1440A9F505AB280D774DA01CB54
                        Function 03B4724D Relevance: .0, Instructions: 40COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                        • Instruction ID: 87a92e7966e9ce55c744256510ba448967a31138042fe4593302f438e92f4705
                        • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                        • Instruction Fuzzy Hash: 04F04675F017596FEB14D7A98901FAABBB8EF81718F0880F5BC119B540EB30E940D394
                        Function 03BE53FC Relevance: .0, Instructions: 39COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 283edeb8424ca29920983768e24291db1c6f2510da0908e27fc3c050e18cfc40
                        • Instruction ID: 2b38ea9ce1fe8e705ad99f3212146c7ffaa9bd8e9faf599f2f5d5245eea0e4c0
                        • Opcode Fuzzy Hash: 283edeb8424ca29920983768e24291db1c6f2510da0908e27fc3c050e18cfc40
                        • Instruction Fuzzy Hash: F5011E75A003099FDB04DFA9D545B9EF7F4FF48304F1482B6A519EB381DA74DA408B90
                        Function 03B0C0F0 Relevance: .0, Instructions: 39COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: c43288cd497956d9fdced4a479a3d245ebcafc317e7b503e497b3302e9870f68
                        • Instruction ID: b1cab07d4b75985af9b815085b9b160b3cbf9e9512907fb09509a6596f2e2cac
                        • Opcode Fuzzy Hash: c43288cd497956d9fdced4a479a3d245ebcafc317e7b503e497b3302e9870f68
                        • Instruction Fuzzy Hash: DEF090713043055BE614D615DC01B227F9AE7C4659F6981FAEA198F2D1EB71DC0182A4
                        Function 03BE3749 Relevance: .0, Instructions: 38COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                        • Instruction ID: d9f60de9d9b67d7238122a0d3f48aedc8f4ef55ec0a2f71b7a3c630c59c17278
                        • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                        • Instruction Fuzzy Hash: 2CF04FB6940348BFE711EB68CD41FEAB7FCEB04714F0001A6B916DB190EA70AA44DB90
                        Function 03BB437C Relevance: .0, Instructions: 37COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                        • Instruction ID: 03be91cf0ff34bbc2fda718fb447f284d1e3fa6786cdab6422e391e7a8ce4193
                        • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                        • Instruction Fuzzy Hash: 40F0B435341B2247D735EA2B8410A7FE265FF80908B4D05BD94458B642DFD0D90087A0
                        Function 03BCF3E6 Relevance: .0, Instructions: 35COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: dc70c8a90fc361fd5e37e8a8ed2c48513180395f7614983e037eb48cea6ab9b9
                        • Instruction ID: 3a0ef99d68d70803bcd18b8f36adc7a7f66fe2ee5036d313ab458aac516dcc8e
                        • Opcode Fuzzy Hash: dc70c8a90fc361fd5e37e8a8ed2c48513180395f7614983e037eb48cea6ab9b9
                        • Instruction Fuzzy Hash: 30F04F75A10348EFCB04EFA9D545BAEB7F4EF48304F5040A9B945EB381D674DA01CB54
                        Function 03B092FF Relevance: .0, Instructions: 35COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 383906bc46af814203a20b625b95f166d7986df0fbff176c04bc551b94c97ca3
                        • Instruction ID: 21a450943e5b93d3aa6687c3062429e6124a01b36812883fa3369a0cfb0d8696
                        • Opcode Fuzzy Hash: 383906bc46af814203a20b625b95f166d7986df0fbff176c04bc551b94c97ca3
                        • Instruction Fuzzy Hash: 0EF0F032200340ABC731EB19CC04F9ABBEDEF84714F0801A8A546830E1C7A1BA04CA50
                        Function 03B147FB Relevance: .0, Instructions: 33COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 61f568531ebef7aa9a19b6b6fb66dd8cfe0e813ac43721a2a7a71aa291fa9da6
                        • Instruction ID: 1f78725b8cdf498b124d6fa0e4aea9a6a9af131d51a0731e2d9992563dcd607b
                        • Opcode Fuzzy Hash: 61f568531ebef7aa9a19b6b6fb66dd8cfe0e813ac43721a2a7a71aa291fa9da6
                        • Instruction Fuzzy Hash: 55F09A359167E49ED722DB6AC044B61B7E8DB0172CF8C89FAD8898B541C7A4D9A0C650
                        Function 03BCF6C7 Relevance: .0, Instructions: 33COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: e24621965a93f70eaf81d77f5bf5dd49d3636501f8a64d987649e9f9dc57dd46
                        • Instruction ID: 675d5a4769a48609f79cf63126caa69cbf7be8f0919d12d5e043f2e53ee6c97d
                        • Opcode Fuzzy Hash: e24621965a93f70eaf81d77f5bf5dd49d3636501f8a64d987649e9f9dc57dd46
                        • Instruction Fuzzy Hash: 6DF04F75A10388ABCB14EBA9D445AAEBBF4AF44308F0440A9E905EB281D674D900CB54
                        Function 03BD0115 Relevance: .0, Instructions: 32COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f800237adfa6834e8c4f1a671accc792ca8d1f397e533958e2fb004f6fcddc45
                        • Instruction ID: a76e2508a9888f5dbaa5aebe76873638661aeaddd7b62b221547f0ac26d4ba18
                        • Opcode Fuzzy Hash: f800237adfa6834e8c4f1a671accc792ca8d1f397e533958e2fb004f6fcddc45
                        • Instruction Fuzzy Hash: E5F0A76A6257C446CB32FF2864503D5AB59D78111CF1E14EDE5E1DB605D5748CA3C224
                        Function 03BE539D Relevance: .0, Instructions: 31COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: e6d853a2d9b38a8b24b8bf887f846b087c6a78557ebcec54104b471f5bee7240
                        • Instruction ID: e72d9bfc718a89281d107332ae3b187253d90f8463f1d02dbd89e6dc9864e66f
                        • Opcode Fuzzy Hash: e6d853a2d9b38a8b24b8bf887f846b087c6a78557ebcec54104b471f5bee7240
                        • Instruction Fuzzy Hash: F0F05474A1034CAFDB14EB79D545B5EB7F4EF44308F5480A5E506EB281DA74DA018B14
                        Function 03BE5283 Relevance: .0, Instructions: 31COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f3d4f56efdbd608de77efc319ad27f4e0fd3bb2eac70ef84dfe31b4e443a5a38
                        • Instruction ID: 702862755b2b6a066f4c42aaf5772f360665723fbcfe4c7d71a63e18047ba8f0
                        • Opcode Fuzzy Hash: f3d4f56efdbd608de77efc319ad27f4e0fd3bb2eac70ef84dfe31b4e443a5a38
                        • Instruction Fuzzy Hash: D7F0BE74A10348ABCB14EBB9D501BAEB7F4EF44308F4444A9B845EB381EB78D9008B50
                        Function 03BE52E2 Relevance: .0, Instructions: 31COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5f421881ccc82a45cad201246ba725e464009dbfc99c8dc277fd22ecaa3b4a16
                        • Instruction ID: c345e828457e4736cec82e7868e8ac21af476c89f5807b55371069df10470746
                        • Opcode Fuzzy Hash: 5f421881ccc82a45cad201246ba725e464009dbfc99c8dc277fd22ecaa3b4a16
                        • Instruction Fuzzy Hash: 7CF0BE78A10348ABCB14EFB9E541F6EB7F4EF04308F4440A9B905EB281EA74DA00CB14
                        Function 03B52619 Relevance: .0, Instructions: 31COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                        • Instruction ID: f571756191317a87acb18984de18f2a7544fcb144ecbb304a661b21b04cf54f2
                        • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                        • Instruction Fuzzy Hash: 44E092323026006BD722EE59CC80F57B76EDF83B14F0404B9B9045E251CAE69C0982A4
                        Function 03BE5341 Relevance: .0, Instructions: 30COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 29f9638757a9f3ecf1c5883e250ce5fd900395822e1fbf3f6277ab3862e39641
                        • Instruction ID: ea542269109dfacc220bd88d3d1ff27bb119d1b8c3ea90f0d657080f08a6aaf7
                        • Opcode Fuzzy Hash: 29f9638757a9f3ecf1c5883e250ce5fd900395822e1fbf3f6277ab3862e39641
                        • Instruction Fuzzy Hash: A5F08274A04348ABCB04EBB9D545F9EB7F8EF49348F5401A9B506EB2D1EA74DE008714
                        Function 03BE5227 Relevance: .0, Instructions: 30COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: ec289c40b09c97fa4d95b0523c944054c75dcd3c630038a4299f77bb56fd366c
                        • Instruction ID: dd6f78d4f7bffa778778d66682c74817b8c669c217534397f878e0615d34677f
                        • Opcode Fuzzy Hash: ec289c40b09c97fa4d95b0523c944054c75dcd3c630038a4299f77bb56fd366c
                        • Instruction Fuzzy Hash: 2AF0E274A14348ABCB14EBB8D501F6EB3F4EF04308F0400A9B905EB281EA74D9008754
                        Function 03B47208 Relevance: .0, Instructions: 30COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: c3a0aeec78e695dc74b8c65784b8d2e9c9e71cd470adb488f6544c95a7d0c09f
                        • Instruction ID: 98d20252b9fdfa449138ac843c271a29f2e3d33cf8d0e5c8558ad7e2c9f073e2
                        • Opcode Fuzzy Hash: c3a0aeec78e695dc74b8c65784b8d2e9c9e71cd470adb488f6544c95a7d0c09f
                        • Instruction Fuzzy Hash: D9F0A7B59136969FD721E71AC185B99B7D8DB0177CF1D49F1D4198F901DB38D880C250
                        Function 03BE51CB Relevance: .0, Instructions: 30COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: acd8c942f1008511383481eb0cd8df0b8a88279a7bfefe10b5d768e4c21e09e4
                        • Instruction ID: 89a1653ec829ff5900e84242b353693bbd4959939f155f5fa075d6b65fb52a71
                        • Opcode Fuzzy Hash: acd8c942f1008511383481eb0cd8df0b8a88279a7bfefe10b5d768e4c21e09e4
                        • Instruction Fuzzy Hash: 06F08274A10348ABDB14EBB9D505F6EB7F4EF0430CF5400A9B905EB2C1EA74D900C764
                        Function 03B8D070 Relevance: .0, Instructions: 30COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                        • Instruction ID: 8d43d75bb1884669d0da8b281af986e6c5c5b21388611efba913d51aab10e776
                        • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                        • Instruction Fuzzy Hash: 6EF0E53360471467C230BA098C05F9BFBACDBD5B74F20036ABA249B1D0DA70A901C7D6
                        Function 03BCF72E Relevance: .0, Instructions: 30COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: c6d60b51e490531bcd15fd6ca7b9bba596e6cbc960ad9295672abdfb66e547a1
                        • Instruction ID: 9f37ebc8511735dcae093a8356f85041dd39bb5a6dc2d2e3905dafd9f3698748
                        • Opcode Fuzzy Hash: c6d60b51e490531bcd15fd6ca7b9bba596e6cbc960ad9295672abdfb66e547a1
                        • Instruction Fuzzy Hash: 3DF08275A10388ABDB14EBB9D555F9E77F4EF08708F4400E9F505EB281D974DD018714
                        Function 03B10710 Relevance: .0, Instructions: 28COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                        • Instruction ID: d1ecbbf39ddc7406a558f0bdcf51acd797625f6deb751a726a98d36305394698
                        • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                        • Instruction Fuzzy Hash: 16F0E53E3043459BDB15EF15D050A957BE8EB41358F4400F8E84A8F301D735EAD1CB40
                        Function 03BE37B6 Relevance: .0, Instructions: 27COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                        • Instruction ID: a478a834e99310447d8d09befcd7d04f0296669a9ecc4db678b8a57534b65938
                        • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                        • Instruction Fuzzy Hash: 1AE06D76211210ABD764DB58CD05FE673ECEB04724F5802A8B519970D0DBB0AE40DA60
                        Function 03B94000 Relevance: .0, Instructions: 22COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                        • Instruction ID: e241fa2e551e2e1b0a2da221eb752ba64f97c1bf6b65e4a97f866ba5ebf1a9ac
                        • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                        • Instruction Fuzzy Hash: 3EE0AE343002058FEB15CF1AC040B62B7A6FFD5A14F29C0B9A8488F205EB32A8438A40
                        Function 03BCB3D0 Relevance: .0, Instructions: 21COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                        • Instruction ID: 8b0008db00c2a9ac9ea806117a8ddf809211341625bf5437afdeaecb9c64095b
                        • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                        • Instruction Fuzzy Hash: 84E0C235284354BBDB32EE40CC01FA97F59DB807A9F1040B5FB0C6E690CA75AD91D6D4
                        Function 03B0823B Relevance: .0, Instructions: 21COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                        • Instruction ID: e8b2db81630d827a5dceb742d31d18ca2fe6389c0b4f4b62d4584e3fcb5324c3
                        • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                        • Instruction Fuzzy Hash: 98E08C35941B20EEDB31EE11DD10B917AA5FB48B28F1449F9F0894E0A48674A882CA44
                        Function 03B992BC Relevance: .0, Instructions: 20COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d2abc8325e5237cd0412460c4e4fc4fe654b7ecc563f8b6cd2d2584f1bc47a55
                        • Instruction ID: 7df8feb4f27c0a6022bc5c756a78845444424331a90cbb459b6d7e98ed6aa1db
                        • Opcode Fuzzy Hash: d2abc8325e5237cd0412460c4e4fc4fe654b7ecc563f8b6cd2d2584f1bc47a55
                        • Instruction Fuzzy Hash: DEF03934205B80CFFA1ADF04C1A1B1173B9F74AB08F4000A9C4428BBA1C33AAE41CA40
                        Function 03B12050 Relevance: .0, Instructions: 20COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 2011186db72abbf3a10220f2b3aa12711e1d9732627cb54c054dbf8d68f3b9f9
                        • Instruction ID: 79010498565f5adeab689a8e71501ed9f25cb3b0099a7d12b497d722f4da9a91
                        • Opcode Fuzzy Hash: 2011186db72abbf3a10220f2b3aa12711e1d9732627cb54c054dbf8d68f3b9f9
                        • Instruction Fuzzy Hash: 1AE08C322006A06BC211FF9DDD10F8A77AAEB942A4F410261B1548B294CA34AC20C794
                        Function 03B0A0E3 Relevance: .0, Instructions: 15COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                        • Instruction ID: c094a5a7fa9bb0417eea5d2f2d57e62d280f86235bee75ea756784f1b5bb5145
                        • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                        • Instruction Fuzzy Hash: 48D02232312230A3CB28DA50A900FA3AE05DB81AA8F0A01BC340EA3840C0088C42C2E0
                        Function 03B202A0 Relevance: .0, Instructions: 13COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                        • Instruction ID: 66606250d23adda18bac60c39900c4b1780dad9dcf08d2e094bda6aa26133499
                        • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                        • Instruction Fuzzy Hash: 9AD0C935612E80CFC61ACB1DC5A4B1577A8FB44B48F8505E1E406CBB21D62CD940CA00
                        Function 03B9930B Relevance: .0, Instructions: 12COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                        • Instruction ID: 41ea966cb1c82217810bb79f52deb4036cbd810d18ccacf89c9336d271ca93cf
                        • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                        • Instruction Fuzzy Hash: 7DD01735945AC49FEB27CB08C166B507BF8F709B44F8900E9E04247AA2C37C9A84CB00
                        Function 03B4C700 Relevance: .0, Instructions: 12COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                        • Instruction ID: 2d73e424716080dab1537e2d9b28de9c19ea729605d53902ffd0ea8449652520
                        • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                        • Instruction Fuzzy Hash: D3C0123A290748AFC712EE98CD01F427BA9EB98B50F000061F2088B670C635E820EA84
                        Function 03B30310 Relevance: .0, Instructions: 11COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                        • Instruction ID: 1990bac904be8f637321856759cf5113f4e201354eff73e5491d90fc9fcaf618
                        • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                        • Instruction Fuzzy Hash: 85D01236100248EFCB01EF45C890D9A772AFFC8710F108059FD1A0B6108A31ED62DA50
                        Function 03B10750 Relevance: .0, Instructions: 9COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                        • Instruction ID: 27e101cf6b75331b47c91e0155db268e718651dab3bd8d48d6674cf561d0d3e2
                        • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                        • Instruction Fuzzy Hash: B5C04C7D7016418FCF15DB19D3D4F4577E4F744744F1508E0E809CB722E628E801CA10
                        Function 0361DFFD Relevance: 56.5, Strings: 45, Instructions: 215COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452981279.0000000003610000.00000040.00001000.00020000.00000000.sdmp, Offset: 03610000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3610000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
                        • API String ID: 0-3558027158
                        • Opcode ID: 289b0828c641e457cdbaae2d864c63646d9d62e9bb74ac9e66f56566867afab1
                        • Instruction ID: 55bae84591dc48534e8b9cbccf4541208dc2fe9388f9e6c39c737612bb33b34f
                        • Opcode Fuzzy Hash: 289b0828c641e457cdbaae2d864c63646d9d62e9bb74ac9e66f56566867afab1
                        • Instruction Fuzzy Hash: 559150F04082988AC7158F55A1612AFFFB1EBC6305F15816DE7E6BB243C3BE8915CB85
                        Function 03A8DFFD Relevance: 56.5, Strings: 45, Instructions: 215COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453427125.0000000003A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 03A80000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3a80000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
                        • API String ID: 0-3558027158
                        • Opcode ID: 289b0828c641e457cdbaae2d864c63646d9d62e9bb74ac9e66f56566867afab1
                        • Instruction ID: 42210dd0e033a96b6ab1e4bda7d13cdd843fb791ee4ae601ac3363f6fa0a2db2
                        • Opcode Fuzzy Hash: 289b0828c641e457cdbaae2d864c63646d9d62e9bb74ac9e66f56566867afab1
                        • Instruction Fuzzy Hash: 8F9130F04482988AC7158F55A0612AFFFB5EBC6305F15816DE7E6BB243C3BE89058B85
                        Function 03613BCA Relevance: 30.1, Strings: 24, Instructions: 65COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452981279.0000000003610000.00000040.00001000.00020000.00000000.sdmp, Offset: 03610000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3610000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: "7rv$&+5#$41 j$4sov$7rvz$cvw $cvw7$j&+5$kwrx$ovw0$o~co$rtu4$rvz|$rxzo$u4cs$u|71$w7zk$zkkw$zmr}$zort$z|~4$|~4l$~4zk$~yk7
                        • API String ID: 0-1676619287
                        • Opcode ID: 7e9dfb99911999530ba79f212fc5e48b35c45c8d02af936015eb64b9ed2b9903
                        • Instruction ID: 003a735a3100d484c1a6669a8fe1cdeee9ccc189d858f5495e7b1dba828d51f6
                        • Opcode Fuzzy Hash: 7e9dfb99911999530ba79f212fc5e48b35c45c8d02af936015eb64b9ed2b9903
                        • Instruction Fuzzy Hash: 512142B041460C9ACF159F55C541BEEBB74FF01288FA1829DE8059F369CB748696CB89
                        Function 03A83BCA Relevance: 30.1, Strings: 24, Instructions: 65COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453427125.0000000003A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 03A80000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3a80000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: "7rv$&+5#$41 j$4sov$7rvz$cvw $cvw7$j&+5$kwrx$ovw0$o~co$rtu4$rvz|$rxzo$u4cs$u|71$w7zk$zkkw$zmr}$zort$z|~4$|~4l$~4zk$~yk7
                        • API String ID: 0-1676619287
                        • Opcode ID: 7e9dfb99911999530ba79f212fc5e48b35c45c8d02af936015eb64b9ed2b9903
                        • Instruction ID: cc245df45da37df682c408fbac9da720576d1460c55570348e850decb42a9d7f
                        • Opcode Fuzzy Hash: 7e9dfb99911999530ba79f212fc5e48b35c45c8d02af936015eb64b9ed2b9903
                        • Instruction Fuzzy Hash: A12142B041060C9ACF159F55D541BEEBB74FF01288F91829DE805AF369CB748696CB89
                        Function 03613CD1 Relevance: 18.8, Strings: 15, Instructions: 59COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2452981279.0000000003610000.00000040.00001000.00020000.00000000.sdmp, Offset: 03610000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3610000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: &<!$""/a$"'%+$#+az$%!gn$*!9=$/<'a$`}xn$a{}y$n+-$x`}g$z`~`${`~n${}y`$|z~}
                        • API String ID: 0-1609194483
                        • Opcode ID: ab2c7ee05656ab9dbdcf6f0468d2b75e848ada8f98f42acf590c3774de1b3e72
                        • Instruction ID: 148e7f2468f3799107c7b6d5dc72e8f26d3d8a179c601c99b10e471325326f69
                        • Opcode Fuzzy Hash: ab2c7ee05656ab9dbdcf6f0468d2b75e848ada8f98f42acf590c3774de1b3e72
                        • Instruction Fuzzy Hash: DC2155B040470CDACB29DF94E5917EEBBB0FF00344F80915DEA096F249D7B68254CB88
                        Function 03A83CD1 Relevance: 18.8, Strings: 15, Instructions: 59COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453427125.0000000003A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 03A80000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3a80000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: &<!$""/a$"'%+$#+az$%!gn$*!9=$/<'a$`}xn$a{}y$n+-$x`}g$z`~`${`~n${}y`$|z~}
                        • API String ID: 0-1609194483
                        • Opcode ID: ab2c7ee05656ab9dbdcf6f0468d2b75e848ada8f98f42acf590c3774de1b3e72
                        • Instruction ID: 41b9eb68aeb7e1f7c6e85470b22ad7decae307ba959c8111e4cba9a115a5bb83
                        • Opcode Fuzzy Hash: ab2c7ee05656ab9dbdcf6f0468d2b75e848ada8f98f42acf590c3774de1b3e72
                        • Instruction Fuzzy Hash: 6D2142B040470CDACB29DF94E9917EEBBB0FF00744F80915DEA096F249D7B68258CB88
                        Function 03B52890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: ___swprintf_l
                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                        • API String ID: 48624451-2108815105
                        • Opcode ID: 0ced43850fc507f693fa6430b350b94fcca94f4cd23509d14571ba281fad6ce2
                        • Instruction ID: 9ae69004a4239717b71e885014f6a1f98dcc1976a0529a3e22a7ba8ba9dbfeba
                        • Opcode Fuzzy Hash: 0ced43850fc507f693fa6430b350b94fcca94f4cd23509d14571ba281fad6ce2
                        • Instruction Fuzzy Hash: 2651B9B5A051167FCB11EB988990A7EF7B8FB08208B1485FAF865DB641D374DE40C7A0
                        Function 03B47630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                        Download Yara Rule
                        Strings
                        • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 03B846FC
                        • CLIENT(ntdll): Processing section info %ws..., xrefs: 03B84787
                        • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 03B84655
                        • Execute=1, xrefs: 03B84713
                        • ExecuteOptions, xrefs: 03B846A0
                        • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 03B84725
                        • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 03B84742
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                        • API String ID: 0-484625025
                        • Opcode ID: 3cb64106cab0049fa9e02c3353f025b9ac2202d11a15e2334b58af33debed9a7
                        • Instruction ID: c089618f9fe9b4d9c24890a17a94431e8386a5c9df22f539abccebfdb8e3ab2f
                        • Opcode Fuzzy Hash: 3cb64106cab0049fa9e02c3353f025b9ac2202d11a15e2334b58af33debed9a7
                        • Instruction Fuzzy Hash: 55510635A00319BEEF10EBA9DC8AFAE77A9EF04308F0400F9E515AB181DB719E45DB54
                        Function 03B5B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: __aulldvrm
                        • String ID: +$-$0$0
                        • API String ID: 1302938615-699404926
                        • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                        • Instruction ID: 6b86f0a5f12e45d812250d7b300658ec61a29d0a4b21bdc8e3e720145174cb52
                        • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                        • Instruction Fuzzy Hash: B9818D74E062499EDF28CE68C8917BEFBA6EF45318F1C41EAFC61A7391C63499418B50
                        Function 03B3F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                        Download Yara Rule
                        Strings
                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 03B802BD
                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 03B802E7
                        • RTL: Re-Waiting, xrefs: 03B8031E
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                        • API String ID: 0-2474120054
                        • Opcode ID: 34b9413c064512a2f712d066badeb697307ebcf94c8bf27e55648a603ed1c604
                        • Instruction ID: a10b254657efb3fc1b40bb920ecc5a0dae8c32ed212f0e872a4040053de95bf2
                        • Opcode Fuzzy Hash: 34b9413c064512a2f712d066badeb697307ebcf94c8bf27e55648a603ed1c604
                        • Instruction Fuzzy Hash: 06E19F34A04741EFD725EF28C884B2AB7E0FB49358F180AB9F5A58B2E1D774D945CB42
                        Function 03B4BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                        Download Yara Rule
                        Strings
                        • RTL: Resource at %p, xrefs: 03B87B8E
                        • RTL: Re-Waiting, xrefs: 03B87BAC
                        • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 03B87B7F
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                        • API String ID: 0-871070163
                        • Opcode ID: 5c03b99162b05db96c289c83b91a7369afad9c537ebabcac70d4b23c6ea7671f
                        • Instruction ID: e7b977c027d257d733a9b0098ae685c7d2b5b42d93b49f7bd8b841687831b807
                        • Opcode Fuzzy Hash: 5c03b99162b05db96c289c83b91a7369afad9c537ebabcac70d4b23c6ea7671f
                        • Instruction Fuzzy Hash: 0341E4357007029FD724DE28C851B6AB7E5EF84718F140ABDFA9ADB280DB31E805DB95
                        Function 03B4B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                        Download Yara Rule
                        APIs
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03B8728C
                        Strings
                        • RTL: Resource at %p, xrefs: 03B872A3
                        • RTL: Re-Waiting, xrefs: 03B872C1
                        • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 03B87294
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                        • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                        • API String ID: 885266447-605551621
                        • Opcode ID: d87ab2ab90166145f02cbefbc98c6edce116fbdbc09e87ac7a90b0dc6c5cc460
                        • Instruction ID: c3ad9dd1b26f84b8435a3d3a46259eb2233081a86a2b4cb8bdcaf9a3b8af33a3
                        • Opcode Fuzzy Hash: d87ab2ab90166145f02cbefbc98c6edce116fbdbc09e87ac7a90b0dc6c5cc460
                        • Instruction Fuzzy Hash: 5941F435B00206ABDB10EF24CC42B6AB7A5FB8571CF2406B9F995DB240DB31E852D7D4
                        Function 03B57D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID: __aulldvrm
                        • String ID: +$-
                        • API String ID: 1302938615-2137968064
                        • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                        • Instruction ID: c30abdb5673c8359ba50d994a204036e5798064037300ad0d0c46f7d67aaf73f
                        • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                        • Instruction Fuzzy Hash: 2491B271F003599BDB24DE69C882BBEB7A5EF44328F5845BAFC65E72C0DB3089408750
                        Function 03B19126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000005.00000002.2453506436.0000000003AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03AE0000, based on PE: true
                        • Associated: 00000005.00000002.2453506436.0000000003C09000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C0D000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 00000005.00000002.2453506436.0000000003C7E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_5_2_3ae0000_iexplore.jbxd
                        Similarity
                        • API ID:
                        • String ID: $$@
                        • API String ID: 0-1194432280
                        • Opcode ID: 6f0de71299490fd3980b5caa736209312a7866607708228ba0f0ebe12119a39f
                        • Instruction ID: a7d4d87148763e520c1b56d4966bd4d91c713ef4f144f287e31386ba64df5b77
                        • Opcode Fuzzy Hash: 6f0de71299490fd3980b5caa736209312a7866607708228ba0f0ebe12119a39f
                        • Instruction Fuzzy Hash: 0A813975D002699BDB35DF54CC44BEAB7B8EF08758F0445EAA919BB280D7309E94CFA0

                        Execution Graph

                        Execution Coverage:0.2%
                        Dynamic/Decrypted Code Coverage:0%
                        Signature Coverage:0%
                        Total number of Nodes:12
                        Total number of Limit Nodes:1
                        execution_graph 73485 2c22c00 73487 2c22c0a 73485->73487 73488 2c22c11 73487->73488 73489 2c22c1f LdrInitializeThunk 73487->73489 73494 2c22ad0 LdrInitializeThunk 73501 2adf1f9 73507 2ae0838 73501->73507 73503 2adf225 NtQueryInformationProcess 73504 2adf25f 73503->73504 73505 2adf3be NtClose 73504->73505 73506 2adf292 73504->73506 73505->73506 73508 2ae085d 73507->73508 73508->73503

                        Executed Functions

                        Function 02ADF1F9 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 412nativeCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        • NtQueryInformationProcess.NTDLL ref: 02ADF244
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916007880.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2ad0000_findstr.jbxd
                        Similarity
                        • API ID: InformationProcessQuery
                        • String ID: 0
                        • API String ID: 1778838933-4108050209
                        • Opcode ID: e60512914322147aab23b0926706af130326b2ce3c6039e193fa7e34a1dd7540
                        • Instruction ID: 5836b22cc1405d36ed4c57fc78db2fc476358063225383e98b9c38aa05b5181e
                        • Opcode Fuzzy Hash: e60512914322147aab23b0926706af130326b2ce3c6039e193fa7e34a1dd7540
                        • Instruction Fuzzy Hash: B6E11974558A8C8FCF64EF68C994AEE77A1FB99308F40062AD84BD7640DF38D641CB42
                        Function 02C23090 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 122 2c23090-2c2309c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 4069af328aba4210c47dedf2ec274c973e0f7439b7e2700fbc9e8190238bfa4d
                        • Instruction ID: a9dce3f9ddf30a063ac49c3ec4ca22a0a8e26ca6ae9feca0201e375e89db6998
                        • Opcode Fuzzy Hash: 4069af328aba4210c47dedf2ec274c973e0f7439b7e2700fbc9e8190238bfa4d
                        • Instruction Fuzzy Hash: 8090026128140802D141715884147070016C7D0A01F55C511F0028554D86168A6576B1
                        Function 02C235C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 123 2c235c0-2c235cc LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 739664bef9e893442055a482d21c09654c9f30155e0a051a653b54292f0353ac
                        • Instruction ID: 93a47647a33f26990289cc54a8ae285f00f6b3528d563bf750d7dca81aaa36ab
                        • Opcode Fuzzy Hash: 739664bef9e893442055a482d21c09654c9f30155e0a051a653b54292f0353ac
                        • Instruction Fuzzy Hash: B990027164550402D10171584514707101587D0601F65C911F0428568D87958A5175A2
                        Function 02C22AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 112 2c22ad0-2c22adc LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: cb788aa7bba593f395062aea674cbb7c582bbdc00cf5677b534ed7c264f2e7ec
                        • Instruction ID: 994c3a4d7aa8095578b895489ec5ce333dcd9faf4fefd103121a4f9508ca833b
                        • Opcode Fuzzy Hash: cb788aa7bba593f395062aea674cbb7c582bbdc00cf5677b534ed7c264f2e7ec
                        • Instruction Fuzzy Hash: 42900475351400030107F55C07045070057C7D5751355C531F101D550CD731CD717131
                        Function 02C22B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 113 2c22b60-2c22b6c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 8349f92b0ebf4773432eeb14b78c569a0df86fc5eee8cf972f9b08d9003e700b
                        • Instruction ID: eb186c8cc5eba5a952ae88dc43f7077255e6cb703bc6c3498f1fd10d410bf8a0
                        • Opcode Fuzzy Hash: 8349f92b0ebf4773432eeb14b78c569a0df86fc5eee8cf972f9b08d9003e700b
                        • Instruction Fuzzy Hash: 799002A124240003410671584414617401A87E0601B55C521F1018590DC52589917125
                        Function 02C22FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 121 2c22fe0-2c22fec LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 564ab06829add9744d6f32f40aeca12d0bb081643ddb5d812653e73fc7203024
                        • Instruction ID: 1c586a20b0f8a3d5a6cef30f2527481888de01b1cc548cfbba5462eb9ece5fd3
                        • Opcode Fuzzy Hash: 564ab06829add9744d6f32f40aeca12d0bb081643ddb5d812653e73fc7203024
                        • Instruction Fuzzy Hash: 73900261251C0042D20175684C14B07001587D0703F55C615F0158554CC91589616521
                        Function 02C22F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 120 2c22f30-2c22f3c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: e7826b01c3a04173070553298a6f4629d0bbdeccd81ef0161a0cd621dfb874a6
                        • Instruction ID: 5289dc0b1a47dc8905bea1c1914c9fb8c47bf72d35b0532790690c5869073ae0
                        • Opcode Fuzzy Hash: e7826b01c3a04173070553298a6f4629d0bbdeccd81ef0161a0cd621dfb874a6
                        • Instruction Fuzzy Hash: 639002A138140442D10171584414B070015C7E1701F55C515F1068554D8619CD527126
                        Function 02C22CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 116 2c22ca0-2c22cac LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: ca4773bd02de0c1a57e647599d13f258c782bf4868f97769e623ef28415e810b
                        • Instruction ID: 838702c3634bcae2c91a8cfaa42f894857a5763384b5ab2d323bffb180d7ff10
                        • Opcode Fuzzy Hash: ca4773bd02de0c1a57e647599d13f258c782bf4868f97769e623ef28415e810b
                        • Instruction Fuzzy Hash: FD90047134140403D10175DC540C7470015C7F0701F55D511F503C555FC775CDD17131
                        Function 02C22C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 114 2c22c60-2c22c6c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: d8e115354261c9168c7a85ca78e02307f8757a9d94f99aa1f5ccf27b39b691a1
                        • Instruction ID: 3fad77934b2652554bd2ef009d63dc9bc62c536759aa138dce2636ceb332f03e
                        • Opcode Fuzzy Hash: d8e115354261c9168c7a85ca78e02307f8757a9d94f99aa1f5ccf27b39b691a1
                        • Instruction Fuzzy Hash: 3790047134140C43D101715C4404F470015C7F0701F55C517F013C754DC715CD517531
                        Function 02C22C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 115 2c22c70-2c22c7c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: fd9073ed3b4284ae48600ec18934ad4d90ad2c89ab7165a5d0cd5dd06b7e4394
                        • Instruction ID: 9258bcd9b50f9fef9096ab4df8d54472ac67762b66d3748b917c78070809f091
                        • Opcode Fuzzy Hash: fd9073ed3b4284ae48600ec18934ad4d90ad2c89ab7165a5d0cd5dd06b7e4394
                        • Instruction Fuzzy Hash: 8290027124148802D1117158840474B001587D0701F59C911F4428658D869589917121
                        Function 02C22DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 118 2c22dd0-2c22ddc LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 4c10b7367b0c3dc199b76562226fbdb80b82d3073df80a8c1a739d0d2a573ace
                        • Instruction ID: 5194279375a68e32be16ffe2cdbe547bfa91bbc525fea0e85eb75dcf8e417df8
                        • Opcode Fuzzy Hash: 4c10b7367b0c3dc199b76562226fbdb80b82d3073df80a8c1a739d0d2a573ace
                        • Instruction Fuzzy Hash: D7900261282441525546B1584404507401697E0641795C512F1418950C85269956E621
                        Function 02C22DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 119 2c22df0-2c22dfc LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 4be91ed1382f7cee24341877f02fd2f14149401cbbf1a404f93344021e3a4e22
                        • Instruction ID: abf66eac0fa892bbdc620d6dc9b6eca4b94299390c905bcc33694bb8ccc09842
                        • Opcode Fuzzy Hash: 4be91ed1382f7cee24341877f02fd2f14149401cbbf1a404f93344021e3a4e22
                        • Instruction Fuzzy Hash: E890027124140413D11271584504707001987D0641F95C912F0428558D96568A52B121
                        Function 02C22D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 117 2c22d10-2c22d1c LdrInitializeThunk
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: 715da4c2e7fcad87f00856f1f6c3151e059000ffa7fc58438deae647dc6b4011
                        • Instruction ID: f743acf7a9188422505cc7dee955f32b92006e8541e75f1dd193b0a3158e9efa
                        • Opcode Fuzzy Hash: 715da4c2e7fcad87f00856f1f6c3151e059000ffa7fc58438deae647dc6b4011
                        • Instruction Fuzzy Hash: 3590026925340002D1817158540860B001587D1602F95D915F0019558CC91589696321
                        Function 02C22C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 108 2c22c0a-2c22c0f 109 2c22c11-2c22c18 108->109 110 2c22c1f-2c22c26 LdrInitializeThunk 108->110
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: InitializeThunk
                        • String ID:
                        • API String ID: 2994545307-0
                        • Opcode ID: ce1431f54d4d61630b33c8d27a8b3c1c75a4a39d373cfdb9ac235cbb3194d0ae
                        • Instruction ID: c6232366128a85c1d556ee607ed16f9f8a606ec2aedc12d4a38b230a178b4694
                        • Opcode Fuzzy Hash: ce1431f54d4d61630b33c8d27a8b3c1c75a4a39d373cfdb9ac235cbb3194d0ae
                        • Instruction Fuzzy Hash: 73B09B719419D5C5EB11F7644A08717791067D0701F15C561E2034641E4B38C1D5F176

                        Non-executed Functions

                        Function 02C22890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: ___swprintf_l
                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                        • API String ID: 48624451-2108815105
                        • Opcode ID: 2732b207aabc815320d0907d5cb1e1a056fbd0e396a47d4545f1f65f889455aa
                        • Instruction ID: 22d746f959afcb39111633be964ea158d1210c50adc755445f4b8bf9f12e4875
                        • Opcode Fuzzy Hash: 2732b207aabc815320d0907d5cb1e1a056fbd0e396a47d4545f1f65f889455aa
                        • Instruction Fuzzy Hash: 8F5129B6A00526BFDB21DFA98880A7EF7B8BF483007508269E855D7641D774DF44CBE1
                        Function 02C17630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                        Download Yara Rule
                        Strings
                        • Execute=1, xrefs: 02C54713
                        • CLIENT(ntdll): Processing section info %ws..., xrefs: 02C54787
                        • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 02C54655
                        • ExecuteOptions, xrefs: 02C546A0
                        • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 02C54742
                        • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 02C546FC
                        • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 02C54725
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID:
                        • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                        • API String ID: 0-484625025
                        • Opcode ID: b8e78fd9e5c650831d508cd5dc06afc781644cceccad3ba632497f822a598893
                        • Instruction ID: 226e10dc5b5977cc8856c36adee472d826a5448b95ffe7500c6cc70e97282b0c
                        • Opcode Fuzzy Hash: b8e78fd9e5c650831d508cd5dc06afc781644cceccad3ba632497f822a598893
                        • Instruction Fuzzy Hash: 35513A31A402196AEF21AB65EC8AFBAB3B9EF45304F1000D9E505A7191DB70DB89EF54
                        Function 02C2B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: __aulldvrm
                        • String ID: +$-$0$0
                        • API String ID: 1302938615-699404926
                        • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                        • Instruction ID: 13df44b64810192048190536d94bf80b2fcf18b1219cfdc135aa4cb181bb18cc
                        • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                        • Instruction Fuzzy Hash: 4D81E770E052699EDF28CF68C4517FEBBB2AF8571CF184119D865A7291CF349E48CB60
                        Function 02C0F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                        Download Yara Rule
                        Strings
                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 02C502E7
                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 02C502BD
                        • RTL: Re-Waiting, xrefs: 02C5031E
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID:
                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                        • API String ID: 0-2474120054
                        • Opcode ID: 72b8ef14b5122040cd4e993ab683b30fe5670e096b9e3ee25b0694fe5efa6de7
                        • Instruction ID: 79fa180465660878841194106c2c0dfd7fd6e851facc29497bb20dcf2d9476cc
                        • Opcode Fuzzy Hash: 72b8ef14b5122040cd4e993ab683b30fe5670e096b9e3ee25b0694fe5efa6de7
                        • Instruction Fuzzy Hash: CCE1BC706087419FD725CF28C884B2AB7E1BF88314F140A5DF9A5CB6E1DB74EA85CB46
                        Function 02C1BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                        Download Yara Rule
                        Strings
                        • RTL: Resource at %p, xrefs: 02C57B8E
                        • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 02C57B7F
                        • RTL: Re-Waiting, xrefs: 02C57BAC
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID:
                        • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                        • API String ID: 0-871070163
                        • Opcode ID: be7ab446882587201d1a85149ced54c3eca218878f6e3182d92ba3931ac61933
                        • Instruction ID: 814cf72f1f1ba9bf9612a6a9e55c05f11e0f926976f6fa55ce1062483944651e
                        • Opcode Fuzzy Hash: be7ab446882587201d1a85149ced54c3eca218878f6e3182d92ba3931ac61933
                        • Instruction Fuzzy Hash: F74102357007029FD720CE26C841B6AB7E6EF8A724F100A1DF95ADB680DB31E949DF91
                        Function 02C1B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                        Download Yara Rule
                        APIs
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C5728C
                        Strings
                        • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 02C57294
                        • RTL: Resource at %p, xrefs: 02C572A3
                        • RTL: Re-Waiting, xrefs: 02C572C1
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                        • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                        • API String ID: 885266447-605551621
                        • Opcode ID: 1b67a635e44697c40bd3997109bc1e66f7131cdf5aa38d1cda158067c512b2eb
                        • Instruction ID: 64f594660b6cfd41f92cc7fa3c51bf81ca17b472db601c3f1334a57acde0be80
                        • Opcode Fuzzy Hash: 1b67a635e44697c40bd3997109bc1e66f7131cdf5aa38d1cda158067c512b2eb
                        • Instruction Fuzzy Hash: 0C412231700212ABD721CE26CC42B6AB7A5FF95714F104618FD55EB640DB31E98ADFD4
                        Function 02C27D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID: __aulldvrm
                        • String ID: +$-
                        • API String ID: 1302938615-2137968064
                        • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                        • Instruction ID: f4d9383678b2b2c2592cf57a11ea4b687992527956744ef53f11905594655468
                        • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                        • Instruction Fuzzy Hash: 3591A170E042369FDB24DE69C8C16BEF7A5EF84724F14461AE855AB2C0DF319A4CCB61
                        Function 02BE9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.3916076692.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                        • Associated: 0000000C.00000002.3916076692.0000000002CD9000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002CDD000.00000040.00001000.00020000.00000000.sdmpDownload File
                        • Associated: 0000000C.00000002.3916076692.0000000002D4E000.00000040.00001000.00020000.00000000.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_2bb0000_findstr.jbxd
                        Similarity
                        • API ID:
                        • String ID: $$@
                        • API String ID: 0-1194432280
                        • Opcode ID: 7f11b188f1190dfc43b3f9e0e768fd9caf262d9d4ca9a9d70ba8f4b4f624e14c
                        • Instruction ID: 64a6b5db0ccb758eaec31f0521926113acec35c50ddd5cab642e7071d14171aa
                        • Opcode Fuzzy Hash: 7f11b188f1190dfc43b3f9e0e768fd9caf262d9d4ca9a9d70ba8f4b4f624e14c
                        • Instruction Fuzzy Hash: 26812C71D002699BDB35CB54CC45BEEB7B9AF48754F0041EAEA1AB7280D7309E84CFA5