Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe

Overview

General Information

Sample name:17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
Analysis ID:1528396
MD5:cb002b9fc6455e305288f91ee142f674
SHA1:3896fb2d9eb35a367faf2f12b11d01e2b97f6990
SHA256:fb4f2f626da581a9165a4c9f8a97bbcfaf2fee33f4710d4cd35f884dbe996439
Tags:base64-decodedexeuser-abuse_ch
Infos:

Detection

FormBook
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
One or more processes crash
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2cf13:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x164b2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2d113:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x166b2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeAvira: detected
      Multi AV Scanner detection for submitted file
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeReversingLabs: Detection: 63%
      Yara detected FormBook
      Source: Yara matchFile source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
      Machine Learning detection for sample
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeJoe Sandbox ML: detected
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: wntdll.pdbUGP source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
      Source: Amcache.hve.3.drString found in binary or memory: http://upx.sf.net

      E-Banking Fraud

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
      Source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F3B3D3 NtClose,0_2_00F3B3D3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F11961 NtProtectVirtualMemory,0_2_00F11961
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2DF0 NtQuerySystemInformation,LdrInitializeThunk,0_2_01AF2DF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF4340 NtSetContextThread,0_2_01AF4340
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF4650 NtSuspendThread,0_2_01AF4650
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2BA0 NtEnumerateValueKey,0_2_01AF2BA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2B80 NtQueryInformationFile,0_2_01AF2B80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2BE0 NtQueryValueKey,0_2_01AF2BE0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2BF0 NtAllocateVirtualMemory,0_2_01AF2BF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2B60 NtClose,0_2_01AF2B60
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2AB0 NtWaitForSingleObject,0_2_01AF2AB0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2AF0 NtWriteFile,0_2_01AF2AF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2AD0 NtReadFile,0_2_01AF2AD0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2DB0 NtEnumerateKey,0_2_01AF2DB0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2DD0 NtDelayExecution,0_2_01AF2DD0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2D30 NtUnmapViewOfSection,0_2_01AF2D30
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2D00 NtSetInformationFile,0_2_01AF2D00
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2D10 NtMapViewOfSection,0_2_01AF2D10
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2CA0 NtQueryInformationToken,0_2_01AF2CA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2CF0 NtOpenProcess,0_2_01AF2CF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2CC0 NtQueryVirtualMemory,0_2_01AF2CC0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2C00 NtQueryInformationProcess,0_2_01AF2C00
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2C60 NtCreateKey,0_2_01AF2C60
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2C70 NtFreeVirtualMemory,0_2_01AF2C70
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2FA0 NtQuerySection,0_2_01AF2FA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2FB0 NtResumeThread,0_2_01AF2FB0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2F90 NtProtectVirtualMemory,0_2_01AF2F90
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2FE0 NtCreateFile,0_2_01AF2FE0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2F30 NtCreateSection,0_2_01AF2F30
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2F60 NtCreateProcessEx,0_2_01AF2F60
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2EA0 NtAdjustPrivilegesToken,0_2_01AF2EA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2E80 NtReadVirtualMemory,0_2_01AF2E80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2EE0 NtQueueApcThread,0_2_01AF2EE0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2E30 NtWriteVirtualMemory,0_2_01AF2E30
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF3090 NtSetValueKey,0_2_01AF3090
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF3010 NtOpenDirectoryObject,0_2_01AF3010
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF35C0 NtCreateMutant,0_2_01AF35C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF39B0 NtGetContextThread,0_2_01AF39B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF3D10 NtOpenProcessToken,0_2_01AF3D10
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF3D70 NtOpenThread,0_2_01AF3D70
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F200F30_2_00F200F3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F130300_2_00F13030
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F268230_2_00F26823
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2681E0_2_00F2681E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F3D8030_2_00F3D803
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F111C00_2_00F111C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F1E1730_2_00F1E173
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F123800_2_00F12380
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F1FED30_2_00F1FED3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F1FECB0_2_00F1FECB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B801AA0_2_01B801AA
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B741A20_2_01B741A2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B781CC0_2_01B781CC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB01000_2_01AB0100
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5A1180_2_01B5A118
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B481580_2_01B48158
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B520000_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE3F00_2_01ACE3F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B803E60_2_01B803E6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7A3520_2_01B7A352
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B402C00_2_01B402C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B602740_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B805910_2_01B80591
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC05350_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6E4F60_2_01B6E4F6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B644200_2_01B64420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B724460_2_01B72446
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABC7C00_2_01ABC7C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC07700_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE47500_2_01AE4750
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADC6E00_2_01ADC6E0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A00_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B8A9A60_2_01B8A9A6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD69620_2_01AD6962
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA68B80_2_01AA68B8
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE8F00_2_01AEE8F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACA8400_2_01ACA840
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC28400_2_01AC2840
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B76BD70_2_01B76BD7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7AB400_2_01B7AB40
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA800_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD8DBF0_2_01AD8DBF
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABADE00_2_01ABADE0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5CD1F0_2_01B5CD1F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACAD000_2_01ACAD00
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60CB50_2_01B60CB5
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0CF20_2_01AB0CF2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0C000_2_01AC0C00
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3EFA00_2_01B3EFA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB2FC80_2_01AB2FC8
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B62F300_2_01B62F30
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B02F280_2_01B02F28
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE0F300_2_01AE0F30
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B34F400_2_01B34F40
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7CE930_2_01B7CE93
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2E900_2_01AD2E90
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7EEDB0_2_01B7EEDB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7EE260_2_01B7EE26
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0E590_2_01AC0E59
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACB1B00_2_01ACB1B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF516C0_2_01AF516C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B8B16B0_2_01B8B16B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAF1720_2_01AAF172
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7F0E00_2_01B7F0E0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B770E90_2_01B770E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC70C00_2_01AC70C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6F0CC0_2_01B6F0CC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B0739A0_2_01B0739A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7132D0_2_01B7132D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAD34C0_2_01AAD34C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC52A00_2_01AC52A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B612ED0_2_01B612ED
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADB2C00_2_01ADB2C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5D5B00_2_01B5D5B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B895C30_2_01B895C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B775710_2_01B77571
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7F43F0_2_01B7F43F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB14600_2_01AB1460
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7F7B00_2_01B7F7B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B716CC0_2_01B716CC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B056300_2_01B05630
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B559100_2_01B55910
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC99500_2_01AC9950
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADB9500_2_01ADB950
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC38E00_2_01AC38E0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2D8000_2_01B2D800
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADFB800_2_01ADFB80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B35BF00_2_01B35BF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AFDBF90_2_01AFDBF9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7FB760_2_01B7FB76
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B05AA00_2_01B05AA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B61AA30_2_01B61AA3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5DAAC0_2_01B5DAAC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6DAC60_2_01B6DAC6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B33A6C0_2_01B33A6C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B77A460_2_01B77A46
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7FA490_2_01B7FA49
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADFDC00_2_01ADFDC0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B77D730_2_01B77D73
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC3D400_2_01AC3D40
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B71D5A0_2_01B71D5A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7FCF20_2_01B7FCF2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B39C320_2_01B39C32
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7FFB10_2_01B7FFB1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC1F920_2_01AC1F92
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01A83FD20_2_01A83FD2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01A83FD50_2_01A83FD5
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7FF090_2_01B7FF09
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC9EB00_2_01AC9EB0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: String function: 01B07E54 appears 108 times
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: String function: 01AAB970 appears 265 times
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: String function: 01B2EA12 appears 86 times
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: String function: 01B3F290 appears 105 times
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: String function: 01AF5130 appears 58 times
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 228
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: No import functions for PE file found
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000019FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001D51000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001834000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
      Source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: Section .text
      Source: classification engineClassification label: mal80.troj.winEXE@2/5@0/0
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2664
      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\e637462d-74ae-412d-b6bf-cccfc9806afaJump to behavior
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeReversingLabs: Detection: 63%
      Source: unknownProcess created: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe "C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe"
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 228
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeSection loaded: apphelp.dllJump to behavior
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: wntdll.pdbUGP source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F12076 push ss; iretd 0_2_00F1207D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F33053 push 8BD62211h; retf 0_2_00F33068
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F132B0 push eax; ret 0_2_00F132B2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F1D236 push 0000001Dh; iretd 0_2_00F1D238
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F183F9 push ebx; ret 0_2_00F183FA
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2E3C5 push ss; iretd 0_2_00F2E3C6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2CB76 push ecx; ret 0_2_00F2CB7C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F184B0 push esi; iretd 0_2_00F18505
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2EC91 push ebx; iretd 0_2_00F2EC9F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2A441 push eax; ret 0_2_00F2A442
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2A43F push eax; iretd 0_2_00F2A440
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F11577 push ss; iretd 0_2_00F1158C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F2E57E push edi; retf 0_2_00F2E5A4
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F26D68 push ebp; retf 0_2_00F26D6D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F32EE3 push edi; ret 0_2_00F32EEE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F32ED8 push edi; ret 0_2_00F32EEE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F21683 push edi; ret 0_2_00F2168A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F21677 push edi; ret 0_2_00F2168A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F11E4B push ss; iretd 0_2_00F11E4D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F11793 push ss; iretd 0_2_00F11766
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F1175F push ss; iretd 0_2_00F11766
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F11731 push ss; iretd 0_2_00F11766
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F32F30 push edi; ret 0_2_00F32EEE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_00F32F07 push edi; ret 0_2_00F32F2D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01A8225F pushad ; ret 0_2_01A827F9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01A827FA pushad ; ret 0_2_01A827F9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB09AD push ecx; mov dword ptr [esp], ecx0_2_01AB09B6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01A8283D push eax; iretd 0_2_01A82858
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01A81368 push eax; iretd 0_2_01A81369
      Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeStatic PE information: section name: .text entropy: 7.994347427666436
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF096E rdtsc 0_2_01AF096E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeAPI coverage: 0.3 %
      Source: Amcache.hve.3.drBinary or memory string: VMware
      Source: Amcache.hve.3.drBinary or memory string: VMware Virtual USB Mouse
      Source: Amcache.hve.3.drBinary or memory string: vmci.syshbin
      Source: Amcache.hve.3.drBinary or memory string: VMware, Inc.
      Source: Amcache.hve.3.drBinary or memory string: VMware20,1hbin@
      Source: Amcache.hve.3.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
      Source: Amcache.hve.3.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
      Source: Amcache.hve.3.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
      Source: Amcache.hve.3.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
      Source: Amcache.hve.3.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
      Source: Amcache.hve.3.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
      Source: Amcache.hve.3.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
      Source: Amcache.hve.3.drBinary or memory string: vmci.sys
      Source: Amcache.hve.3.drBinary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
      Source: Amcache.hve.3.drBinary or memory string: vmci.syshbin`
      Source: Amcache.hve.3.drBinary or memory string: \driver\vmci,\driver\pci
      Source: Amcache.hve.3.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
      Source: Amcache.hve.3.drBinary or memory string: VMware20,1
      Source: Amcache.hve.3.drBinary or memory string: Microsoft Hyper-V Generation Counter
      Source: Amcache.hve.3.drBinary or memory string: NECVMWar VMware SATA CD00
      Source: Amcache.hve.3.drBinary or memory string: VMware Virtual disk SCSI Disk Device
      Source: Amcache.hve.3.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
      Source: Amcache.hve.3.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
      Source: Amcache.hve.3.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
      Source: Amcache.hve.3.drBinary or memory string: VMware PCI VMCI Bus Device
      Source: Amcache.hve.3.drBinary or memory string: VMware VMCI Bus Device
      Source: Amcache.hve.3.drBinary or memory string: VMware Virtual RAM
      Source: Amcache.hve.3.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
      Source: Amcache.hve.3.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeProcess queried: DebugPortJump to behavior
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeProcess queried: DebugPortJump to behavior
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF096E rdtsc 0_2_01AF096E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2DF0 NtQuerySystemInformation,LdrInitializeThunk,0_2_01AF2DF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF0185 mov eax, dword ptr fs:[00000030h]0_2_01AF0185
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h]0_2_01B3019F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h]0_2_01B3019F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h]0_2_01B3019F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h]0_2_01B3019F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B54180 mov eax, dword ptr fs:[00000030h]0_2_01B54180
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B54180 mov eax, dword ptr fs:[00000030h]0_2_01B54180
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAA197 mov eax, dword ptr fs:[00000030h]0_2_01AAA197
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAA197 mov eax, dword ptr fs:[00000030h]0_2_01AAA197
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAA197 mov eax, dword ptr fs:[00000030h]0_2_01AAA197
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6C188 mov eax, dword ptr fs:[00000030h]0_2_01B6C188
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6C188 mov eax, dword ptr fs:[00000030h]0_2_01B6C188
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE01F8 mov eax, dword ptr fs:[00000030h]0_2_01AE01F8
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B861E5 mov eax, dword ptr fs:[00000030h]0_2_01B861E5
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h]0_2_01B2E1D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h]0_2_01B2E1D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E1D0 mov ecx, dword ptr fs:[00000030h]0_2_01B2E1D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h]0_2_01B2E1D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h]0_2_01B2E1D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B761C3 mov eax, dword ptr fs:[00000030h]0_2_01B761C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B761C3 mov eax, dword ptr fs:[00000030h]0_2_01B761C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE0124 mov eax, dword ptr fs:[00000030h]0_2_01AE0124
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B70115 mov eax, dword ptr fs:[00000030h]0_2_01B70115
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5A118 mov ecx, dword ptr fs:[00000030h]0_2_01B5A118
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5A118 mov eax, dword ptr fs:[00000030h]0_2_01B5A118
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5A118 mov eax, dword ptr fs:[00000030h]0_2_01B5A118
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5A118 mov eax, dword ptr fs:[00000030h]0_2_01B5A118
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h]0_2_01B5E10E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84164 mov eax, dword ptr fs:[00000030h]0_2_01B84164
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84164 mov eax, dword ptr fs:[00000030h]0_2_01B84164
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B48158 mov eax, dword ptr fs:[00000030h]0_2_01B48158
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h]0_2_01B44144
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h]0_2_01B44144
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B44144 mov ecx, dword ptr fs:[00000030h]0_2_01B44144
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h]0_2_01B44144
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h]0_2_01B44144
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAC156 mov eax, dword ptr fs:[00000030h]0_2_01AAC156
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB6154 mov eax, dword ptr fs:[00000030h]0_2_01AB6154
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB6154 mov eax, dword ptr fs:[00000030h]0_2_01AB6154
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA80A0 mov eax, dword ptr fs:[00000030h]0_2_01AA80A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B760B8 mov eax, dword ptr fs:[00000030h]0_2_01B760B8
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B760B8 mov ecx, dword ptr fs:[00000030h]0_2_01B760B8
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B480A8 mov eax, dword ptr fs:[00000030h]0_2_01B480A8
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB208A mov eax, dword ptr fs:[00000030h]0_2_01AB208A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB80E9 mov eax, dword ptr fs:[00000030h]0_2_01AB80E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAA0E3 mov ecx, dword ptr fs:[00000030h]0_2_01AAA0E3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B360E0 mov eax, dword ptr fs:[00000030h]0_2_01B360E0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAC0F0 mov eax, dword ptr fs:[00000030h]0_2_01AAC0F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF20F0 mov ecx, dword ptr fs:[00000030h]0_2_01AF20F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B320DE mov eax, dword ptr fs:[00000030h]0_2_01B320DE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B46030 mov eax, dword ptr fs:[00000030h]0_2_01B46030
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAA020 mov eax, dword ptr fs:[00000030h]0_2_01AAA020
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAC020 mov eax, dword ptr fs:[00000030h]0_2_01AAC020
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B34000 mov ecx, dword ptr fs:[00000030h]0_2_01B34000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h]0_2_01B52000
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h]0_2_01ACE016
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h]0_2_01ACE016
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h]0_2_01ACE016
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h]0_2_01ACE016
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADC073 mov eax, dword ptr fs:[00000030h]0_2_01ADC073
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36050 mov eax, dword ptr fs:[00000030h]0_2_01B36050
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB2050 mov eax, dword ptr fs:[00000030h]0_2_01AB2050
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAE388 mov eax, dword ptr fs:[00000030h]0_2_01AAE388
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAE388 mov eax, dword ptr fs:[00000030h]0_2_01AAE388
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAE388 mov eax, dword ptr fs:[00000030h]0_2_01AAE388
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD438F mov eax, dword ptr fs:[00000030h]0_2_01AD438F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD438F mov eax, dword ptr fs:[00000030h]0_2_01AD438F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA8397 mov eax, dword ptr fs:[00000030h]0_2_01AA8397
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA8397 mov eax, dword ptr fs:[00000030h]0_2_01AA8397
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA8397 mov eax, dword ptr fs:[00000030h]0_2_01AA8397
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h]0_2_01AC03E9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE63FF mov eax, dword ptr fs:[00000030h]0_2_01AE63FF
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE3F0 mov eax, dword ptr fs:[00000030h]0_2_01ACE3F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE3F0 mov eax, dword ptr fs:[00000030h]0_2_01ACE3F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE3F0 mov eax, dword ptr fs:[00000030h]0_2_01ACE3F0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B543D4 mov eax, dword ptr fs:[00000030h]0_2_01B543D4
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B543D4 mov eax, dword ptr fs:[00000030h]0_2_01B543D4
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h]0_2_01ABA3C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h]0_2_01ABA3C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h]0_2_01ABA3C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h]0_2_01ABA3C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h]0_2_01ABA3C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h]0_2_01ABA3C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h]0_2_01AB83C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h]0_2_01AB83C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h]0_2_01AB83C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h]0_2_01AB83C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E3DB mov eax, dword ptr fs:[00000030h]0_2_01B5E3DB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E3DB mov eax, dword ptr fs:[00000030h]0_2_01B5E3DB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E3DB mov ecx, dword ptr fs:[00000030h]0_2_01B5E3DB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5E3DB mov eax, dword ptr fs:[00000030h]0_2_01B5E3DB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B363C0 mov eax, dword ptr fs:[00000030h]0_2_01B363C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6C3CD mov eax, dword ptr fs:[00000030h]0_2_01B6C3CD
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B88324 mov eax, dword ptr fs:[00000030h]0_2_01B88324
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B88324 mov ecx, dword ptr fs:[00000030h]0_2_01B88324
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B88324 mov eax, dword ptr fs:[00000030h]0_2_01B88324
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B88324 mov eax, dword ptr fs:[00000030h]0_2_01B88324
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA30B mov eax, dword ptr fs:[00000030h]0_2_01AEA30B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA30B mov eax, dword ptr fs:[00000030h]0_2_01AEA30B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA30B mov eax, dword ptr fs:[00000030h]0_2_01AEA30B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAC310 mov ecx, dword ptr fs:[00000030h]0_2_01AAC310
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD0310 mov ecx, dword ptr fs:[00000030h]0_2_01AD0310
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5437C mov eax, dword ptr fs:[00000030h]0_2_01B5437C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7A352 mov eax, dword ptr fs:[00000030h]0_2_01B7A352
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B58350 mov ecx, dword ptr fs:[00000030h]0_2_01B58350
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h]0_2_01B3035C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h]0_2_01B3035C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h]0_2_01B3035C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3035C mov ecx, dword ptr fs:[00000030h]0_2_01B3035C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h]0_2_01B3035C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h]0_2_01B3035C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B8634F mov eax, dword ptr fs:[00000030h]0_2_01B8634F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h]0_2_01B32349
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC02A0 mov eax, dword ptr fs:[00000030h]0_2_01AC02A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC02A0 mov eax, dword ptr fs:[00000030h]0_2_01AC02A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h]0_2_01B462A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B462A0 mov ecx, dword ptr fs:[00000030h]0_2_01B462A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h]0_2_01B462A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h]0_2_01B462A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h]0_2_01B462A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h]0_2_01B462A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE284 mov eax, dword ptr fs:[00000030h]0_2_01AEE284
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE284 mov eax, dword ptr fs:[00000030h]0_2_01AEE284
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B30283 mov eax, dword ptr fs:[00000030h]0_2_01B30283
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B30283 mov eax, dword ptr fs:[00000030h]0_2_01B30283
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B30283 mov eax, dword ptr fs:[00000030h]0_2_01B30283
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC02E1 mov eax, dword ptr fs:[00000030h]0_2_01AC02E1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC02E1 mov eax, dword ptr fs:[00000030h]0_2_01AC02E1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC02E1 mov eax, dword ptr fs:[00000030h]0_2_01AC02E1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h]0_2_01ABA2C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h]0_2_01ABA2C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h]0_2_01ABA2C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h]0_2_01ABA2C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h]0_2_01ABA2C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B862D6 mov eax, dword ptr fs:[00000030h]0_2_01B862D6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA823B mov eax, dword ptr fs:[00000030h]0_2_01AA823B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA826B mov eax, dword ptr fs:[00000030h]0_2_01AA826B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h]0_2_01B60274
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4260 mov eax, dword ptr fs:[00000030h]0_2_01AB4260
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4260 mov eax, dword ptr fs:[00000030h]0_2_01AB4260
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4260 mov eax, dword ptr fs:[00000030h]0_2_01AB4260
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B8625D mov eax, dword ptr fs:[00000030h]0_2_01B8625D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6A250 mov eax, dword ptr fs:[00000030h]0_2_01B6A250
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6A250 mov eax, dword ptr fs:[00000030h]0_2_01B6A250
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B38243 mov eax, dword ptr fs:[00000030h]0_2_01B38243
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B38243 mov ecx, dword ptr fs:[00000030h]0_2_01B38243
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB6259 mov eax, dword ptr fs:[00000030h]0_2_01AB6259
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAA250 mov eax, dword ptr fs:[00000030h]0_2_01AAA250
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B305A7 mov eax, dword ptr fs:[00000030h]0_2_01B305A7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B305A7 mov eax, dword ptr fs:[00000030h]0_2_01B305A7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B305A7 mov eax, dword ptr fs:[00000030h]0_2_01B305A7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD45B1 mov eax, dword ptr fs:[00000030h]0_2_01AD45B1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD45B1 mov eax, dword ptr fs:[00000030h]0_2_01AD45B1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE4588 mov eax, dword ptr fs:[00000030h]0_2_01AE4588
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB2582 mov eax, dword ptr fs:[00000030h]0_2_01AB2582
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB2582 mov ecx, dword ptr fs:[00000030h]0_2_01AB2582
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE59C mov eax, dword ptr fs:[00000030h]0_2_01AEE59C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC5ED mov eax, dword ptr fs:[00000030h]0_2_01AEC5ED
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC5ED mov eax, dword ptr fs:[00000030h]0_2_01AEC5ED
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h]0_2_01ADE5E7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB25E0 mov eax, dword ptr fs:[00000030h]0_2_01AB25E0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE5CF mov eax, dword ptr fs:[00000030h]0_2_01AEE5CF
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE5CF mov eax, dword ptr fs:[00000030h]0_2_01AEE5CF
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB65D0 mov eax, dword ptr fs:[00000030h]0_2_01AB65D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA5D0 mov eax, dword ptr fs:[00000030h]0_2_01AEA5D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA5D0 mov eax, dword ptr fs:[00000030h]0_2_01AEA5D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h]0_2_01ADE53E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h]0_2_01ADE53E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h]0_2_01ADE53E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h]0_2_01ADE53E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h]0_2_01ADE53E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h]0_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h]0_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h]0_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h]0_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h]0_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h]0_2_01AC0535
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B46500 mov eax, dword ptr fs:[00000030h]0_2_01B46500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h]0_2_01B84500
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE656A mov eax, dword ptr fs:[00000030h]0_2_01AE656A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE656A mov eax, dword ptr fs:[00000030h]0_2_01AE656A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE656A mov eax, dword ptr fs:[00000030h]0_2_01AE656A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8550 mov eax, dword ptr fs:[00000030h]0_2_01AB8550
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8550 mov eax, dword ptr fs:[00000030h]0_2_01AB8550
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB64AB mov eax, dword ptr fs:[00000030h]0_2_01AB64AB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3A4B0 mov eax, dword ptr fs:[00000030h]0_2_01B3A4B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE44B0 mov ecx, dword ptr fs:[00000030h]0_2_01AE44B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6A49A mov eax, dword ptr fs:[00000030h]0_2_01B6A49A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB04E5 mov ecx, dword ptr fs:[00000030h]0_2_01AB04E5
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAE420 mov eax, dword ptr fs:[00000030h]0_2_01AAE420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAE420 mov eax, dword ptr fs:[00000030h]0_2_01AAE420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAE420 mov eax, dword ptr fs:[00000030h]0_2_01AAE420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AAC427 mov eax, dword ptr fs:[00000030h]0_2_01AAC427
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h]0_2_01B36420
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA430 mov eax, dword ptr fs:[00000030h]0_2_01AEA430
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE8402 mov eax, dword ptr fs:[00000030h]0_2_01AE8402
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE8402 mov eax, dword ptr fs:[00000030h]0_2_01AE8402
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE8402 mov eax, dword ptr fs:[00000030h]0_2_01AE8402
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3C460 mov ecx, dword ptr fs:[00000030h]0_2_01B3C460
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADA470 mov eax, dword ptr fs:[00000030h]0_2_01ADA470
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADA470 mov eax, dword ptr fs:[00000030h]0_2_01ADA470
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADA470 mov eax, dword ptr fs:[00000030h]0_2_01ADA470
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B6A456 mov eax, dword ptr fs:[00000030h]0_2_01B6A456
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h]0_2_01AEE443
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA645D mov eax, dword ptr fs:[00000030h]0_2_01AA645D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD245A mov eax, dword ptr fs:[00000030h]0_2_01AD245A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB07AF mov eax, dword ptr fs:[00000030h]0_2_01AB07AF
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B647A0 mov eax, dword ptr fs:[00000030h]0_2_01B647A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5678E mov eax, dword ptr fs:[00000030h]0_2_01B5678E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD27ED mov eax, dword ptr fs:[00000030h]0_2_01AD27ED
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD27ED mov eax, dword ptr fs:[00000030h]0_2_01AD27ED
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD27ED mov eax, dword ptr fs:[00000030h]0_2_01AD27ED
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB47FB mov eax, dword ptr fs:[00000030h]0_2_01AB47FB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB47FB mov eax, dword ptr fs:[00000030h]0_2_01AB47FB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3E7E1 mov eax, dword ptr fs:[00000030h]0_2_01B3E7E1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABC7C0 mov eax, dword ptr fs:[00000030h]0_2_01ABC7C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B307C3 mov eax, dword ptr fs:[00000030h]0_2_01B307C3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2C730 mov eax, dword ptr fs:[00000030h]0_2_01B2C730
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC720 mov eax, dword ptr fs:[00000030h]0_2_01AEC720
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC720 mov eax, dword ptr fs:[00000030h]0_2_01AEC720
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE273C mov eax, dword ptr fs:[00000030h]0_2_01AE273C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE273C mov ecx, dword ptr fs:[00000030h]0_2_01AE273C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE273C mov eax, dword ptr fs:[00000030h]0_2_01AE273C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC700 mov eax, dword ptr fs:[00000030h]0_2_01AEC700
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0710 mov eax, dword ptr fs:[00000030h]0_2_01AB0710
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE0710 mov eax, dword ptr fs:[00000030h]0_2_01AE0710
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8770 mov eax, dword ptr fs:[00000030h]0_2_01AB8770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h]0_2_01AC0770
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE674D mov esi, dword ptr fs:[00000030h]0_2_01AE674D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE674D mov eax, dword ptr fs:[00000030h]0_2_01AE674D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE674D mov eax, dword ptr fs:[00000030h]0_2_01AE674D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B34755 mov eax, dword ptr fs:[00000030h]0_2_01B34755
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3E75D mov eax, dword ptr fs:[00000030h]0_2_01B3E75D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0750 mov eax, dword ptr fs:[00000030h]0_2_01AB0750
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2750 mov eax, dword ptr fs:[00000030h]0_2_01AF2750
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2750 mov eax, dword ptr fs:[00000030h]0_2_01AF2750
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC6A6 mov eax, dword ptr fs:[00000030h]0_2_01AEC6A6
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE66B0 mov eax, dword ptr fs:[00000030h]0_2_01AE66B0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4690 mov eax, dword ptr fs:[00000030h]0_2_01AB4690
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4690 mov eax, dword ptr fs:[00000030h]0_2_01AB4690
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h]0_2_01B2E6F2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h]0_2_01B2E6F2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h]0_2_01B2E6F2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h]0_2_01B2E6F2
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B306F1 mov eax, dword ptr fs:[00000030h]0_2_01B306F1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B306F1 mov eax, dword ptr fs:[00000030h]0_2_01B306F1
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA6C7 mov ebx, dword ptr fs:[00000030h]0_2_01AEA6C7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA6C7 mov eax, dword ptr fs:[00000030h]0_2_01AEA6C7
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB262C mov eax, dword ptr fs:[00000030h]0_2_01AB262C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACE627 mov eax, dword ptr fs:[00000030h]0_2_01ACE627
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE6620 mov eax, dword ptr fs:[00000030h]0_2_01AE6620
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE8620 mov eax, dword ptr fs:[00000030h]0_2_01AE8620
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h]0_2_01AC260B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF2619 mov eax, dword ptr fs:[00000030h]0_2_01AF2619
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E609 mov eax, dword ptr fs:[00000030h]0_2_01B2E609
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA660 mov eax, dword ptr fs:[00000030h]0_2_01AEA660
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA660 mov eax, dword ptr fs:[00000030h]0_2_01AEA660
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7866E mov eax, dword ptr fs:[00000030h]0_2_01B7866E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7866E mov eax, dword ptr fs:[00000030h]0_2_01B7866E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE2674 mov eax, dword ptr fs:[00000030h]0_2_01AE2674
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ACC640 mov eax, dword ptr fs:[00000030h]0_2_01ACC640
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B389B3 mov esi, dword ptr fs:[00000030h]0_2_01B389B3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B389B3 mov eax, dword ptr fs:[00000030h]0_2_01B389B3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B389B3 mov eax, dword ptr fs:[00000030h]0_2_01B389B3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB09AD mov eax, dword ptr fs:[00000030h]0_2_01AB09AD
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB09AD mov eax, dword ptr fs:[00000030h]0_2_01AB09AD
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h]0_2_01AC29A0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3E9E0 mov eax, dword ptr fs:[00000030h]0_2_01B3E9E0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE29F9 mov eax, dword ptr fs:[00000030h]0_2_01AE29F9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE29F9 mov eax, dword ptr fs:[00000030h]0_2_01AE29F9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7A9D3 mov eax, dword ptr fs:[00000030h]0_2_01B7A9D3
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B469C0 mov eax, dword ptr fs:[00000030h]0_2_01B469C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h]0_2_01ABA9D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h]0_2_01ABA9D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h]0_2_01ABA9D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h]0_2_01ABA9D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h]0_2_01ABA9D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h]0_2_01ABA9D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE49D0 mov eax, dword ptr fs:[00000030h]0_2_01AE49D0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3892A mov eax, dword ptr fs:[00000030h]0_2_01B3892A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B4892B mov eax, dword ptr fs:[00000030h]0_2_01B4892B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3C912 mov eax, dword ptr fs:[00000030h]0_2_01B3C912
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA8918 mov eax, dword ptr fs:[00000030h]0_2_01AA8918
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA8918 mov eax, dword ptr fs:[00000030h]0_2_01AA8918
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E908 mov eax, dword ptr fs:[00000030h]0_2_01B2E908
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2E908 mov eax, dword ptr fs:[00000030h]0_2_01B2E908
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF096E mov eax, dword ptr fs:[00000030h]0_2_01AF096E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF096E mov edx, dword ptr fs:[00000030h]0_2_01AF096E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AF096E mov eax, dword ptr fs:[00000030h]0_2_01AF096E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B54978 mov eax, dword ptr fs:[00000030h]0_2_01B54978
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B54978 mov eax, dword ptr fs:[00000030h]0_2_01B54978
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD6962 mov eax, dword ptr fs:[00000030h]0_2_01AD6962
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD6962 mov eax, dword ptr fs:[00000030h]0_2_01AD6962
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD6962 mov eax, dword ptr fs:[00000030h]0_2_01AD6962
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3C97C mov eax, dword ptr fs:[00000030h]0_2_01B3C97C
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B30946 mov eax, dword ptr fs:[00000030h]0_2_01B30946
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84940 mov eax, dword ptr fs:[00000030h]0_2_01B84940
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0887 mov eax, dword ptr fs:[00000030h]0_2_01AB0887
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3C89D mov eax, dword ptr fs:[00000030h]0_2_01B3C89D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7A8E4 mov eax, dword ptr fs:[00000030h]0_2_01B7A8E4
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC8F9 mov eax, dword ptr fs:[00000030h]0_2_01AEC8F9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEC8F9 mov eax, dword ptr fs:[00000030h]0_2_01AEC8F9
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADE8C0 mov eax, dword ptr fs:[00000030h]0_2_01ADE8C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B808C0 mov eax, dword ptr fs:[00000030h]0_2_01B808C0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5483A mov eax, dword ptr fs:[00000030h]0_2_01B5483A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5483A mov eax, dword ptr fs:[00000030h]0_2_01B5483A
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h]0_2_01AD2835
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h]0_2_01AD2835
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h]0_2_01AD2835
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2835 mov ecx, dword ptr fs:[00000030h]0_2_01AD2835
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h]0_2_01AD2835
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h]0_2_01AD2835
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEA830 mov eax, dword ptr fs:[00000030h]0_2_01AEA830
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3C810 mov eax, dword ptr fs:[00000030h]0_2_01B3C810
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3E872 mov eax, dword ptr fs:[00000030h]0_2_01B3E872
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3E872 mov eax, dword ptr fs:[00000030h]0_2_01B3E872
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B46870 mov eax, dword ptr fs:[00000030h]0_2_01B46870
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B46870 mov eax, dword ptr fs:[00000030h]0_2_01B46870
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC2840 mov ecx, dword ptr fs:[00000030h]0_2_01AC2840
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4859 mov eax, dword ptr fs:[00000030h]0_2_01AB4859
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB4859 mov eax, dword ptr fs:[00000030h]0_2_01AB4859
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE0854 mov eax, dword ptr fs:[00000030h]0_2_01AE0854
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B64BB0 mov eax, dword ptr fs:[00000030h]0_2_01B64BB0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B64BB0 mov eax, dword ptr fs:[00000030h]0_2_01B64BB0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0BBE mov eax, dword ptr fs:[00000030h]0_2_01AC0BBE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AC0BBE mov eax, dword ptr fs:[00000030h]0_2_01AC0BBE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3CBF0 mov eax, dword ptr fs:[00000030h]0_2_01B3CBF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADEBFC mov eax, dword ptr fs:[00000030h]0_2_01ADEBFC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8BF0 mov eax, dword ptr fs:[00000030h]0_2_01AB8BF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8BF0 mov eax, dword ptr fs:[00000030h]0_2_01AB8BF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8BF0 mov eax, dword ptr fs:[00000030h]0_2_01AB8BF0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5EBD0 mov eax, dword ptr fs:[00000030h]0_2_01B5EBD0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0BCD mov eax, dword ptr fs:[00000030h]0_2_01AB0BCD
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0BCD mov eax, dword ptr fs:[00000030h]0_2_01AB0BCD
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0BCD mov eax, dword ptr fs:[00000030h]0_2_01AB0BCD
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD0BCB mov eax, dword ptr fs:[00000030h]0_2_01AD0BCB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD0BCB mov eax, dword ptr fs:[00000030h]0_2_01AD0BCB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD0BCB mov eax, dword ptr fs:[00000030h]0_2_01AD0BCB
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADEB20 mov eax, dword ptr fs:[00000030h]0_2_01ADEB20
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADEB20 mov eax, dword ptr fs:[00000030h]0_2_01ADEB20
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B78B28 mov eax, dword ptr fs:[00000030h]0_2_01B78B28
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B78B28 mov eax, dword ptr fs:[00000030h]0_2_01B78B28
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h]0_2_01B2EB1D
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84B00 mov eax, dword ptr fs:[00000030h]0_2_01B84B00
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AACB7E mov eax, dword ptr fs:[00000030h]0_2_01AACB7E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B5EB50 mov eax, dword ptr fs:[00000030h]0_2_01B5EB50
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h]0_2_01B82B57
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h]0_2_01B82B57
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h]0_2_01B82B57
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h]0_2_01B82B57
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B46B40 mov eax, dword ptr fs:[00000030h]0_2_01B46B40
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B46B40 mov eax, dword ptr fs:[00000030h]0_2_01B46B40
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B7AB40 mov eax, dword ptr fs:[00000030h]0_2_01B7AB40
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B58B42 mov eax, dword ptr fs:[00000030h]0_2_01B58B42
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AA8B50 mov eax, dword ptr fs:[00000030h]0_2_01AA8B50
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B64B4B mov eax, dword ptr fs:[00000030h]0_2_01B64B4B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B64B4B mov eax, dword ptr fs:[00000030h]0_2_01B64B4B
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8AA0 mov eax, dword ptr fs:[00000030h]0_2_01AB8AA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB8AA0 mov eax, dword ptr fs:[00000030h]0_2_01AB8AA0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B06AA4 mov eax, dword ptr fs:[00000030h]0_2_01B06AA4
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h]0_2_01ABEA80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B84A80 mov eax, dword ptr fs:[00000030h]0_2_01B84A80
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE8A90 mov edx, dword ptr fs:[00000030h]0_2_01AE8A90
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEAAEE mov eax, dword ptr fs:[00000030h]0_2_01AEAAEE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AEAAEE mov eax, dword ptr fs:[00000030h]0_2_01AEAAEE
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AB0AD0 mov eax, dword ptr fs:[00000030h]0_2_01AB0AD0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B06ACC mov eax, dword ptr fs:[00000030h]0_2_01B06ACC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B06ACC mov eax, dword ptr fs:[00000030h]0_2_01B06ACC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B06ACC mov eax, dword ptr fs:[00000030h]0_2_01B06ACC
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE4AD0 mov eax, dword ptr fs:[00000030h]0_2_01AE4AD0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AE4AD0 mov eax, dword ptr fs:[00000030h]0_2_01AE4AD0
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01ADEA2E mov eax, dword ptr fs:[00000030h]0_2_01ADEA2E
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AECA24 mov eax, dword ptr fs:[00000030h]0_2_01AECA24
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AECA38 mov eax, dword ptr fs:[00000030h]0_2_01AECA38
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD4A35 mov eax, dword ptr fs:[00000030h]0_2_01AD4A35
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AD4A35 mov eax, dword ptr fs:[00000030h]0_2_01AD4A35
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B3CA11 mov eax, dword ptr fs:[00000030h]0_2_01B3CA11
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2CA72 mov eax, dword ptr fs:[00000030h]0_2_01B2CA72
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01B2CA72 mov eax, dword ptr fs:[00000030h]0_2_01B2CA72
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AECA6F mov eax, dword ptr fs:[00000030h]0_2_01AECA6F
      Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exeCode function: 0_2_01AECA6F mov eax, dword ptr fs:[00000030h]0_2_01AECA6F
      Source: Amcache.hve.3.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
      Source: Amcache.hve.3.drBinary or memory string: msmpeng.exe
      Source: Amcache.hve.3.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
      Source: Amcache.hve.3.drBinary or memory string: MsMpEng.exe

      Stealing of Sensitive Information

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
      DLL Side-Loading      		1
      Process Injection      		1
      Virtualization/Sandbox Evasion      		OS Credential Dumping31
      Security Software Discovery      		Remote Services1
      Archive Collected Data      		1
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
      DLL Side-Loading      		2
      Software Packing      		LSASS Memory1
      Virtualization/Sandbox Evasion      		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
      Process Injection      		Security Account Manager1
      Process Discovery      		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
      Deobfuscate/Decode Files or Information      		NTDS1
      System Information Discovery      		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
      DLL Side-Loading      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
      Obfuscated Files or Information      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe63%ReversingLabsWin32.Backdoor.FormBook
      17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe100%AviraTR/Crypt.ZPACK.Gen
      17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe100%Joe Sandbox ML

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://upx.sf.net0%URL Reputationsafe

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netAmcache.hve.3.drfalse
      • URL Reputation: safe
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1528396
      Start date and time:2024-10-07 21:54:07 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 5m 6s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:8
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
      Detection:MAL
      Classification:mal80.troj.winEXE@2/5@0/0
      EGA Information:
      • Successful, ratio: 100%
      HCA Information:
      • Successful, ratio: 88%
      • Number of executed functions: 5
      • Number of non-executed functions: 338
      Cookbook Comments:
      • Found application associated with file extension: .exe

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 20.42.73.29
      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
      • Not all processes where analyzed, report is missing behavior information
      • Report size exceeded maximum capacity and may have missing disassembly code.
      • VT rate limit hit for: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe

      Simulations

      Behavior and APIs

      TimeTypeDescription
      15:55:30API Interceptor1x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_17283307843512dd_f9fe3f1f1e94486b2f576f19d4787792f5ebeb4_c6a5d8df_b60491c4-c368-43a6-ad9e-7c62a9c6c501\Report.wer

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):65536
      Entropy (8bit):0.7192464669204144
      Encrypted:false
      SSDEEP:96:icFuOqhqXwhlTGqY4qU5shqahBhqg7sf2QXIDcQvc6QcEVcw3cE/GqUql+HbHg6E:rEVsEl4u5n0BU/gjEzuiFgZ24IO83
      MD5:30FEE89C4E3F63029708DDB3444AB7B3
      SHA1:FADC56E108B4C0FB1817E600F3C3830D16BA7E79
      SHA-256:62ADB0D44D5B6DC6BBD59A824FF3577348498C3B540AAE01602DFF80A7C0D2DB
      SHA-512:1F6D2599FC060A98DC8B46319D6208B3B17CDC5CD7923CAED699A4170774D61BCD81C5635EE3BD321359DAA7F4ADA5F6FAAC7F2ED016485FEA0F54E6C46C5B76
      Malicious:false
      Reputation:low
      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.4.5.1.4.8.8.5.7.2.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.4.5.1.5.1.5.1.3.4.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.0.4.9.1.c.4.-.c.3.6.8.-.4.3.a.6.-.a.d.9.e.-.7.c.6.2.a.9.c.6.c.5.0.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.d.9.c.3.8.9.-.0.b.6.a.-.4.f.8.9.-.b.5.e.5.-.7.9.9.3.e.a.d.6.7.1.c.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.7.2.8.3.3.0.7.8.4.3.5.1.2.d.d.b.9.d.a.5.f.e.b.0.6.5.e.9.e.5.1.f.4.3.0.0.1.4.9.7.1.3.7.6.a.6.3.e.3.0.9.c.8.4.9.f.0.5.d.5.e.b.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.6.8.-.0.0.0.1.-.0.0.1.4.-.9.1.c.9.-.5.0.c.e.f.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.6.4.f.5.3.3.7.6.0.5.e.e.8.a.2.3.c.0.d.0.e.f.9.0.9.c.0.9.8.0.a.0.0.0.0.f.f.f.f.!.0.0.0.0.3.8.9.6.f.b.2.d.9.e.b.3.5.a.3.6.

      C:\ProgramData\Microsoft\Windows\WER\Temp\WERC59E.tmp.dmp

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:Mini DuMP crash report, 14 streams, Mon Oct 7 19:55:14 2024, 0x1205a4 type
      Category:dropped
      Size (bytes):25490
      Entropy (8bit):1.776014698446611
      Encrypted:false
      SSDEEP:96:5c8noo6FzRbP6UT8Kq+i7naA3yESMwF6nMcbWsjf+oWItWIfsIZKnBSx:dwOFmODiEOFmMcbpBKnBG
      MD5:4F63B5D7D648F218CF2EA2F9D80878E0
      SHA1:EC67F18B7B74F47F6B49BCFB61E9FC38A1DF78EF
      SHA-256:8ADEE6892E1E83B77A12953722B1A89104AF0496174D2501820500DEC57D683C
      SHA-512:33C9EBACFAB2682198FC7AB00F11EAB08C28C7429F5A0368AE2F2D678E247DB16A698265277FBBF55A794E7F92866F7D76A76127D7CF9BE82CB89D41B60756A0
      Malicious:false
      Reputation:low
      Preview:MDMP..a..... ........<.g............4...............<...........<...........T.......8...........T...........p..."Z......................................................................................................eJ......L.......GenuineIntel............T.......h....<.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5ED.tmp.WERInternalMetadata.xml

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):8660
      Entropy (8bit):3.70397779273273
      Encrypted:false
      SSDEEP:192:R6l7wVeJSG6ZRe6Y9/SU9pKgmfdzprt89bdssf9VR/m:R6lXJD6m6Y1SU9pKgmfdEd/f3U
      MD5:DF402293730532460BBCE2B445C5A2B3
      SHA1:1A4AEB8EB3BC2F51EBBF90176A58A9F41880B65C
      SHA-256:755D59A453EDCDDE2A95C9E0ECA86B3B9E4DB45BCB2CE74A990E6C45FEDFEEA7
      SHA-512:A1E94AA99BEBFE5A0D5BD18ABAD918B69D8B227AC920127DFD7E215DF35C4809F8DECAC30D15A9811D16959CE641564D67C835A8BE4EDFAF61E0A7CA29573218
      Malicious:false
      Reputation:low
      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.6.4.<./.P.i.

      C:\ProgramData\Microsoft\Windows\WER\Temp\WERC60D.tmp.xml

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):4987
      Entropy (8bit):4.586801287295991
      Encrypted:false
      SSDEEP:48:cvIwWl8zsZJg77aI9wbWpW8VYHPYm8M4JVfsk7FQ+q84lJ/ibPZCNCad:uIjfrI7+q7VKSJKZKPYcad
      MD5:E85D20C2E183677262A87790CA151C1F
      SHA1:EA19F816834B4A6E7DC52478F8B015AE9CB8A8EA
      SHA-256:16D7726DA4BF5AFA2E56ABEB99E086D2499C09E7A8709BA44C3EC1D9C5CFE1B3
      SHA-512:B7D33DBA0C9FEA89E9FE6EDDB6018123EB6094DBFDA92E96FA66059DA06E968ACD4BD22DB6E99AC026FEF7B9DC5E4B8923755CEAE91FC5B863CE78EB065580AF
      Malicious:false
      Reputation:low
      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533457" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

      C:\Windows\appcompat\Programs\Amcache.hve

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:MS Windows registry file, NT/2000 or above
      Category:dropped
      Size (bytes):1835008
      Entropy (8bit):4.4659876319784475
      Encrypted:false
      SSDEEP:6144:6IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNTdwBCswSb4:PXD94+WlLZMM6YFHZ+4
      MD5:0E2F8B15070325F850DD5A054EDB9A82
      SHA1:660AF24CDC11DE3CDEED862E145210692D9C35FF
      SHA-256:2AA826B23F7E0535C04101EBC6B90A15A1A2F8DB58B590A43715284CF244B445
      SHA-512:2D121FDCEC38BF222FC49065F0125BD5C58F3AA68A365B5E690EB01DFE5AB9DF80B851C5DBE7FB61CE91F66AB15E78E8B48BF58DC878CE5D513F272F4BAAFDD3
      Malicious:false
      Reputation:low
      Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.G.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):7.960355957692939
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.98%
      • DOS Executable Generic (2002/1) 0.02%
      File name:17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
      File size:271'872 bytes
      MD5:cb002b9fc6455e305288f91ee142f674
      SHA1:3896fb2d9eb35a367faf2f12b11d01e2b97f6990
      SHA256:fb4f2f626da581a9165a4c9f8a97bbcfaf2fee33f4710d4cd35f884dbe996439
      SHA512:a12f1e5bc36889795606523cd362d6d168f67bfe3dcd4b443d3517dfb57a3d2935f8f7851998e147ebc410398cd367a4c573a1973d875cd13982728ff8ecf60b
      SSDEEP:6144:Fx7ig1V3zYyj7vtXc3F9zWr9aC568Mx1zBwV9Wku3sgHmyK:j7b/3zdXtXaqrYz8MxofWAgHmyK
      TLSH:6044239F9921B0AFD67E8771605FB20E474D5BECB45487221EE87CA3F1E4AC05025F92
      File Content Preview:MZER.....X.......<......(...............................................!..L.!This program cannot be run in DOS mode....$.......y...=`g.=`g.=`g.....:`g.....<`g.....<`g.Rich=`g.........PE..L......Y............................p........0....@................

      File Icon

      Icon Hash:90cececece8e8eb0

      Static PE Info

      General

      Entrypoint:0x401470
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Time Stamp:0x59841B8F [Fri Aug 4 07:00:31 2017 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:6
      OS Version Minor:0
      File Version Major:6
      File Version Minor:0
      Subsystem Version Major:6
      Subsystem Version Minor:0
      Import Hash:

      Entrypoint Preview

      Instruction
      push ebp
      mov ebp, esp
      sub esp, 0000040Ch
      push ebx
      push esi
      push edi
      push 000003E8h
      lea eax, dword ptr [ebp-00000408h]
      push 00000000h
      push eax
      mov dword ptr [ebp-0000040Ch], 00000000h
      call 00007F85E0B6818Ch
      xor ebx, ebx
      add esp, 0Ch
      xor edi, edi
      mov eax, 0000008Fh
      mov dword ptr [ebp-18h], 00002D3Ah
      mov dword ptr [ebp-1Ch], ebx
      mov dword ptr [ebp-10h], 00000BDFh
      xor esi, esi
      mov dword ptr [ebp-20h], 00002EE8h
      mov dword ptr [ebp-08h], 00000870h
      mov dword ptr [ebp-0Ch], 00005D98h
      mov dword ptr [ebp-14h], 000067BEh
      mov dword ptr [ebp-04h], 00004E37h
      mov ecx, 00006002h
      mov edx, 00000009h
      cmp eax, 09h
      cmovnle eax, edx
      dec ecx
      jne 00007F85E0B66629h
      call 00007F85E0B683F2h
      mov dword ptr [ebp-000003F8h], eax
      mov ecx, 000012E8h
      mov edi, edi
      mov eax, 92492493h
      imul ecx
      add edx, ecx
      sar edx, 02h
      mov ecx, edx
      shr ecx, 1Fh
      add ecx, edx
      jne 00007F85E0B6661Dh
      lea eax, dword ptr [ebp-00000208h]
      push eax
      push 00003C80h
      call 00007F85E0B662CFh
      lea eax, dword ptr [ebp-000003D8h]
      push eax
      push 00006ACCh
      call 00007F85E0B662BEh

      Rich Headers

      Programming Language:
      • [C++] VS2012 build 50727
      • [ASM] VS2012 build 50727
      • [LNK] VS2012 build 50727

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x412b40x4140031943ae4401e36a3330af6033a10a105False0.988767660440613data7.994347427666436IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

      Network Behavior

      ⊘No network behavior found

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      High Level Behavior Distribution

      Click to dive into process behavior distribution

      Behavior

      Click to jump to process

      System Behavior

      General

      Target ID:0
      Start time:15:55:06
      Start date:07/10/2024
      Path:C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
      Wow64 process (32bit):true
      Commandline:"C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe"
      Imagebase:0xf10000
      File size:271'872 bytes
      MD5 hash:CB002B9FC6455E305288F91EE142F674
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Yara matches:
      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
      Reputation:low
      Has exited:true

      General

      Target ID:3
      Start time:15:55:14
      Start date:07/10/2024
      Path:C:\Windows\SysWOW64\WerFault.exe
      Wow64 process (32bit):true
      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 228
      Imagebase:0xee0000
      File size:483'680 bytes
      MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      Disassembly

      Reset < >

        Execution Graph

        Execution Coverage:0.5%
        Dynamic/Decrypted Code Coverage:6%
        Signature Coverage:6%
        Total number of Nodes:67
        Total number of Limit Nodes:8
        execution_graph 94856 f3a9f3 94857 f3aa0d 94856->94857 94860 1af2df0 LdrInitializeThunk 94857->94860 94858 f3aa35 94860->94858 94861 f34553 94862 f34562 94861->94862 94863 f345a6 94862->94863 94866 f345e7 94862->94866 94868 f345ec 94862->94868 94869 f3d2a3 94863->94869 94867 f3d2a3 RtlFreeHeap 94866->94867 94867->94868 94872 f3b733 94869->94872 94871 f345b6 94873 f3b750 94872->94873 94874 f3b761 RtlFreeHeap 94873->94874 94874->94871 94901 f3e3e3 94902 f3d2a3 RtlFreeHeap 94901->94902 94903 f3e3f8 94902->94903 94904 f341c3 94905 f341df 94904->94905 94906 f34207 94905->94906 94907 f3421b 94905->94907 94908 f3b3d3 NtClose 94906->94908 94914 f3b3d3 94907->94914 94910 f34210 94908->94910 94911 f34224 94917 f3d3c3 RtlAllocateHeap 94911->94917 94913 f3422f 94915 f3b3f0 94914->94915 94916 f3b401 NtClose 94915->94916 94916->94911 94917->94913 94918 f3e383 94919 f3e393 94918->94919 94920 f3e399 94918->94920 94923 f3d383 94920->94923 94922 f3e3bf 94926 f3b6e3 94923->94926 94925 f3d39e 94925->94922 94927 f3b6fd 94926->94927 94928 f3b70e RtlAllocateHeap 94927->94928 94928->94925 94875 f26573 94881 f3be13 94875->94881 94877 f26533 94878 f26584 94878->94877 94888 f38093 94878->94888 94880 f265aa 94883 f3be2b 94881->94883 94882 f3be4f 94882->94878 94883->94882 94893 f3aa43 94883->94893 94886 f3d2a3 RtlFreeHeap 94887 f3bebd 94886->94887 94887->94878 94889 f380f0 94888->94889 94890 f3811b 94889->94890 94900 f26183 NtClose 94889->94900 94890->94880 94892 f380fd 94892->94880 94894 f3aa5d 94893->94894 94897 1af2c0a 94894->94897 94895 f3aa89 94895->94886 94898 1af2c1f LdrInitializeThunk 94897->94898 94899 1af2c11 94897->94899 94898->94895 94899->94895 94900->94892 94929 f11a49 94930 f11a50 94929->94930 94930->94930 94933 f3e843 94930->94933 94936 f3ce93 94933->94936 94935 f11b28 94937 f3ceb9 94936->94937 94939 f3ceee 94937->94939 94940 f2ac53 NtClose 94937->94940 94939->94935 94940->94939

        Executed Functions

        Function 00F3B3D3 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
        Download Yara Rule

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 90 f3b3d3-f3b40f call f14753 call f3c473 NtClose
        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID: Close
        • String ID:
        • API String ID: 3535843008-0
        • Opcode ID: 9f2ecb86485d10f6183161808962557c7b6deeff54ed9a76d0c1a3f7529a8491
        • Instruction ID: 00aa414bcef0d5d6216f0c5dd54857ba5096ac94ff672c18f2f51cfe2bc7aca5
        • Opcode Fuzzy Hash: 9f2ecb86485d10f6183161808962557c7b6deeff54ed9a76d0c1a3f7529a8491
        • Instruction Fuzzy Hash: B1E086312012047BD210EA59DC41FDB775DDFC6754F004415FA196B181C775BA0187F1
        Function 01AF2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
        Download Yara Rule

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 99 1af2df0-1af2dfc LdrInitializeThunk
        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: InitializeThunk
        • String ID:
        • API String ID: 2994545307-0
        • Opcode ID: e4ff844f74eb8889034fac977234c54372e0a7f8f8c16d5f7045a14561317ec9
        • Instruction ID: 4625fd114ce2645afef411ebfb12b3f7908b2250e060b89d6289273c21162be5
        • Opcode Fuzzy Hash: e4ff844f74eb8889034fac977234c54372e0a7f8f8c16d5f7045a14561317ec9
        • Instruction Fuzzy Hash: 5E90023260180453D11671584504707040997D0281F95C452A042459DDD7568B92A221
        Function 00F3B6E3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
        Download Yara Rule

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 80 f3b6e3-f3b724 call f14753 call f3c473 RtlAllocateHeap
        APIs
        • RtlAllocateHeap.NTDLL(?,00F2E01B,?,?,00000000,?,00F2E01B,?,?,?), ref: 00F3B71F
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID: AllocateHeap
        • String ID:
        • API String ID: 1279760036-0
        • Opcode ID: 1689e4bd67f72f39f0ddbcbffc393cafcfb1b5d5f095b9b0021a765bbfb41908
        • Instruction ID: 879d3471bc31391cde4f1453896cd9e3380d911db3462a31b0a7494381ea30d5
        • Opcode Fuzzy Hash: 1689e4bd67f72f39f0ddbcbffc393cafcfb1b5d5f095b9b0021a765bbfb41908
        • Instruction Fuzzy Hash: 9DE092B12002047BD610EE59DC41FEB77ACDFC5710F004419FA19A7242D670B9118BB5
        Function 00F3B733 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
        Download Yara Rule

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 85 f3b733-f3b777 call f14753 call f3c473 RtlFreeHeap
        APIs
        • RtlFreeHeap.NTDLL(00F21FCF,?,00F21FCF,?,00000000,00F21FCF,?,00F21FCF,?,?), ref: 00F3B772
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID: FreeHeap
        • String ID:
        • API String ID: 3298025750-0
        • Opcode ID: 49ed3abd4220ba25f89d9cf8b9d79e782464d8ce8c00592e10888f11586d478b
        • Instruction ID: daeda030aa8fe590f200fdcd418d7b07f5142dfb423b34841ba515fbe4e0746c
        • Opcode Fuzzy Hash: 49ed3abd4220ba25f89d9cf8b9d79e782464d8ce8c00592e10888f11586d478b
        • Instruction Fuzzy Hash: D2E0EDB5244204BBD614EF59EC45EAB77ACDFC9750F004459FA18A7242DA70B9108BB5
        Function 01AF2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
        Download Yara Rule

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 95 1af2c0a-1af2c0f 96 1af2c1f-1af2c26 LdrInitializeThunk 95->96 97 1af2c11-1af2c18 95->97
        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: InitializeThunk
        • String ID:
        • API String ID: 2994545307-0
        • Opcode ID: 4293b01e6a8cf9ddca5b47cec5957ec832de4092bc543dbd5c5989e81f0dd20f
        • Instruction ID: 50d04c62b374d11386772dcbafa7f41cb499096691ee4a25885e43abf00dbcb7
        • Opcode Fuzzy Hash: 4293b01e6a8cf9ddca5b47cec5957ec832de4092bc543dbd5c5989e81f0dd20f
        • Instruction Fuzzy Hash: E3B09B72D019C5C5DA16E7A446087177D00B7D0741F15C076E3030686F8738C5D1E275

        Non-executed Functions

        Function 01B32349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
        • API String ID: 0-2160512332
        • Opcode ID: 3831a6bfc5c4c1c82aad8308684bb770ba3b6fa275eb46452ba804d30a3f38bb
        • Instruction ID: 0e5cecdd8e18366f84e3e6fcdcd8d9599f797bbb638b21996633f4f8360501a5
        • Opcode Fuzzy Hash: 3831a6bfc5c4c1c82aad8308684bb770ba3b6fa275eb46452ba804d30a3f38bb
        • Instruction Fuzzy Hash: EF928D71608742AFE729DE29C880B6BB7E8FF84750F0449ADFA94D7250D770E854CB92
        Function 01AA68B8 Relevance: 19.0, Strings: 15, Instructions: 249COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: ApphelpCheckModule$Could not locate procedure "%s" in the shim engine DLL$LdrpGetShimEngineInterface$SE_DllLoaded$SE_DllUnloaded$SE_GetProcAddressForCaller$SE_InitializeEngine$SE_InstallAfterInit$SE_InstallBeforeInit$SE_LdrEntryRemoved$SE_LdrResolveDllName$SE_ProcessDying$SE_ShimDllLoaded$apphelp.dll$minkernel\ntdll\ldrinit.c
        • API String ID: 0-3089669407
        • Opcode ID: ec36ef6ab350fa20b8e4ae699089f9a0bdeb87d8684cd73c6093f5d402ce6ad7
        • Instruction ID: f41cef8f283e71c9f62a9f60eb865ae566aa15e777b2c683ca78f5774c338c18
        • Opcode Fuzzy Hash: ec36ef6ab350fa20b8e4ae699089f9a0bdeb87d8684cd73c6093f5d402ce6ad7
        • Instruction Fuzzy Hash: 958143B2D122197F9B25FAD4DDC1EEE7BBDAB086107844466FA14F7114E730DE058BA0
        Function 01B55910 Relevance: 18.5, Strings: 14, Instructions: 963COMMON
        Download Yara Rule
        Strings
        • PreferredUILanguagesPending, xrefs: 01B561D2
        • PreferredUILanguages, xrefs: 01B563D1
        • LanguageConfiguration, xrefs: 01B56420
        • Control Panel\Desktop, xrefs: 01B5615E
        • InstallLanguageFallback, xrefs: 01B56050
        • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlpSetPreferredUILanguages is not a valid multi-string!, xrefs: 01B55A84
        • @, xrefs: 01B56277
        • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 01B55FE1
        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 01B5635D
        • @, xrefs: 01B56027
        • LanguageConfigurationPending, xrefs: 01B56221
        • @, xrefs: 01B5647A
        • @, xrefs: 01B563A0
        • @, xrefs: 01B561B0
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlpSetPreferredUILanguages is not a valid multi-string!$@$@$@$@$@$Control Panel\Desktop$InstallLanguageFallback$LanguageConfiguration$LanguageConfigurationPending$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
        • API String ID: 0-1325123933
        • Opcode ID: 37a890226ef3c4f44d6931e3645de94ec024e291483649c15618063abe833aaa
        • Instruction ID: f28a29a8a3668bf36a6228f623ee205ca9c542e5fb7af1bfa27c60f4b9594d1b
        • Opcode Fuzzy Hash: 37a890226ef3c4f44d6931e3645de94ec024e291483649c15618063abe833aaa
        • Instruction Fuzzy Hash: F5727A715083419BD7A9DF68C880B6BBBE9FF88704F44496DFA85D7250EB34E805CB52
        Function 01AE8620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
        Download Yara Rule
        Strings
        • double initialized or corrupted critical section, xrefs: 01B25508
        • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 01B2540A, 01B25496, 01B25519
        • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 01B254E2
        • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 01B254CE
        • Invalid debug info address of this critical section, xrefs: 01B254B6
        • Address of the debug info found in the active list., xrefs: 01B254AE, 01B254FA
        • 8, xrefs: 01B252E3
        • Critical section address, xrefs: 01B25425, 01B254BC, 01B25534
        • Thread identifier, xrefs: 01B2553A
        • Critical section address., xrefs: 01B25502
        • Critical section debug info address, xrefs: 01B2541F, 01B2552E
        • corrupted critical section, xrefs: 01B254C2
        • Thread is in a state in which it cannot own a critical section, xrefs: 01B25543
        • undeleted critical section in freed memory, xrefs: 01B2542B
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
        • API String ID: 0-2368682639
        • Opcode ID: 987cef01669a52191d287115a770f3233426c8590437544d3b0df089f19d24a6
        • Instruction ID: 0457984c24a7c56d01f75ba2d983e1259b2e966d66469f8043b67aaa25fdcfaf
        • Opcode Fuzzy Hash: 987cef01669a52191d287115a770f3233426c8590437544d3b0df089f19d24a6
        • Instruction Fuzzy Hash: F58178B0A00358AFDF24CF99C945BAEBBF5FB49714F104159E508BB281D379A985CBA0
        Function 01AE29F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
        Download Yara Rule
        Strings
        • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01B22624
        • @, xrefs: 01B2259B
        • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01B22409
        • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01B22498
        • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 01B222E4
        • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01B22506
        • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01B22412
        • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 01B225EB
        • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 01B224C0
        • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01B22602
        • RtlpResolveAssemblyStorageMapEntry, xrefs: 01B2261F
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
        • API String ID: 0-4009184096
        • Opcode ID: 50ae7d04bf3adf37081695f30500e35bbbc019dc20ba0cd6c57a3204c34b1c6c
        • Instruction ID: 84dfca48ae304f06bdc26687896972f9ec178eda957ea46a0714099b70197fb4
        • Opcode Fuzzy Hash: 50ae7d04bf3adf37081695f30500e35bbbc019dc20ba0cd6c57a3204c34b1c6c
        • Instruction Fuzzy Hash: 74027FF1D002299BDB35DB54CD84BAAB7B8AF54304F4441DAE70DA7241DB309E98CF69
        Function 01AE0F30 Relevance: 13.3, Strings: 10, Instructions: 764COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: $!$%$%%%u$%%%u!%s!$0$9$h$l$w
        • API String ID: 0-360209818
        • Opcode ID: 5baa9a9edeaa972c38479157040c2cb82148a3d04320e470c85a781a9bc5552a
        • Instruction ID: 686aea4d542a2f545110feda4927eda6af413cd0f7ed462c0526a0d3f769ce9e
        • Opcode Fuzzy Hash: 5baa9a9edeaa972c38479157040c2cb82148a3d04320e470c85a781a9bc5552a
        • Instruction Fuzzy Hash: 1E628DB1A002299FDB38CF1CC8417A9BBB6EF95320F5582DAE54DAB240D7725AD5CF40
        Function 01B58B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
        • API String ID: 0-2515994595
        • Opcode ID: 620a987057407e7d129268f9010985e6604f47d844f3b0aeaa755a571b7e79f1
        • Instruction ID: d518d478a49a2db48b77fe84cce2bb5907f080492001ef4c1ab78992bb24b833
        • Opcode Fuzzy Hash: 620a987057407e7d129268f9010985e6604f47d844f3b0aeaa755a571b7e79f1
        • Instruction Fuzzy Hash: 4B51F0715143019BD36ADF5A8984BABBBECFF94640F240A5DFE99C3280E770D644CB92
        Function 01B612ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
        • API String ID: 0-3591852110
        • Opcode ID: 379f7f9923fbc4bcdb970bb8517668d7738e4c30f6406cddf8a27b17101fe842
        • Instruction ID: 5330cc1c05f9c14f1e9b2578470906268e9690e3df767900cca1d4178d0b65ad
        • Opcode Fuzzy Hash: 379f7f9923fbc4bcdb970bb8517668d7738e4c30f6406cddf8a27b17101fe842
        • Instruction Fuzzy Hash: D112C234600642EFDB29DF2DC441BBABBF9FF65714F088599E5868B651D738E880CB50
        Function 01ACAD00 Relevance: 11.8, Strings: 9, Instructions: 509COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: DLL name: %wZ$DLL search path passed in externally: %ws$LdrGetDllHandleEx$LdrpFindLoadedDllInternal$LdrpInitializeDllPath$Status: 0x%08lx$minkernel\ntdll\ldrapi.c$minkernel\ntdll\ldrfind.c$minkernel\ntdll\ldrutil.c
        • API String ID: 0-3197712848
        • Opcode ID: 9d68973114824dd6f14050242940344b3d69d66020e78556ae0144c222b08d9a
        • Instruction ID: f82c13b8f6705f64ea9c721819c31ff5f62ff3ce20e95afc7a55bef7acd0147d
        • Opcode Fuzzy Hash: 9d68973114824dd6f14050242940344b3d69d66020e78556ae0144c222b08d9a
        • Instruction Fuzzy Hash: 6A1235B16083568FD725DF28C881BBAB7E0FF84B14F49495DF9898B291E730D944CB92
        Function 01AAD34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
        • API String ID: 0-3532704233
        • Opcode ID: b72bbd7d823bbc4cf2c482247fc459c400801af99fc2cc9620fcce74482d5a1b
        • Instruction ID: 694d0c051cbb975bc54c20ff00240133d00d4d4e0d45bbf49200f4452f956567
        • Opcode Fuzzy Hash: b72bbd7d823bbc4cf2c482247fc459c400801af99fc2cc9620fcce74482d5a1b
        • Instruction Fuzzy Hash: 8FB19C715083569FD726DFA8C480B6FBBE8BB88744F45496EF9C9D7240D730DA048B92
        Function 01B60CB5 Relevance: 10.4, Strings: 8, Instructions: 402COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
        • API String ID: 0-1357697941
        • Opcode ID: fbbec5ac5c4645af91c68f17c1746320c541f092d5a5234c9df2a14331596615
        • Instruction ID: f6570b17e09ca92d824d6f603ed86e32ca82a94b0966656469c21ace9c8d2dec
        • Opcode Fuzzy Hash: fbbec5ac5c4645af91c68f17c1746320c541f092d5a5234c9df2a14331596615
        • Instruction Fuzzy Hash: 2CF11831A00246EFDB29EF6DC440BBABBF9FF29704F444099F98597251D738A985CB50
        Function 01B60274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
        • API String ID: 0-1700792311
        • Opcode ID: d8ff78b67826fe78a7f35f0db725fd33a6c9c2ed11703d1ab96b007368fd511e
        • Instruction ID: 0265cd7486247a2152f62e8cc74f61ea8c132ff29032e3f5b653fdac92c3ece5
        • Opcode Fuzzy Hash: d8ff78b67826fe78a7f35f0db725fd33a6c9c2ed11703d1ab96b007368fd511e
        • Instruction Fuzzy Hash: 06D11531500686EFDB2AEF6AC441AAEBFF5FF69700F488099F4459B252D778D981CB10
        Function 01B389B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
        Download Yara Rule
        Strings
        • AVRF: -*- final list of providers -*- , xrefs: 01B38B8F
        • HandleTraces, xrefs: 01B38C8F
        • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01B38A67
        • VerifierDebug, xrefs: 01B38CA5
        • VerifierFlags, xrefs: 01B38C50
        • VerifierDlls, xrefs: 01B38CBD
        • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01B38A3D
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
        • API String ID: 0-3223716464
        • Opcode ID: bb459118f90392b2f05a3dcaeadc826ff705367e8566bca944a5eca4e4c2271e
        • Instruction ID: 34a83bab09e5b6e7d08d43d4aceedb4e1633cce2aa849bbb424dcb7761277f42
        • Opcode Fuzzy Hash: bb459118f90392b2f05a3dcaeadc826ff705367e8566bca944a5eca4e4c2271e
        • Instruction Fuzzy Hash: F59166B2644706AFDB39DF28C981B5BB7E4EBC4714F84069CFA41AB240D770AD21C792
        Function 01ABEA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
        • API String ID: 0-1109411897
        • Opcode ID: 649592f98763dab7c4dcfe41883b96b9f3d09a76ea893226f5f281ba38ee17fb
        • Instruction ID: 19fcfdd4287a9ca16befa4961e6c144986fd120bc95a434b3d18c371a8ed737e
        • Opcode Fuzzy Hash: 649592f98763dab7c4dcfe41883b96b9f3d09a76ea893226f5f281ba38ee17fb
        • Instruction Fuzzy Hash: 6EA24774A0566A8FDB68CF18CD887E9BBB9EF45304F5942E9D90DA7255DB309E80CF00
        Function 01AAF172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
        • API String ID: 0-523794902
        • Opcode ID: d570c93621d4ba1076f9539c5bbf745a770752364a399c52077fb8f53dfdc215
        • Instruction ID: 8781e46eafab7b449ba6a06a73b424797dfa71e68c1a87de72a1441af9bb40ca
        • Opcode Fuzzy Hash: d570c93621d4ba1076f9539c5bbf745a770752364a399c52077fb8f53dfdc215
        • Instruction Fuzzy Hash: 7A42F0712083829FD71ADF28C580A6ABBE5FF88704F4889ADE895CB392D730D845CB51
        Function 01ABADE0 Relevance: 8.1, Strings: 6, Instructions: 573COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: #$H$J$LdrpResSearchResourceMappedFile Enter$LdrpResSearchResourceMappedFile Exit$MUI
        • API String ID: 0-4098886588
        • Opcode ID: eec7d62f1a7bafc153cf806888ede2016c3eaba201b1a6e2bca1afa6736873da
        • Instruction ID: db33ff8395c557f3296a2e53387de0bfcca0bc8ca2bbf38ea477c597c047454d
        • Opcode Fuzzy Hash: eec7d62f1a7bafc153cf806888ede2016c3eaba201b1a6e2bca1afa6736873da
        • Instruction Fuzzy Hash: E232A1719042A98BDF26CF18C8D4BEEBBB9BF45350F1441E9E849A7252D7319E818F60
        Function 01ACB1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
        • API String ID: 0-122214566
        • Opcode ID: 90737515abe2699766dc9f1166fae43689c5914c1bb28e9aa14719ee34a82efb
        • Instruction ID: 3fa198cf66ee45469619036c7fb9fdbd1435d30562f738ea1143ff5ebdca57e2
        • Opcode Fuzzy Hash: 90737515abe2699766dc9f1166fae43689c5914c1bb28e9aa14719ee34a82efb
        • Instruction Fuzzy Hash: 72C17D31A002159BDF299B68C882B7EBBB5BF45B50F1840ADED06DB791DB75CD44C3A0
        Function 01AE63FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
        • API String ID: 0-792281065
        • Opcode ID: 44baf4288e77f99ac86e6da32e6ec9054f345378deec8e498f79a8da390c2f2b
        • Instruction ID: bcbe62a862b59d2180bc07a6af0a61024f2788692451a125eeb1106942d43ac4
        • Opcode Fuzzy Hash: 44baf4288e77f99ac86e6da32e6ec9054f345378deec8e498f79a8da390c2f2b
        • Instruction Fuzzy Hash: B4918970B00325ABEB39DF19D949BAA7FE1FF11B14F5800ADE9086B682D7709845C7D0
        Function 01AA645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
        Download Yara Rule
        Strings
        • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 01B099ED
        • minkernel\ntdll\ldrinit.c, xrefs: 01B09A11, 01B09A3A
        • apphelp.dll, xrefs: 01AA6496
        • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 01B09A2A
        • LdrpInitShimEngine, xrefs: 01B099F4, 01B09A07, 01B09A30
        • Getting the shim engine exports failed with status 0x%08lx, xrefs: 01B09A01
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
        • API String ID: 0-204845295
        • Opcode ID: 28f0120a4203e333ab709d94f8a13c59dfed24310e07f9be6181502c7b218d8f
        • Instruction ID: 24c7db9204d289df548f50240af77ca20acf3abe013093653f5e6cee72ef500c
        • Opcode Fuzzy Hash: 28f0120a4203e333ab709d94f8a13c59dfed24310e07f9be6181502c7b218d8f
        • Instruction Fuzzy Hash: 7B51B371208305AFEB25DF24D941FABBBE8FB84748F44491EF5899B1A1D730E944CB92
        Function 01AEC6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
        Download Yara Rule
        Strings
        • LdrpInitializeImportRedirection, xrefs: 01B28177, 01B281EB
        • minkernel\ntdll\ldrinit.c, xrefs: 01AEC6C3
        • LdrpInitializeProcess, xrefs: 01AEC6C4
        • Unable to build import redirection Table, Status = 0x%x, xrefs: 01B281E5
        • minkernel\ntdll\ldrredirect.c, xrefs: 01B28181, 01B281F5
        • Loading import redirection DLL: '%wZ', xrefs: 01B28170
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
        • API String ID: 0-475462383
        • Opcode ID: ef265507422c0dd8d8723758ad802370314007f45381baba81891e4ad4f543fd
        • Instruction ID: d6ea6b91c88468d4e0da7252c19213ae1150195e4b4898ea1285a6b0926c0831
        • Opcode Fuzzy Hash: ef265507422c0dd8d8723758ad802370314007f45381baba81891e4ad4f543fd
        • Instruction Fuzzy Hash: E7312571644716AFC724EF29D946E2BBBE4FF94B20F04055CF945AB295E720EC04CBA2
        Function 01AE2674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
        Download Yara Rule
        Strings
        • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 01B221BF
        • RtlGetAssemblyStorageRoot, xrefs: 01B22160, 01B2219A, 01B221BA
        • SXS: %s() passed the empty activation context, xrefs: 01B22165
        • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01B22180
        • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01B22178
        • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 01B2219F
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
        • API String ID: 0-861424205
        • Opcode ID: 7101de2dfa77b1b245713e72faf86e4a8281bcf83ede24c4700a10b8a06915bc
        • Instruction ID: bdb50340630161b4b00d05b7931d022f43b41ecf46eadf3acfee9ccdf347bcbc
        • Opcode Fuzzy Hash: 7101de2dfa77b1b245713e72faf86e4a8281bcf83ede24c4700a10b8a06915bc
        • Instruction Fuzzy Hash: 44310836E4022577FB259A9ACC45F6B7AB8EB94B50F1540DAFA04FB140D3709A41C6A1
        Function 01AC9950 Relevance: 6.7, Strings: 5, Instructions: 462COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
        • API String ID: 0-3393094623
        • Opcode ID: 5b8fb53f9ea432a32ce6569fed6253b7c49b842d763f5c7afe011d86a00d939d
        • Instruction ID: dae715c20f4ff564746fbcc6d9001663e2df531fb73f3d00bf406aeff33729d9
        • Opcode Fuzzy Hash: 5b8fb53f9ea432a32ce6569fed6253b7c49b842d763f5c7afe011d86a00d939d
        • Instruction Fuzzy Hash: E7025B75508381DFD721CF28C1807ABBBE5FF88B08F85895EE99997251E770D844CB92
        Function 01AF096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
        Download Yara Rule
        APIs
          • Part of subcall function 01AF2DF0: LdrInitializeThunk.NTDLL ref: 01AF2DFA
        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01AF0BA3
        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01AF0BB6
        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01AF0D60
        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01AF0D74
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
        • String ID:
        • API String ID: 1404860816-0
        • Opcode ID: 21f0f7c654efcbdd83d2b963af6fe0265c8b3d5436e4652647175de66d904df3
        • Instruction ID: 028fa1b29acf9f133441dc162b84e955149a7c223fe182ca2ff29db4cba6d232
        • Opcode Fuzzy Hash: 21f0f7c654efcbdd83d2b963af6fe0265c8b3d5436e4652647175de66d904df3
        • Instruction Fuzzy Hash: 04423971900715DFDB25CF68C980BAAB7F5FF08314F1445AEEA899B242E770A985CF60
        Function 01B34F40 Relevance: 6.5, Strings: 5, Instructions: 246COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: .DLL$.Local$/$\$\microsoft.system.package.metadata\Application
        • API String ID: 0-2518169356
        • Opcode ID: 81cad50d2177f71f9adb2f4d13a6f6ca99087a65d21304765778ddda246d1d13
        • Instruction ID: 8c0cbe28019c597c06c97af2b9ec4da31377df9c13b35e22758527b5dfb3ef7e
        • Opcode Fuzzy Hash: 81cad50d2177f71f9adb2f4d13a6f6ca99087a65d21304765778ddda246d1d13
        • Instruction Fuzzy Hash: 3C91C172D0061A9BCB29CF9DC881AAEF7B0FF88310F5941A9E915E7350D775D911CB90
        Function 01AC70C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
        • API String ID: 0-3178619729
        • Opcode ID: d7e5a3ad7721f82be571223161eb9ed3076600c454374112fa3d58ce534ec2c7
        • Instruction ID: a264f785e2852a7c733ec929d73daf89e6a29998e3d154b3d6bf9cd8749aeaa7
        • Opcode Fuzzy Hash: d7e5a3ad7721f82be571223161eb9ed3076600c454374112fa3d58ce534ec2c7
        • Instruction Fuzzy Hash: 1113AF70A00656CFDB29CF68C4807A9BBF1FF59B04F1881ADD959AB382D734A945CF90
        Function 01ACA840 Relevance: 5.4, Strings: 4, Instructions: 358COMMON
        Download Yara Rule
        Strings
        • SsHd, xrefs: 01ACA885
        • SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 01B17D39
        • SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 01B17D56
        • RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 01B17D03
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
        • API String ID: 0-2905229100
        • Opcode ID: 9acb764f79f0083fae8d713e3683a4835608ef31351ad409d149cd16dc1c0a6a
        • Instruction ID: 86da7ae4e91dba8a881a550d67b4ece32c374f46e3cf1eb47ded8ab1a84890a1
        • Opcode Fuzzy Hash: 9acb764f79f0083fae8d713e3683a4835608ef31351ad409d149cd16dc1c0a6a
        • Instruction Fuzzy Hash: 4AD1BE76A002099BDF29CFA8D8C16FDBBB1EF48710F5940ADE905AB345E7319881CB90
        Function 01ABA3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
        • API String ID: 0-379654539
        • Opcode ID: e40820eb91d08580b5c4028c83dbaed22996ab218712af37174be5e521c7598e
        • Instruction ID: 0ef1298a599107e25046501774e31ac52246586feabe5ecb92191fc0bc3c2c2c
        • Opcode Fuzzy Hash: e40820eb91d08580b5c4028c83dbaed22996ab218712af37174be5e521c7598e
        • Instruction Fuzzy Hash: 5BC18D74108386CFD715DF68C180BAAB7F8FF84704F0449AAF9958B252E738DA49CB56
        Function 01AE8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
        Download Yara Rule
        Strings
        • @, xrefs: 01AE8591
        • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 01AE855E
        • minkernel\ntdll\ldrinit.c, xrefs: 01AE8421
        • LdrpInitializeProcess, xrefs: 01AE8422
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
        • API String ID: 0-1918872054
        • Opcode ID: b62cea613e6cb236a2adca9645ecec36cc89b4359656b4d30595771084cb675b
        • Instruction ID: 10be1afcfa676e30c08e1580992b49a19d70360198f4269157a1102ddd6b86b9
        • Opcode Fuzzy Hash: b62cea613e6cb236a2adca9645ecec36cc89b4359656b4d30595771084cb675b
        • Instruction Fuzzy Hash: CC918A71508345AFD721EF65CD85FABBAE8FF88744F40096EFA8892151E738D904CB62
        Function 01AC0C00 Relevance: 5.3, Strings: 4, Instructions: 260COMMON
        Download Yara Rule
        Strings
        • HEAP[%wZ]: , xrefs: 01B154D1, 01B15592
        • HEAP: , xrefs: 01B154E0, 01B155A1
        • ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 01B154ED
        • ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 01B155AE
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
        • API String ID: 0-1657114761
        • Opcode ID: b15e8ded8e73f9f74b6725cd0b442913ffb29c57b2dc80023c637d18414779f3
        • Instruction ID: 0511c85d0e5f3074162e64168dfc5c52cfd6b97bee12986bc65930966ad2ca6e
        • Opcode Fuzzy Hash: b15e8ded8e73f9f74b6725cd0b442913ffb29c57b2dc80023c637d18414779f3
        • Instruction Fuzzy Hash: 46A1F278604306DFDB29CF28C680BBABBF1FF55B00F18856DE5968B646D734A844CB90
        Function 01AE273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
        Download Yara Rule
        Strings
        • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 01B222B6
        • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 01B221D9, 01B222B1
        • SXS: %s() passed the empty activation context, xrefs: 01B221DE
        • .Local, xrefs: 01AE28D8
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
        • API String ID: 0-1239276146
        • Opcode ID: a754534807a8f576ae5fa0843083c73598d2fa5deb663501d5377af6166da0ad
        • Instruction ID: 41b9cd38bbb41c9327448ff85951b3e54173b00204a8117903076585f0c2e16c
        • Opcode Fuzzy Hash: a754534807a8f576ae5fa0843083c73598d2fa5deb663501d5377af6166da0ad
        • Instruction Fuzzy Hash: E2A19031900229DBDB25CF68CC88BA9B7F5BF59354F1541EAE908EB251D7309E84CF90
        Function 01AE4AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON
        Download Yara Rule
        Strings
        • RtlDeactivateActivationContext, xrefs: 01B23425, 01B23432, 01B23451
        • SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 01B23437
        • SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 01B23456
        • SXS: %s() called with invalid flags 0x%08lx, xrefs: 01B2342A
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
        • API String ID: 0-1245972979
        • Opcode ID: e97de25fb9e1b08841c232e65ee793f09f7bb0657fa08d70d60461230fb7c9a3
        • Instruction ID: 7f9e41056c95520034ac6a78322ff7cff7315979ce8684d9dcbc074bf7bfc9a2
        • Opcode Fuzzy Hash: e97de25fb9e1b08841c232e65ee793f09f7bb0657fa08d70d60461230fb7c9a3
        • Instruction Fuzzy Hash: A06135326007129BDB26CF1DC885B3AB7E9FF88B10F14859DE969DB250C738E845CB91
        Function 01AB64AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
        Download Yara Rule
        Strings
        • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01B11028
        • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01B10FE5
        • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 01B110AE
        • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 01B1106B
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
        • API String ID: 0-1468400865
        • Opcode ID: 6374e7927dba5e26128d20dee72a0c4bb6c5ed861385557965edcfe57177f9d0
        • Instruction ID: 3ce0c515ab8e9ca546556285542678ced423e0123467f3984cf8230ff6b18e71
        • Opcode Fuzzy Hash: 6374e7927dba5e26128d20dee72a0c4bb6c5ed861385557965edcfe57177f9d0
        • Instruction Fuzzy Hash: 6571CEB1904345AFCB21EF28C8C4B977FA8EF94764F440568F9498B18BD334D598CB92
        Function 00F111C0 Relevance: 5.2, Strings: 4, Instructions: 198COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID: DLV>$Z9$dFI($gfff
        • API String ID: 0-2403641326
        • Opcode ID: 8a926b8d5176969f0814ce8d31a92cd6931eace55719289067c1082a0d268b3e
        • Instruction ID: bec8584f9b6d836356a25a11af17547e20e5ab0abb7f87dc8798e4f4710474a5
        • Opcode Fuzzy Hash: 8a926b8d5176969f0814ce8d31a92cd6931eace55719289067c1082a0d268b3e
        • Instruction Fuzzy Hash: 2961C171E0060A87DF18CE99D8401EDF772FFE4310F14926AEA19BF794E6759E819B80
        Function 01AD245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
        Download Yara Rule
        Strings
        • LdrpDynamicShimModule, xrefs: 01B1A998
        • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 01B1A992
        • minkernel\ntdll\ldrinit.c, xrefs: 01B1A9A2
        • apphelp.dll, xrefs: 01AD2462
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
        • API String ID: 0-176724104
        • Opcode ID: abf471a03c572d09c22b27ecf8e54ec199fbfe5af1722df12469e15d68119d4b
        • Instruction ID: 6c6f2e8e16a918f869c2d9f7cd69c2606f060f5154221c592dd193da3c6b6fa4
        • Opcode Fuzzy Hash: abf471a03c572d09c22b27ecf8e54ec199fbfe5af1722df12469e15d68119d4b
        • Instruction Fuzzy Hash: 3D3141B1600241ABDB359F6DD882FB9B7F5FB84710F9A405EF90167259C7706981CB40
        Function 01AC29A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
        Download Yara Rule
        Strings
        • HEAP[%wZ]: , xrefs: 01AC3255
        • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 01AC327D
        • HEAP: , xrefs: 01AC3264
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
        • API String ID: 0-617086771
        • Opcode ID: 463e40be313ea153ba9de84b766dcc89f1dc1e4069fe845c6502ee8c82ba03b6
        • Instruction ID: ec4ae44faba70059080ff17738bda45aea2804fd4cd581a0db54e2cc66c323e5
        • Opcode Fuzzy Hash: 463e40be313ea153ba9de84b766dcc89f1dc1e4069fe845c6502ee8c82ba03b6
        • Instruction Fuzzy Hash: 8B92AA71A042499FDF25CF68C4407AEBBF1BF48B10F1880AEE959AB352D735A945CF50
        Function 01B402C0 Relevance: 4.4, Strings: 3, Instructions: 611COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: """"$MitigationAuditOptions$MitigationOptions
        • API String ID: 0-1670051934
        • Opcode ID: 06d77a5bd1d4346c71d08a4618640c5b474e59bf07252456251a8edfcb78748d
        • Instruction ID: aa23b532e3a0ba11a76b3056e89797726b9e7d0be6d7b0005b5fa832cb36bde2
        • Opcode Fuzzy Hash: 06d77a5bd1d4346c71d08a4618640c5b474e59bf07252456251a8edfcb78748d
        • Instruction Fuzzy Hash: 8D228D726147028FE728DF2DC99166ABBE1FBD8310F24CA6EF29A87650D770E504DB41
        Function 01AC0770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
        • API String ID: 0-4253913091
        • Opcode ID: bcd6c068826e00a225233e49a908c2cc9ab7418189744cee145192a75ed894c2
        • Instruction ID: 5777783f5f7543f0b918c74b946b6a8e9a2ab2d3ef3ae2e23773137608643e5f
        • Opcode Fuzzy Hash: bcd6c068826e00a225233e49a908c2cc9ab7418189744cee145192a75ed894c2
        • Instruction Fuzzy Hash: B8F1BE35A00606DFEB2ACF68C984BAAB7B5FF85700F1481ACE5169B355D734E981CB90
        Function 01AB1460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
        Download Yara Rule
        Strings
        • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 01AB1728
        • HEAP[%wZ]: , xrefs: 01AB1712
        • HEAP: , xrefs: 01AB1596
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
        • API String ID: 0-3178619729
        • Opcode ID: ae251672d2b84ab0d6fb5a7d728ec09325b7a9cdbf6641a98db8d2bc1bede040
        • Instruction ID: 4e186078841bac5164bce44cb4f61427834a99c9a140f3128a2beb1823aec389
        • Opcode Fuzzy Hash: ae251672d2b84ab0d6fb5a7d728ec09325b7a9cdbf6641a98db8d2bc1bede040
        • Instruction Fuzzy Hash: 3CE1D370A046859FDB29CF28D4A1BBABBF9EF44300F18859DE596CB287D734E941CB50
        Function 01AD6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: $@
        • API String ID: 0-1077428164
        • Opcode ID: de564b988bfa412e94048501793b17ec862cc9882c8e4a54167d0c8f36a3094d
        • Instruction ID: b976c7c883098c682a084e60de5978d97745066155d6555b6480483c0bb3baea
        • Opcode Fuzzy Hash: de564b988bfa412e94048501793b17ec862cc9882c8e4a54167d0c8f36a3094d
        • Instruction Fuzzy Hash: 03C2A1716087419FDB29CF68C881BABBBE5BF88718F05896DF98AC7241D734D844CB52
        Function 01AAA197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: FilterFullPath$UseFilter$\??\
        • API String ID: 0-2779062949
        • Opcode ID: 47003fc05d46fb4610a797e292b7623a1b88de91403788f984f75953530a92c2
        • Instruction ID: a8651221d303d5a507afa2c1b61551b08fdda6f7135133402ceda4ba58795c85
        • Opcode Fuzzy Hash: 47003fc05d46fb4610a797e292b7623a1b88de91403788f984f75953530a92c2
        • Instruction Fuzzy Hash: A5A15E719116299BDF32DF64CD88BAABBB8FF44700F1141EAEA09A7250D7359E84CF50
        Function 01AD0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
        Download Yara Rule
        Strings
        • Failed to allocated memory for shimmed module list, xrefs: 01B1A10F
        • minkernel\ntdll\ldrinit.c, xrefs: 01B1A121
        • LdrpCheckModule, xrefs: 01B1A117
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
        • API String ID: 0-161242083
        • Opcode ID: 94821d92897cf9b4e8f0a6248a257e6e7d76794929f861d8c1ed1b8cadde2e81
        • Instruction ID: 1e190f685f4efbdc24b38ce3cebdeb3f4cfee794fa8e13999357ce6bf76c2515
        • Opcode Fuzzy Hash: 94821d92897cf9b4e8f0a6248a257e6e7d76794929f861d8c1ed1b8cadde2e81
        • Instruction Fuzzy Hash: 6D71F1B0A00606DFDB29DF68CA85ABEB7F4FB48704F59406DE806E7255E734AD41CB40
        Function 01AEC720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
        Download Yara Rule
        Strings
        • Failed to reallocate the system dirs string !, xrefs: 01B282D7
        • LdrpInitializePerUserWindowsDirectory, xrefs: 01B282DE
        • minkernel\ntdll\ldrinit.c, xrefs: 01B282E8
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
        • API String ID: 0-1783798831
        • Opcode ID: 1b6a48db48aab8b8e2624d8b0c3cdee1ff43c005b1f5bce98402371df8edd4a4
        • Instruction ID: a33b867d0d027ae165365d7acebc91489b948e86febfadba0cb2c64a371fd8c8
        • Opcode Fuzzy Hash: 1b6a48db48aab8b8e2624d8b0c3cdee1ff43c005b1f5bce98402371df8edd4a4
        • Instruction Fuzzy Hash: 6241F3B1984311BBC720EB68DD45B9B7BE8FF54760F49492AF949D3254E770D800CB91
        Function 01B6C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
        Download Yara Rule
        Strings
        • @, xrefs: 01B6C1F1
        • PreferredUILanguages, xrefs: 01B6C212
        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 01B6C1C5
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
        • API String ID: 0-2968386058
        • Opcode ID: 52695df924a7838dc2bff9203519b85092cacdd056a6be6cde2f59621f5153b9
        • Instruction ID: 67df4ed1db98b4cfddfbe3505c782b7ead59e9f34df87647c0a3a765782cfce7
        • Opcode Fuzzy Hash: 52695df924a7838dc2bff9203519b85092cacdd056a6be6cde2f59621f5153b9
        • Instruction Fuzzy Hash: 75415271E0020AEBDF15DED8C951FEEBBBCEB24704F1441AAEA49B7250D7789A44CB50
        Function 01B44144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
        • API String ID: 0-1373925480
        • Opcode ID: 9f22f129c211fb31b4caaf4cd10303c562f8394fc29f300bf9d6b99db3f48023
        • Instruction ID: 44e27734749fe6e7cfbac87a7a915515b53a6244fd90190f0a43c8759b9c6237
        • Opcode Fuzzy Hash: 9f22f129c211fb31b4caaf4cd10303c562f8394fc29f300bf9d6b99db3f48023
        • Instruction Fuzzy Hash: 71414371A106888BEB2ADFE9C940BADBBB8FF55740F14849AD901FB381DB349900CB10
        Function 01B34755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
        Download Yara Rule
        Strings
        • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01B34888
        • LdrpCheckRedirection, xrefs: 01B3488F
        • minkernel\ntdll\ldrredirect.c, xrefs: 01B34899
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
        • API String ID: 0-3154609507
        • Opcode ID: b3575554843e572dd4922ca74fa334ba032654a01649ad71cdac046e6cec0c22
        • Instruction ID: 1af5537f88b7af45a9fd95d13233037048e90c9377a357aedc1a46d748584418
        • Opcode Fuzzy Hash: b3575554843e572dd4922ca74fa334ba032654a01649ad71cdac046e6cec0c22
        • Instruction Fuzzy Hash: C541AF32A15651DFCB2ACE6DD840A26BBE4FFC9B50B0506E9ED5897351E730E820CB91
        Function 01AC0BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
        • API String ID: 0-2558761708
        • Opcode ID: e6285182c403464b77eefeea2cd7bf183c5d7e1576d5a85f3616227ca7ddd7b9
        • Instruction ID: 77dbeb7ace8c865e2f090ed483a845c6b1366af18daee18e662520415b3d71a4
        • Opcode Fuzzy Hash: e6285182c403464b77eefeea2cd7bf183c5d7e1576d5a85f3616227ca7ddd7b9
        • Instruction Fuzzy Hash: 2A11DC35394142DFDB2DDB28C551B6AB3A4EF82A16FA981ADF406CF259DB30E880C750
        Function 01B320DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
        Download Yara Rule
        Strings
        • Process initialization failed with status 0x%08lx, xrefs: 01B320F3
        • minkernel\ntdll\ldrinit.c, xrefs: 01B32104
        • LdrpInitializationFailure, xrefs: 01B320FA
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
        • API String ID: 0-2986994758
        • Opcode ID: 90ad50d0c5b30be6b46d8ab6db99210b7bd73be6a5a0bb2058bb8203aa5af7fd
        • Instruction ID: 85690d33586001df9651dcf7d51095d221f990d78205609d844d87a294657cda
        • Opcode Fuzzy Hash: 90ad50d0c5b30be6b46d8ab6db99210b7bd73be6a5a0bb2058bb8203aa5af7fd
        • Instruction Fuzzy Hash: BAF0FC35640308BBEB28E64DCD43F9A7BA8FB80B54F5400D9F7047B285D3B0A550C691
        Function 01AC03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
        Download Yara Rule
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: ___swprintf_l
        • String ID: #%u
        • API String ID: 48624451-232158463
        • Opcode ID: 60f3d2b382652e67c4582602607822ee9eeddab04fce53395264b22eb2cdb167
        • Instruction ID: 6aee56ad6db044095abc5a92833da0f6f332cbc69b65c7417cef53b738e35f23
        • Opcode Fuzzy Hash: 60f3d2b382652e67c4582602607822ee9eeddab04fce53395264b22eb2cdb167
        • Instruction Fuzzy Hash: 02714771A0014A9FDF05DFA8CA90BAEBBF8FF18704F154069E905E7251EB34AD05CBA0
        Function 01AC52A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$@
        • API String ID: 0-149943524
        • Opcode ID: 647248f8fbdd81212b089f6153a839647456a9496b48021da8b71878a9e41f62
        • Instruction ID: d51572792a1b59019114d14ca58ce9962a8c6dc4232fe0ff794de5cd6ff681bb
        • Opcode Fuzzy Hash: 647248f8fbdd81212b089f6153a839647456a9496b48021da8b71878a9e41f62
        • Instruction Fuzzy Hash: 0832AC70A083118BDB28CF19C59077EBBF1EF84B44F59495EFA859B290E774E880CB52
        Function 01ABA9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
        Download Yara Rule
        Strings
        • LdrResSearchResource Exit, xrefs: 01ABAA25
        • LdrResSearchResource Enter, xrefs: 01ABAA13
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
        • API String ID: 0-4066393604
        • Opcode ID: a2ab6282b4ee6890db503eb9da958e753d4d81d9e579203888e7135e98144e63
        • Instruction ID: 1f034896effe8e5120cd10680803ca6408d6a87cf3c97c935035428e0dcfc68a
        • Opcode Fuzzy Hash: a2ab6282b4ee6890db503eb9da958e753d4d81d9e579203888e7135e98144e63
        • Instruction Fuzzy Hash: 79E19171E00249AFEF26DF99C980BEEBBB9FF08310F1545A9E911E7256E7349940CB50
        Function 01B7A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: `$`
        • API String ID: 0-197956300
        • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
        • Instruction ID: 6e97508afdc57923ed04c18b26f710728aeaa9e395e5eaa5a94c387096fa0614
        • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
        • Instruction Fuzzy Hash: 52C1BD312043429BEB69CF28C845B6FBBE5EFC4718F084A6DF6A68B290D775D505CB81
        Function 01AB0CF2 Relevance: 2.8, Strings: 2, Instructions: 317COMMON
        Download Yara Rule
        Strings
        • Failed to retrieve service checksum., xrefs: 01B0EE56
        • ResIdCount less than 2., xrefs: 01B0EEC9
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: Failed to retrieve service checksum.$ResIdCount less than 2.
        • API String ID: 0-863616075
        • Opcode ID: 47cef4363dceedee4bd2f96234e080c47c4b137bce6764ac17869ea7e908d088
        • Instruction ID: dfb56ad90d3363c24bb4dd3a16252901e2adfdc742579ac80e6104bd43d35d31
        • Opcode Fuzzy Hash: 47cef4363dceedee4bd2f96234e080c47c4b137bce6764ac17869ea7e908d088
        • Instruction Fuzzy Hash: A9E1F2B19083849FE365CF15C080BABFBE4FB88314F408A2EE5998B391D7719949CF56
        Function 01B2E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: InitializeThunk
        • String ID: Legacy$UEFI
        • API String ID: 2994545307-634100481
        • Opcode ID: dfa7b159c8c04ba0a1eb5e3b83f03ae636d538656bd18705e89fee1ed1820b7f
        • Instruction ID: 7663a6fa4c8756ff029f93d75ae1c8d2d8adb8833dcc32cdada91cf447697aa4
        • Opcode Fuzzy Hash: dfa7b159c8c04ba0a1eb5e3b83f03ae636d538656bd18705e89fee1ed1820b7f
        • Instruction Fuzzy Hash: E5617E71E003199FDB18DFAAC940BAEBBB5FB48700F1441ADE649EB291D771E944CB50
        Function 01B543D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @$MUI
        • API String ID: 0-17815947
        • Opcode ID: 5030f01582da94b561c7470759abda80f2ccf24b789a07810a3b60ec0acb1a8f
        • Instruction ID: 056efa094ad1aaff0c5585a69b5f50a8e42ebe024357b501e6cb34c2043a0a7c
        • Opcode Fuzzy Hash: 5030f01582da94b561c7470759abda80f2ccf24b789a07810a3b60ec0acb1a8f
        • Instruction Fuzzy Hash: 43512771E0021DAEDF15DFE9DD84BEEBBB8EB44754F10056AEA11B7280E7309945CB60
        Function 01AB04E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
        Download Yara Rule
        Strings
        • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 01AB063D
        • kLsE, xrefs: 01AB0540
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
        • API String ID: 0-2547482624
        • Opcode ID: 81328cf1f0553a173f0e1250d57b4f2f1038dad0710185c67c7130aa610540d4
        • Instruction ID: 4a71bdf217870fc0baf8fca9b66f44e8912117a29600ea5009009893c2fa7047
        • Opcode Fuzzy Hash: 81328cf1f0553a173f0e1250d57b4f2f1038dad0710185c67c7130aa610540d4
        • Instruction Fuzzy Hash: A0519D715047829BD724EF78C6806E7BBF8AF84304F14893EF69A87642E770E545CB91
        Function 01ABA2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
        Download Yara Rule
        Strings
        • RtlpResUltimateFallbackInfo Exit, xrefs: 01ABA309
        • RtlpResUltimateFallbackInfo Enter, xrefs: 01ABA2FB
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
        • API String ID: 0-2876891731
        • Opcode ID: acc792594d0aa02195cc2ba32a06e77cda9c261de1f587ba0e7bee7e8834caa3
        • Instruction ID: fb7ea574f9c737fa09a87f272252c4be9d436976c0fae23342fe50ea42e75579
        • Opcode Fuzzy Hash: acc792594d0aa02195cc2ba32a06e77cda9c261de1f587ba0e7bee7e8834caa3
        • Instruction Fuzzy Hash: 9841D234A05689DBDB15DF5DC480BAE7BB8FF84700F2580E9E905DB296E375D900CB50
        Function 01AEA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: InitializeThunk
        • String ID: Cleanup Group$Threadpool!
        • API String ID: 2994545307-4008356553
        • Opcode ID: f178a53c8508b6396849ce7e6a3b94076d69dda2c4e7c207b0c04e25b6e263bc
        • Instruction ID: 6121b32a477be357b93c3e5d798290aa0d66ee298b6ef4751f2491e841b02099
        • Opcode Fuzzy Hash: f178a53c8508b6396849ce7e6a3b94076d69dda2c4e7c207b0c04e25b6e263bc
        • Instruction Fuzzy Hash: 5401A9B2640700AFD321DF28CE4AB2677E8F785B25F058979F658C7190E334E804CB46
        Function 01ABC7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: MUI
        • API String ID: 0-1339004836
        • Opcode ID: f921c04a401cc5712fcb9e7b91a5590e75aaa07f9f6bb08e7e8d1ec0211b2867
        • Instruction ID: 853f456953d74053db2618e5837c3caaf7e14686ec99ca19febfba5ea623c67b
        • Opcode Fuzzy Hash: f921c04a401cc5712fcb9e7b91a5590e75aaa07f9f6bb08e7e8d1ec0211b2867
        • Instruction Fuzzy Hash: 63828D75E002988FEB25CFA9C9C0BEDBBB9BF44324F148169E919AB356D7309D41CB50
        Function 01B02F28 Relevance: 2.0, Strings: 1, Instructions: 762COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: P`vRbv
        • API String ID: 0-2392986850
        • Opcode ID: e2f5dbfef8fb328b0838c674d1058eab355412f3d8a67ea75cc4eea3ee700cad
        • Instruction ID: 22fc62deb947b09385803356bffc7867bc10a190dd745c59c68336a17ecf2565
        • Opcode Fuzzy Hash: e2f5dbfef8fb328b0838c674d1058eab355412f3d8a67ea75cc4eea3ee700cad
        • Instruction Fuzzy Hash: 1842BF71D0424AAEDF2FCAADD8886BDBFF0FB09310F14819AE541AB2E1D7358981C750
        Function 01B5CD1F Relevance: 1.9, Strings: 1, Instructions: 620COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: @
        • API String ID: 0-2766056989
        • Opcode ID: a62076708d3ed8f09253c3cd3ba277d89f510b56d554c4357fdc89bf54a91837
        • Instruction ID: 3d5c1ac9ee96d1ade4fa20980efa476b4ea9f60e371d5c128519857b67d66e09
        • Opcode Fuzzy Hash: a62076708d3ed8f09253c3cd3ba277d89f510b56d554c4357fdc89bf54a91837
        • Instruction Fuzzy Hash: 86622870D012188FCB98DF9AC4D4AADB7B2FF8C311F608199E9816BB45C7356A16CF60
        Function 01AD2E90 Relevance: 1.7, Strings: 1, Instructions: 438COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: 0
        • API String ID: 0-4108050209
        • Opcode ID: 1dc1afd428c3fd5484fa3864634149562031556d33ccd5ee1218fb1f24b7edf8
        • Instruction ID: 3517cc29f4731f0080191c1c5ec197f94d09779c41e50ac2adec138cce250e5d
        • Opcode Fuzzy Hash: 1dc1afd428c3fd5484fa3864634149562031556d33ccd5ee1218fb1f24b7edf8
        • Instruction Fuzzy Hash: 42F17EB1608B468FDF25CF28C584B6ABBF1BF88610F09486DF99A87241DB34D945CB52
        Function 00F2681E Relevance: 1.7, Strings: 1, Instructions: 427COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID: (
        • API String ID: 0-3887548279
        • Opcode ID: d030d77252bd43815717611452a26bd12f17f919c66c1abb051a0a298225eb27
        • Instruction ID: 2ba9f03af79149204ee28045e638a6635e65acd91f270201a8f254203823e21d
        • Opcode Fuzzy Hash: d030d77252bd43815717611452a26bd12f17f919c66c1abb051a0a298225eb27
        • Instruction Fuzzy Hash: 3E021CB6E006189FDB14CF9AD8805DDFBF2FF88314F1AC1AAD859A7315D6746A418F80
        Function 00F26823 Relevance: 1.7, Strings: 1, Instructions: 423COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID: (
        • API String ID: 0-3887548279
        • Opcode ID: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
        • Instruction ID: a21ddce9e184c969b4f21893033555d0f8b8f296c858452494e0987257e19078
        • Opcode Fuzzy Hash: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
        • Instruction Fuzzy Hash: 58021DB6E006189FDB14CF9AD8805DDFBF2FF88314F1AC1AAD859A7315D6746A418F80
        Function 01AB2FC8 Relevance: 1.7, Strings: 1, Instructions: 410COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: PATH
        • API String ID: 0-1036084923
        • Opcode ID: 23ead819d43d442c3455b24827114df306f6841b01f7c800d2510f86bbf99fd2
        • Instruction ID: e8f4de43bb21eeaa27d0768a3ee597741073d703004f41585a3cf4fe1a47e0c8
        • Opcode Fuzzy Hash: 23ead819d43d442c3455b24827114df306f6841b01f7c800d2510f86bbf99fd2
        • Instruction Fuzzy Hash: EEF19D71D00259ABCF25CF9CD9C1AEEBBB9FF48700F898029E541AB352D734A941CB60
        Function 01B3EFA0 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
        Download Yara Rule
        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: __aullrem
        • String ID:
        • API String ID: 3758378126-0
        • Opcode ID: d2399a191eb0f5f701a36fcf9f691f845dfe918fa796f31438aa4cbd81ac600a
        • Instruction ID: d47ce02d90eba1be7dfe3d0763694762b4505198123cd024b99cac52d9c8b541
        • Opcode Fuzzy Hash: d2399a191eb0f5f701a36fcf9f691f845dfe918fa796f31438aa4cbd81ac600a
        • Instruction Fuzzy Hash: 5E418D71F001199BDF18DEBCC8805BEF7F2FF88310B18827AE615E7280D674A9548780
        Function 01AC38E0 Relevance: 1.6, Strings: 1, Instructions: 349COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: G\Y
        • API String ID: 0-2169780821
        • Opcode ID: 7973dfbe9b6836079ca8cd1e6e4ee7e12ee6194a079ba7857d7e3086737b2570
        • Instruction ID: 239dc16dca5a1ca274c24391a0d22f66ac4ffa5338077e47ed215add765a5f23
        • Opcode Fuzzy Hash: 7973dfbe9b6836079ca8cd1e6e4ee7e12ee6194a079ba7857d7e3086737b2570
        • Instruction Fuzzy Hash: EDE1B075A00205CFDB18CF59C890AAABBF1FF48310F69819DE955EB395D730EA41CB90
        Function 01AB0100 Relevance: 1.6, Strings: 1, Instructions: 321COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID: 0-3916222277
        • Opcode ID: 9238b2e30d199e662bff931be968084dda8685d672c7cf53249958cbc79ee1a7
        • Instruction ID: b0df6b195513f4f1f270eb01ff10a173c20fa32075f486c92472c2655f7daa5f
        • Opcode Fuzzy Hash: 9238b2e30d199e662bff931be968084dda8685d672c7cf53249958cbc79ee1a7
        • Instruction Fuzzy Hash: C4A10931A043996ADF2A8B288BC4BFF6FBD9B55304F0844D9FE46A71C3D774C9848A50
        Function 01B64420 Relevance: 1.6, Strings: 1, Instructions: 307COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID: 0-3916222277
        • Opcode ID: 8fb2f3f8fbf0c85492b94789b478d04821f9d6c0cd0fdfcba8fcf98f8d4c1bd0
        • Instruction ID: 9057158418561a78309e67edb0e285465eeda89a8dec2c7b027a5bd5dbb239b2
        • Opcode Fuzzy Hash: 8fb2f3f8fbf0c85492b94789b478d04821f9d6c0cd0fdfcba8fcf98f8d4c1bd0
        • Instruction Fuzzy Hash: E3A10531600B686ADF3D8A68C940BFA2BACDF7A714F0844D8BE455B281DB7DC954CB60
        Function 01B36420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID: 0-3916222277
        • Opcode ID: 7ece775d15b298878a19b9c4d69e59f355edc4056cee0a0beee78dd6d7888899
        • Instruction ID: 290f105b2dd9f4d5980355d700ae51992a7037ca2bdcee7a3d247893205ec476
        • Opcode Fuzzy Hash: 7ece775d15b298878a19b9c4d69e59f355edc4056cee0a0beee78dd6d7888899
        • Instruction Fuzzy Hash: F19181B1A00619BFEB25DB94CD85FEE7BB8EF58B50F114065F601AB190D774AD04CBA0
        Function 01B5E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID: 0-3916222277
        • Opcode ID: b03ab8b7c5d60be968e526fda11a0f6820a25845f858e80086907414e8c00075
        • Instruction ID: d3b7c1d3ccba0d3791ed275e13c7d89bc1a9e26203e6462c6c8f8da0dedaf25d
        • Opcode Fuzzy Hash: b03ab8b7c5d60be968e526fda11a0f6820a25845f858e80086907414e8c00075
        • Instruction Fuzzy Hash: E091BE32900609AFDF2AABA5DD84FAFBBB9EF45780F000069F905A7251DB35DA01CB50
        Function 00F12380 Relevance: 1.5, Strings: 1, Instructions: 214COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID: sHM
        • API String ID: 0-1294282591
        • Opcode ID: aa25474b17bc28eb79d0012a44ec3ba4155be1d3ac5deb9fe3cef1ff7f9b5237
        • Instruction ID: d4ba981b836b9fb5e1581e88d250cabab9e9a585923fec8dc429c6dffbb63338
        • Opcode Fuzzy Hash: aa25474b17bc28eb79d0012a44ec3ba4155be1d3ac5deb9fe3cef1ff7f9b5237
        • Instruction Fuzzy Hash: F261B471F0010547DB68CA9CDCD12AAB392EBE8315F58817AED05DF782F634EDA1A780
        Function 01AEA660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: GlobalTags
        • API String ID: 0-1106856819
        • Opcode ID: 504621e23c56135cf3f02c1610eb4bb4d4ee1317873551e531f762a6467d2213
        • Instruction ID: cf355e40838f92b6b5725c4eac228a9e2ba2c0c6e9663231c863dae8c0ea4e74
        • Opcode Fuzzy Hash: 504621e23c56135cf3f02c1610eb4bb4d4ee1317873551e531f762a6467d2213
        • Instruction Fuzzy Hash: 24718EB5E0022ACFDF28CF9CD5806ADBBB1FF58700F1481AAED09AB251E7719845CB50
        Function 01B7132D Relevance: 1.4, Strings: 1, Instructions: 188COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: G\Y
        • API String ID: 0-2169780821
        • Opcode ID: cf80d80ae44a6b2bc5bf0a6eb0242410a6f723cedfa3d6ee8d7e797df06b15f5
        • Instruction ID: 762fd54348eb9ec51b5128af7c26fdafe7d04cbc31e4c9939d14d1485758f03f
        • Opcode Fuzzy Hash: cf80d80ae44a6b2bc5bf0a6eb0242410a6f723cedfa3d6ee8d7e797df06b15f5
        • Instruction Fuzzy Hash: 50816F75A00245DFCB09CF68C490AAEBBF1FF48310F1981A9D859EB355D734EA51CBA0
        Function 01B54978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: .mui
        • API String ID: 0-1199573805
        • Opcode ID: aaf5c5ec8ecf414237bf31c14109aada8171188eedce0b8f459fe8f23da7cd4f
        • Instruction ID: 1cfb9b86cb72b7793fcc9fbd9cc84732af81385c3d0d81397c21a0048c43ebfc
        • Opcode Fuzzy Hash: aaf5c5ec8ecf414237bf31c14109aada8171188eedce0b8f459fe8f23da7cd4f
        • Instruction Fuzzy Hash: F0519472D0022A9BDF99DFA9D940BEEBBB4EF05B10F054169EE11B7240E7349841CBE4
        Function 01ACE627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: EXT-
        • API String ID: 0-1948896318
        • Opcode ID: 88bcf2b7d472960625a911887e228c33ff65fd6a83a5028a3074b859b2c0ecae
        • Instruction ID: 7c5ba8011cfc51f20db51e287807b0cb4968f257a4eeed152e32e26045a57afd
        • Opcode Fuzzy Hash: 88bcf2b7d472960625a911887e228c33ff65fd6a83a5028a3074b859b2c0ecae
        • Instruction Fuzzy Hash: 7C418272608342AFD721DB75C940B6FBBE8AF88B14F44092DFA84E7140EB74D908C796
        Function 01B2C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: BinaryHash
        • API String ID: 0-2202222882
        • Opcode ID: 7b96f5b0dba8ed624fadc4321c0916d5533e8b9a336c8eb214d924bf9de7a443
        • Instruction ID: dd671d8eaed712fc8b1ce34c2f3bedfec897ea831a58fdf2fc16195dcb8fa81f
        • Opcode Fuzzy Hash: 7b96f5b0dba8ed624fadc4321c0916d5533e8b9a336c8eb214d924bf9de7a443
        • Instruction Fuzzy Hash: 8B4146B1D0052DAADF25DA50DD84FEEBB7CAB44714F0085D5E708AB140DB709E498F95
        Function 01B46B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: #
        • API String ID: 0-1885708031
        • Opcode ID: 89371650078041977960dda71e4157f19dd4a1b8d4f3b5ac71676da5797b444c
        • Instruction ID: bb1f511f699b0714348da175f92851e8826c9309b6b4365bd780e5922e0682a3
        • Opcode Fuzzy Hash: 89371650078041977960dda71e4157f19dd4a1b8d4f3b5ac71676da5797b444c
        • Instruction Fuzzy Hash: B5311631E007199BEB26CF69C850BAE7BA8DF06704F1480A8E941AB282D775EC45DB54
        Function 01B2CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: BinaryName
        • API String ID: 0-215506332
        • Opcode ID: 1ffeae8ea3efd022c31a88d5030e6295cb404496f96d540a329ca9b048c3b7a4
        • Instruction ID: c618241d8e903851952b8f8d22ed2a2e747ce406d1053d1f4d0685846912b770
        • Opcode Fuzzy Hash: 1ffeae8ea3efd022c31a88d5030e6295cb404496f96d540a329ca9b048c3b7a4
        • Instruction Fuzzy Hash: EE310536900529AFEB19DA58C959E6FBF74EF80760F0141A9EA09E7250D7309E08DBE0
        Function 01B3892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
        Download Yara Rule
        Strings
        • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 01B3895E
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
        • API String ID: 0-702105204
        • Opcode ID: a15f5d61a7fc24d3f5f53a5d46a763df804da64a565215944c337c664187e250
        • Instruction ID: f1878b856043eebcb4b664f5622951dc707c6d323c72e09293f1fcb338c88c71
        • Opcode Fuzzy Hash: a15f5d61a7fc24d3f5f53a5d46a763df804da64a565215944c337c664187e250
        • Instruction Fuzzy Hash: B9012632204305AFEB3D6F5ADDC4AAA7B75EFC5254B4423ACF64217152CB20B8A1C793
        Function 01AEE8F0 Relevance: 1.0, Instructions: 985COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5eb20d256da4fbfd3902286c89720544d72e97caab7f3edfd5a6296e3138e587
        • Instruction ID: ebbd8f20286eb598a1635ea545ae6ea957b7fc348d37f88d5603771d82d4fb16
        • Opcode Fuzzy Hash: 5eb20d256da4fbfd3902286c89720544d72e97caab7f3edfd5a6296e3138e587
        • Instruction Fuzzy Hash: BE823476F102188BCB58CFADDC916DDB7F2EF88314B19802DE416EB349DA34AC568B45
        Function 01AF516C Relevance: .8, Instructions: 785COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 461c2d555ec2e96987b244f6b31c62bafe055c9f3593f9da73a76a395487637b
        • Instruction ID: b5964048fb22c04fcfc43dd74e5bb1bcc9b8ae16000737e3d1f6233df236ab9f
        • Opcode Fuzzy Hash: 461c2d555ec2e96987b244f6b31c62bafe055c9f3593f9da73a76a395487637b
        • Instruction Fuzzy Hash: 3462CF36D0464AAFCF25CF88D4900AEFB72BE51314B49C65CEEAA67605D330BA55CBD0
        Function 01B52000 Relevance: .8, Instructions: 757COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d964e084fc78d7a6b7423f6a74648e87f844abbdaf6438b4b8893264f1438282
        • Instruction ID: 2bde5f75e46be9f144ffba8a8e598cfe2f54146bbd38049a7424cf75cc12c2ec
        • Opcode Fuzzy Hash: d964e084fc78d7a6b7423f6a74648e87f844abbdaf6438b4b8893264f1438282
        • Instruction Fuzzy Hash: 3042C335609341DBEB69CF68C890B6BBBE5EF88340F0809ADFE9297250D771D845CB52
        Function 01B0739A Relevance: .7, Instructions: 705COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 05a71c819445dc8e015257a6b985b4201b677329d423de2fb41b48a4eee05512
        • Instruction ID: 66e9f7c1946b105c6a7722419516ad7af42c45b700599c0eb0a17ce38d80495a
        • Opcode Fuzzy Hash: 05a71c819445dc8e015257a6b985b4201b677329d423de2fb41b48a4eee05512
        • Instruction Fuzzy Hash: E942A271A006169FDB1ACF59C4906BEFBB2FF88314B14859DD592AB390DB34F942CB90
        Function 01ADB2C0 Relevance: .6, Instructions: 629COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9681b4965927bda2c0273ba3bdc9d037ca777a1b5c4a7548d2e4f67860a524ce
        • Instruction ID: a6c8b9139e9611d2f26b3c2299c3842c0421d142a661e15d788494a3f2971b10
        • Opcode Fuzzy Hash: 9681b4965927bda2c0273ba3bdc9d037ca777a1b5c4a7548d2e4f67860a524ce
        • Instruction Fuzzy Hash: 8D32A0B1E00619DBDF15CFA8C980BAEBBB1FF55714F19006DE906AB391E7359901CBA0
        Function 01B48158 Relevance: .6, Instructions: 617COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: cb837132734269a79cbab6135eec80fd9cace0513b720b5ec5615a08df2763bb
        • Instruction ID: b220dc440b9acd48fcaeab0eb7d8497c61cb083067492fc0a8df9dd504f5807d
        • Opcode Fuzzy Hash: cb837132734269a79cbab6135eec80fd9cace0513b720b5ec5615a08df2763bb
        • Instruction Fuzzy Hash: 05422A75A002199FEB29CFA9C881BADBBF5FF48300F14C199E949EB242D7349985DF50
        Function 01AC2840 Relevance: .6, Instructions: 605COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 565ad6ed84de7ac451105e03012f906c4fe2bf8f53b6d62724662a1b188fca30
        • Instruction ID: a1f648c391972b698cd9eb9ad63a8909b60e136139187eb738c34091d1cd9c42
        • Opcode Fuzzy Hash: 565ad6ed84de7ac451105e03012f906c4fe2bf8f53b6d62724662a1b188fca30
        • Instruction Fuzzy Hash: FA321270A007558FEB29CF69C8447BEBBF2FF84700F55419EE8469B289D7B5A801CB50
        Function 01B5A118 Relevance: .6, Instructions: 591COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9f6f50d74e6cadfb6eb1c5ad302456060041027c02f3ce444eb6e356c067ea3e
        • Instruction ID: 7d1c06dffc3d01d318092a2d5351021022e4c462dee035a3dc9d7490caffaaa5
        • Opcode Fuzzy Hash: 9f6f50d74e6cadfb6eb1c5ad302456060041027c02f3ce444eb6e356c067ea3e
        • Instruction Fuzzy Hash: 6222B0702046518BEBA9CF39C091772BBF1EF45344F0886D9EE96AF286D375E452CB60
        Function 01B716CC Relevance: .6, Instructions: 571COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 81a3d2451578812f674f58c87fc5384c8f0f0cbaaffa838fd41fab44c73c894c
        • Instruction ID: 32081a8579003c6945486cedc90a1e57d5e8465d5f10fcba107afb1aca72d749
        • Opcode Fuzzy Hash: 81a3d2451578812f674f58c87fc5384c8f0f0cbaaffa838fd41fab44c73c894c
        • Instruction Fuzzy Hash: 90225035A002168FDB1DCF5DC4906BAB7B2FF89314B1845ADD965EB345DB30E942CBA0
        Function 01ADFB80 Relevance: .6, Instructions: 559COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3c1facfeb2ce7619f25be4d34afd63be15b9988d5c902c9901765d4abe20a22a
        • Instruction ID: 7c8670bb48bdd239cc0a5176e1d40be2fc601a330a9cd87c68d4a9407873aa42
        • Opcode Fuzzy Hash: 3c1facfeb2ce7619f25be4d34afd63be15b9988d5c902c9901765d4abe20a22a
        • Instruction Fuzzy Hash: CC22FA7090021AEFDF19EFA8C480BAFB7B5FF44300F1442A9E9199B245EB74DA45CB90
        Function 01AD8DBF Relevance: .6, Instructions: 554COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 11335a3224b554b9e1fd7ecaecdc7a03b0a13d49260c0dc0efc6bdeb53424fde
        • Instruction ID: a358f12595de7c74c0c530514cadb805ff1e6a17a2f6e6cdc6c3238cb4122811
        • Opcode Fuzzy Hash: 11335a3224b554b9e1fd7ecaecdc7a03b0a13d49260c0dc0efc6bdeb53424fde
        • Instruction Fuzzy Hash: 5D226F70E006169BCB19CF99C4809BEFBF2FF48314B59809AE94697245E738ED41CBA0
        Function 01B72446 Relevance: .5, Instructions: 485COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 62ff687058879bce912cfb4feed30403a9edf8fbdf1253855793c6dd624cd728
        • Instruction ID: 5771e5491d3b690bbabb45c94dda406aed62c5bbd9f0d2948b63335036abe0ce
        • Opcode Fuzzy Hash: 62ff687058879bce912cfb4feed30403a9edf8fbdf1253855793c6dd624cd728
        • Instruction Fuzzy Hash: B902D175A046518BEB2CCF2EC550275FBF1EF85300B1981DAE9E6DB282D335E942DB60
        Function 01B05630 Relevance: .5, Instructions: 458COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 743c94b24dba1edfdbdbc7f9e1d66971d251120f723e29e2eaeff24ce68898bf
        • Instruction ID: ffb0d5ffaedd461392ff03f0fc5286a20521a18151f0aafea998c91714caa2ef
        • Opcode Fuzzy Hash: 743c94b24dba1edfdbdbc7f9e1d66971d251120f723e29e2eaeff24ce68898bf
        • Instruction Fuzzy Hash: FDD14573B6471C4FC384DE6EDC82381B2D2ABD4528B5D843C9D18CB303F669E91E6688
        Function 01B741A2 Relevance: .5, Instructions: 452COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ae628c27a43b1b06cfe08a25fd6ccbf3a9446b6d64c6b79558401fd9e5184817
        • Instruction ID: f5934326c7ccb2c106f531cce6fd9e35e4d83a2243fa5f6e76711939d3f24bef
        • Opcode Fuzzy Hash: ae628c27a43b1b06cfe08a25fd6ccbf3a9446b6d64c6b79558401fd9e5184817
        • Instruction Fuzzy Hash: EF02B371E00215CFCF09CF9CC4806ADBBB2FF49305F2986A9E566AB351D731AA42CB50
        Function 01B8B16B Relevance: .4, Instructions: 450COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6011882b89df479a80a00dc55ccbbd0ab39c736728a9977fa21f5c0dcadef485
        • Instruction ID: 2fdb4f787c5ddb000bc41771edca14eed567fa06f6aaffa85d95aa990c645b72
        • Opcode Fuzzy Hash: 6011882b89df479a80a00dc55ccbbd0ab39c736728a9977fa21f5c0dcadef485
        • Instruction Fuzzy Hash: 6CF1E172E006158BCB1CEE79CAA167EBFF5EB8861071941A9D856DB381E734EA01CB50
        Function 00F200F3 Relevance: .4, Instructions: 435COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
        • Instruction ID: feb7aaaeac1576c6808553a86c6678dced8ce1686b4230548f18f1063e71f4a1
        • Opcode Fuzzy Hash: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
        • Instruction Fuzzy Hash: 74026F73E547164FE720CE4ACDC4725B3A3EFC8311F5B85B8CA142B613CA39BA525A90
        Function 01B8A9A6 Relevance: .4, Instructions: 425COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0fd6b942a2f09133b0a06821af366f3badec11b3682d724b578fab5aca8a97ee
        • Instruction ID: b79f2e1da025765fd391d8bac165b2a2adcfab351927d8c59c18b2ebfac9c07d
        • Opcode Fuzzy Hash: 0fd6b942a2f09133b0a06821af366f3badec11b3682d724b578fab5aca8a97ee
        • Instruction Fuzzy Hash: ACF1C372E005269BCB1CEE78C5A05BDFBF5EF5461071942AAD856EB380D734EE41CB90
        Function 01AD4A35 Relevance: .4, Instructions: 423COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
        • Instruction ID: 11557015e8c2604c8554c806c84da42bcc2d1849ecd48ac6519a1f0f8def48a1
        • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
        • Instruction Fuzzy Hash: 04F19F70E0060A9BDF19CFA9C580BAEBBF5FF48710F498169E942AB754E734D841CB60
        Function 01B62F30 Relevance: .4, Instructions: 412COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c2a072dac7886edb0b701dc2a5db406c913add0e1a17bdc002566c78d656fc74
        • Instruction ID: 125ef9f90affe0d83701efa2cabeecdcda94a06876d6acc41c76b1ab926d7743
        • Opcode Fuzzy Hash: c2a072dac7886edb0b701dc2a5db406c913add0e1a17bdc002566c78d656fc74
        • Instruction Fuzzy Hash: 41E1F671E042859FEB28CFACC4807BEBBF5FF58310F044599D49AAB291D7399985CB50
        Function 01B4892B Relevance: .4, Instructions: 386COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5596878e7f22e244c4bf0ef896826d8a5c74c57c23d0d39c6b99d598af7003da
        • Instruction ID: eb0ec88331f2e33e0c5eed31533986e04096767d9d49fc660e6811260cfff4c7
        • Opcode Fuzzy Hash: 5596878e7f22e244c4bf0ef896826d8a5c74c57c23d0d39c6b99d598af7003da
        • Instruction Fuzzy Hash: 5CD1F071A0060A9FDF09CFA9C881AFEB7F1EF88304F18C1A9D955E7241E735E9059B60
        Function 01AB65D0 Relevance: .4, Instructions: 383COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5d7cc1fd82a648bbdea5b747c7dc00896bd94ea021ba1cc334d43f15d4739f88
        • Instruction ID: 3e20e5671959919ec5eb80eeb46f91e709024585cf942bf8c0bb08cfb0a32252
        • Opcode Fuzzy Hash: 5d7cc1fd82a648bbdea5b747c7dc00896bd94ea021ba1cc334d43f15d4739f88
        • Instruction Fuzzy Hash: 1BE16D71508382CFC715CF28C5D0AAABBE4FF89314F05896DE99987352EB31E945CB92
        Function 01AA8397 Relevance: .4, Instructions: 380COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 63d1ad296397b945185ac4e09dd1b08436dbbe935c5c12d9dd9ed41d15843f99
        • Instruction ID: 7167a8176f0cfcca0a2e63c0427e765804ddfe719239bbb9d36daf00e0f09d1a
        • Opcode Fuzzy Hash: 63d1ad296397b945185ac4e09dd1b08436dbbe935c5c12d9dd9ed41d15843f99
        • Instruction Fuzzy Hash: C8D10171A002069BDB19CF68C980EBABBB5FF54305F48426DF912DB2C1EB38E950CB50
        Function 01ADC6E0 Relevance: .4, Instructions: 367COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7237cd20148a58c76f1619ab9bb9beae72b839602db8b64b5a756dc6fa71d260
        • Instruction ID: 241b8a82bf997b752f51855bb41a54beac84d14db4a762924a2a1352b9142146
        • Opcode Fuzzy Hash: 7237cd20148a58c76f1619ab9bb9beae72b839602db8b64b5a756dc6fa71d260
        • Instruction Fuzzy Hash: 9BD17D32E04A198BEB29CF8CC5457BDBBB2FB44320F99806ED943E7299D7748941CB45
        Function 01B895C3 Relevance: .3, Instructions: 326COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c442db4c496353c09647d9b2d4eea027066bab2a00adc1f36dbb009573c0c4a2
        • Instruction ID: 5b27769470f3ee8c81d70480df4cc17428f21beba657bd0ad65e332d4b45f25d
        • Opcode Fuzzy Hash: c442db4c496353c09647d9b2d4eea027066bab2a00adc1f36dbb009573c0c4a2
        • Instruction Fuzzy Hash: 29B199B1910116AFFF299B64CC55FBB76ACEB44B54F0442DABA19E71C0DB709E80CB60
        Function 01B38243 Relevance: .3, Instructions: 322COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
        • Instruction ID: 7b4e401705bb4c5dab21db36131815b0b4596489492c10b8344955b51db1e4ee
        • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
        • Instruction Fuzzy Hash: 31B16374A006059FDF28DF99C980AABBBBAFFC4304F10459DBA5297790DB34E919CB11
        Function 01AC0535 Relevance: .3, Instructions: 300COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
        • Instruction ID: ad717ca8d09a25d59b66fb692a78fa4cd778030c44965ba92a8ea2734db7dd1e
        • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
        • Instruction Fuzzy Hash: 2FB12535600646DFDB29DBA8C950BBEBBF6EF88700F194199E6429B385D730ED41CB90
        Function 01AB83C0 Relevance: .3, Instructions: 281COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 02ffbf8b2d951ceb74314e4a365921b56250157eaf294bfa5bec4bc5d286c705
        • Instruction ID: cbb8e8543e58cf97fef9d1218aa772733e800db5f89f07cbcd7417a189730c70
        • Opcode Fuzzy Hash: 02ffbf8b2d951ceb74314e4a365921b56250157eaf294bfa5bec4bc5d286c705
        • Instruction Fuzzy Hash: 3BC148751083818FE764DF29C484BABB7E9FF88304F45496DEA8987291D778E904CF92
        Function 01AAC427 Relevance: .3, Instructions: 280COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9f6f17589fd667f34e468a03b7d35c314bfd741d5d9103b0e00176e48b08b201
        • Instruction ID: b5468913fed293aac6728aebba6192a747ec38ba72ee9f57d02922613a2fa6ca
        • Opcode Fuzzy Hash: 9f6f17589fd667f34e468a03b7d35c314bfd741d5d9103b0e00176e48b08b201
        • Instruction Fuzzy Hash: 5AB19670A002668BEB25DF68C990BA9B7F5EF44710F4485E9E54AE7285EB30DDC5CF20
        Function 01ADE5E7 Relevance: .3, Instructions: 278COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f20e55bb4083b486d98e94c7864c19791f31448c616076d217f22eaa238ec273
        • Instruction ID: 52e2a8ca94682bf72f7d156f9fb43bcc6ee0a7ea9bbfd2321ea3d832a56a8a85
        • Opcode Fuzzy Hash: f20e55bb4083b486d98e94c7864c19791f31448c616076d217f22eaa238ec273
        • Instruction Fuzzy Hash: 37A10731E00A199FEB26DB98C944BBEBBB4FF00714F060199EA12AB2D5D7749D44CBD1
        Function 01AF0185 Relevance: .3, Instructions: 276COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a4ca6247fb058385ec507e55060d44c034a36c83bf889060db404128e9327c81
        • Instruction ID: 473bbe5ca56b8cce8e5cc5fee56230615d1f04f1c6f7ea8743f4c0b8d297e1b0
        • Opcode Fuzzy Hash: a4ca6247fb058385ec507e55060d44c034a36c83bf889060db404128e9327c81
        • Instruction Fuzzy Hash: 1AA1A170B006269BDB25DFA9C690BAAB7B2FF54314F14412DFB4997283DB34E805CB50
        Function 01B84500 Relevance: .3, Instructions: 275COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f312fcffb42e39ea510fab3a8f8cbdb40fa30e35fc0eba988345f44974f8b5f8
        • Instruction ID: bed8a65f94985247f59e53c76c121fadb0a88feb35eda0f22b0eb4a42f6130ca
        • Opcode Fuzzy Hash: f312fcffb42e39ea510fab3a8f8cbdb40fa30e35fc0eba988345f44974f8b5f8
        • Instruction Fuzzy Hash: 8AA1DF72A14212DFC719EF18CA80B6ABBE9FF58B04F4505ADF5459B651D734EC00CB91
        Function 01B82B57 Relevance: .3, Instructions: 266COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
        • Instruction ID: 158000ab35018f22ffe3d8e0337a6a991d96d355be90f518036d8c0f557be5b5
        • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
        • Instruction Fuzzy Hash: E5B14771E0061ADFDF29DFA9C980AADBBB5FF48710F1481A9E914A7390D730A941CF94
        Function 01B360E0 Relevance: .3, Instructions: 264COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1a2ee64800cbb5a10e2ffb8858827c51fa8bc90c9fd19062c17626ae9b78a638
        • Instruction ID: eb3138def3ee3b581c25cd72cd52f59e1981fdf0badf43fc6ee695cb88d88817
        • Opcode Fuzzy Hash: 1a2ee64800cbb5a10e2ffb8858827c51fa8bc90c9fd19062c17626ae9b78a638
        • Instruction Fuzzy Hash: BE916371D00616BFDF19CF69D884BAEBBB5EF88710F154199E610EB241D734DA109BA0
        Function 01ACE3F0 Relevance: .3, Instructions: 261COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6cb894ea011624e98758243c6adf0788fbb842328694928eccc75e1b01965c18
        • Instruction ID: 67e9112828d309bd240a893f4eb946070e0e589ec7191df975b454a77c956967
        • Opcode Fuzzy Hash: 6cb894ea011624e98758243c6adf0788fbb842328694928eccc75e1b01965c18
        • Instruction Fuzzy Hash: DD913671A00656CBEB28DB6CC540BBABFB2EFA4B14F0940ADED059B285EB34D901C751
        Function 01AE4750 Relevance: .3, Instructions: 251COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9a4050b41c6a135279948fe63c017d1f443f312da45434136b065312031d96b8
        • Instruction ID: 67ff4584f457aa4c94b6d7a994c307017d2972cb83b9a75059183bce67a5ed21
        • Opcode Fuzzy Hash: 9a4050b41c6a135279948fe63c017d1f443f312da45434136b065312031d96b8
        • Instruction Fuzzy Hash: BB814D31A443A58BDB164EADC8C526DBBF8FF5F200F2C46BAD546CB241C368984AD791
        Function 01AFDBF9 Relevance: .2, Instructions: 244COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8549c86322cfe958a29a8ef1ef3c7120cca5d0c53e5cdecc8be8a9795373b755
        • Instruction ID: 41e2c8167b0496cc2e5734fddfd4efc39d05475e32c9ac3295f74587556ff062
        • Opcode Fuzzy Hash: 8549c86322cfe958a29a8ef1ef3c7120cca5d0c53e5cdecc8be8a9795373b755
        • Instruction Fuzzy Hash: 3C913272511A068FE726CFADC885662BFE0FF55325B188A1CE6E6DB6A0C375E511CB00
        Function 01B7F7B0 Relevance: .2, Instructions: 242COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1cba330e7952971d324bb1d3f9e92653d7848f2fc8acfd504173c4ada158e07e
        • Instruction ID: ebe8870c3fb601d0bd80183e4a1a9aac338c0d43507111ccb50a4c2531ef2049
        • Opcode Fuzzy Hash: 1cba330e7952971d324bb1d3f9e92653d7848f2fc8acfd504173c4ada158e07e
        • Instruction Fuzzy Hash: 2791C471A00216EBEB19CF68C98077ABBE1EF54310F1585BCE975DB281E774E901CBA4
        Function 01B7F43F Relevance: .2, Instructions: 241COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 45095599da9c33a5dd35bdb06479b1fba14c554e2b82b3618e0184cfe855a34e
        • Instruction ID: 51abc6a8c86df8a1ff3a81b6d1f09a842ac31aa6afe95093f12a57ebf4824e13
        • Opcode Fuzzy Hash: 45095599da9c33a5dd35bdb06479b1fba14c554e2b82b3618e0184cfe855a34e
        • Instruction Fuzzy Hash: A491D072A001058BDF18CF79C8916BABBF1EF88310B1982BDE865DB296D734D905CB54
        Function 01B781CC Relevance: .2, Instructions: 232COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 499ee6842465f1fae4cebea99ab91b472a3b2311b22407321e05f408066843b4
        • Instruction ID: 888b8e03bf44c4a0e1402a8196ade4f9e959136d32cdd3705bb7490413f5262a
        • Opcode Fuzzy Hash: 499ee6842465f1fae4cebea99ab91b472a3b2311b22407321e05f408066843b4
        • Instruction Fuzzy Hash: 8981A471E005199BCB18CF6DC8C85AEB7F1FF88311B1943AAE935E7290D7749951CB90
        Function 01AC0E59 Relevance: .2, Instructions: 231COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9093419ceee75356346243761677ede0ff0e2316b7fe4ff60c607651ac4a33e0
        • Instruction ID: 10f6811d0c7bec9ba9a12cd7a78cf365c6f877b34bcde61c83eb9937fcfad681
        • Opcode Fuzzy Hash: 9093419ceee75356346243761677ede0ff0e2316b7fe4ff60c607651ac4a33e0
        • Instruction Fuzzy Hash: 9781B075A00119DFDB24CF5DC9809AEBBB2FFC5610B298299F8549B34AD730E941CBD0
        Function 01B06ACC Relevance: .2, Instructions: 226COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1ccc598efc03b2e6ff109b5de3705234dd2ffbe79c1fd214967e10e007a524ee
        • Instruction ID: 5f0ec4be00d843318c86c96b497800e5a78e59d50d6c6fe624dfc5f1580f42e6
        • Opcode Fuzzy Hash: 1ccc598efc03b2e6ff109b5de3705234dd2ffbe79c1fd214967e10e007a524ee
        • Instruction Fuzzy Hash: 8281B4B1E006169FDB29CF69C940ABEBBF9FB48700F04852EE545E7680E734D951CB94
        Function 01B6E4F6 Relevance: .2, Instructions: 224COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b63aae5b904f4d8d795c6cda666bcc1e78c1edc1152f2b3464ced44bd7fd240f
        • Instruction ID: 1bd3f3ccdecf1c323ace120860468c463ad8d941362e1b854682ea7029547578
        • Opcode Fuzzy Hash: b63aae5b904f4d8d795c6cda666bcc1e78c1edc1152f2b3464ced44bd7fd240f
        • Instruction Fuzzy Hash: 0C81A076E002159BCF18CF98C5906ADFBF5EF98310B1981AAD816EB385D734DD41CB90
        Function 01B7AB40 Relevance: .2, Instructions: 222COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
        • Instruction ID: e2ce7ed67deeb7760dd5aedff69827ec2ca5d48fdf509c13157ee9ac356c8c93
        • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
        • Instruction Fuzzy Hash: A2815371A002099FDF5DCF69C890ABEBBB6FF84310F1885A9D9259B385DB74E901CB50
        Function 01AEE284 Relevance: .2, Instructions: 212COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a344f169468b429762ea7246f8b0abed5a0aa9d10d5cbca4306b2d7a16e0d1c7
        • Instruction ID: 598d518fdbeaaaab0c20b5a37a3711ad3326194c1a11ce2fade5abfbd8ac64a3
        • Opcode Fuzzy Hash: a344f169468b429762ea7246f8b0abed5a0aa9d10d5cbca4306b2d7a16e0d1c7
        • Instruction Fuzzy Hash: FA817E71A0061AAFDB25CFA9C984BEEBBF9FF48314F14442AE559A7250D730AC45CB60
        Function 01ADB950 Relevance: .2, Instructions: 209COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 017bae413304163711e9d49e6e6e61b087101035dc88b2b470f7828045c537fc
        • Instruction ID: 48781b91e3874be691e20b3ac7003e6d9a5759cdc35dc4de4daa4a076f770c70
        • Opcode Fuzzy Hash: 017bae413304163711e9d49e6e6e61b087101035dc88b2b470f7828045c537fc
        • Instruction Fuzzy Hash: 0A710730200A508FE729CF2AC94073677E1AB86705F9A8599F997CB1D8D735E802CB71
        Function 01ACC640 Relevance: .2, Instructions: 206COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3cdcce4730260469ee9f8c640e9d7cb08d4d56675502d7fa7cdb4632551bf4a6
        • Instruction ID: 0293d68a7c4f59416f808b970e400929fab561e10792905bc556de1547d2e256
        • Opcode Fuzzy Hash: 3cdcce4730260469ee9f8c640e9d7cb08d4d56675502d7fa7cdb4632551bf4a6
        • Instruction Fuzzy Hash: 9D71D1B5D00629DBCB29CF59C9907BEBBB0FF48B10F99415EE856AB358D3349800CB90
        Function 01B647A0 Relevance: .2, Instructions: 202COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: bc183d85abbb87e3ce22e23c38d9267c055ad12a6ece07c45dae79b1e2f21ca6
        • Instruction ID: 6963e833d24323bda1078df668cae617287dbc08e18f64827c20a622024be297
        • Opcode Fuzzy Hash: bc183d85abbb87e3ce22e23c38d9267c055ad12a6ece07c45dae79b1e2f21ca6
        • Instruction Fuzzy Hash: AC71B4B1900605EFDB28CFA9DA41A9EBBFCFFA4340F44419AE654A7298D735C940CF54
        Function 01AC260B Relevance: .2, Instructions: 201COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 48783e4dfa36c33021ca4f9bfff746acc1083354edd3d2ad312bfbce70af6638
        • Instruction ID: 0a95347e891eba167b8e8e652e102f86dc0b28827a9a66f3b7c680cb0530511b
        • Opcode Fuzzy Hash: 48783e4dfa36c33021ca4f9bfff746acc1083354edd3d2ad312bfbce70af6638
        • Instruction Fuzzy Hash: E471D0356042428FD716DF2CC480B6AB7E5FF84710F0985AEE899CB352DB78D845CBA1
        Function 01B770E9 Relevance: .2, Instructions: 201COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 180fb4c11d79d266a6ba2c2e3cb3f3260d17c6e43b1d1a097e10a3fbe4bfc06b
        • Instruction ID: 22fc76b9d3dfacd26fcb4cb641d1bbfd55f9fa2c032eddfaa52e362744ef38c0
        • Opcode Fuzzy Hash: 180fb4c11d79d266a6ba2c2e3cb3f3260d17c6e43b1d1a097e10a3fbe4bfc06b
        • Instruction Fuzzy Hash: D0611A71E0021B9BDF19EEA9C898ABFB77AEF54200F1044BAE93197640DF34D941CB90
        Function 01B6F0CC Relevance: .2, Instructions: 199COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e6a5a4a66a15aabc470b2df4e66543198703a2b6ba680a275b21f386c17d3145
        • Instruction ID: 7512397281ba873d2a2acca87bf2505d7fe157b6bcc298ad02c55a9aa63493ec
        • Opcode Fuzzy Hash: e6a5a4a66a15aabc470b2df4e66543198703a2b6ba680a275b21f386c17d3145
        • Instruction Fuzzy Hash: 1271AF79A01622DBDB28CF5EE0A017AB7F9FF65744B6444AEE94297240D378E980CF50
        Function 01B3035C Relevance: .2, Instructions: 198COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
        • Instruction ID: a88496d2f4d3e0aab06816e22784e51410249c06749e97dcdfa377b109113857
        • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
        • Instruction Fuzzy Hash: 32716D71A00609EFDF15EFA9C984AEEBBB8FF98700F104569E505E7290DB30EA15CB50
        Function 01B462A0 Relevance: .2, Instructions: 198COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4ed44213b4e9b34a5549cb22c70b4cf0a4c5620bc7501bab8bdc43de7b3a0eaa
        • Instruction ID: 827ed4185a2e17c93e18735b60f7a65e83fe576700a1ba6c85712492e20b45a4
        • Opcode Fuzzy Hash: 4ed44213b4e9b34a5549cb22c70b4cf0a4c5620bc7501bab8bdc43de7b3a0eaa
        • Instruction Fuzzy Hash: 0B710232200701AFEB3ADF18C984F6ABBA6EF41720F14859CE655972A0D774E944EB50
        Function 01AB8AA0 Relevance: .2, Instructions: 197COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7462aa2d7f697e2aff33462977040424ac591118ed5a0d2cd630a8b967c8c20e
        • Instruction ID: 7de62a90b9d3692672525bedfc86c274af338ec474154a8b4ab62f214053da97
        • Opcode Fuzzy Hash: 7462aa2d7f697e2aff33462977040424ac591118ed5a0d2cd630a8b967c8c20e
        • Instruction Fuzzy Hash: 4C819072A04345CFDB28CF9CD584BEDB7B9EB48310FAA41ADD9046B286D7759D40CB90
        Function 01B88324 Relevance: .2, Instructions: 192COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a7ec6fd6c023581763888fece98c64d5301c1765c1b65bc9e86ff0aeb9fa58eb
        • Instruction ID: 870caada9641c07e4b088f45495280ecc677036086cb07ac5f3d15639f0c61b3
        • Opcode Fuzzy Hash: a7ec6fd6c023581763888fece98c64d5301c1765c1b65bc9e86ff0aeb9fa58eb
        • Instruction Fuzzy Hash: 88710A71E0020AAFDF15DF94C981FEEBBB9FF04750F504269F621A6290D774AA05CBA0
        Function 01B6A250 Relevance: .2, Instructions: 184COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 46d278a52730fc8e8d25c8ac72642653bc0628bfc48fe07ac16667f1b09c9761
        • Instruction ID: 469fc695209ae467a5c52835a7c470c78ea8238d2bbf134fc5aea26f5fce78d7
        • Opcode Fuzzy Hash: 46d278a52730fc8e8d25c8ac72642653bc0628bfc48fe07ac16667f1b09c9761
        • Instruction Fuzzy Hash: 0651CF72504712AFDB15DA78C894B5BBBECEBD8750F0009A9BA40EB150D778ED05C7A2
        Function 01B7CE93 Relevance: .2, Instructions: 172COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: adaef8c90542e90ae6fae2448e28977f4ff712f71b9da8e8631f75b3b546fe51
        • Instruction ID: 61d3ebd8f08abc40380bf406feaca136323e4a69afad393dad62a1b796293bea
        • Opcode Fuzzy Hash: adaef8c90542e90ae6fae2448e28977f4ff712f71b9da8e8631f75b3b546fe51
        • Instruction Fuzzy Hash: 635127326046034BDB19EE2D886076BBFD6EFD1290F1985ADE9B5CB242DB30D9098791
        Function 00F1FED3 Relevance: .2, Instructions: 165COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
        • Instruction ID: ab6ecc32cca4b6136132a8e6c008ff241af2c5d36fb0f8f2d593f08df8c2a6f6
        • Opcode Fuzzy Hash: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
        • Instruction Fuzzy Hash: D55170B3E14A214BD318CE09CC40635B792EFD8312B5F81BADD199B357CE74E9529A90
        Function 01B58350 Relevance: .2, Instructions: 161COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 44817ba1a4536406c4823e780f4ebd969573c113deec48f766bc99efe4b2b5b6
        • Instruction ID: be8ef505c2c12eeb37cc065aa7997f0ef5136deb594a0d96ac7d8d27da2f3ec2
        • Opcode Fuzzy Hash: 44817ba1a4536406c4823e780f4ebd969573c113deec48f766bc99efe4b2b5b6
        • Instruction Fuzzy Hash: 8E51DE709007059FDB69CF5AC880B6BFBF8FF54710F10465EEA52576A1C7B0A545CB50
        Function 00F1FECB Relevance: .2, Instructions: 160COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 592fd677240d8328b67129da49d60a51a55bd863db21eba15102e8dc3ad4d84a
        • Instruction ID: 83edb4a6ad210473cf66feac30fd2da5e1eeba31d201399ab0f834cba27366f2
        • Opcode Fuzzy Hash: 592fd677240d8328b67129da49d60a51a55bd863db21eba15102e8dc3ad4d84a
        • Instruction Fuzzy Hash: FF5192B3E54A214BD318CF09CD50631B692EFC8312B5FC1BECD199B357CE74A9529A90
        Function 01AEE443 Relevance: .2, Instructions: 158COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e864d3952e8d806791593e5274d3f281208a0d5a3524c4f3a800358a6e499eb2
        • Instruction ID: 4d03e22b1ec1f3ab02054ac1fffdde8276d0ee361b1ba0bd4d8465f8b6bd8368
        • Opcode Fuzzy Hash: e864d3952e8d806791593e5274d3f281208a0d5a3524c4f3a800358a6e499eb2
        • Instruction Fuzzy Hash: E6519E31200A15EFCB22EFAACA84EAAB7F9FF14744F40046EE50597261D734E944CB60
        Function 01B54180 Relevance: .2, Instructions: 156COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 08fc8a4b25bf0f49e3a60fb0e16e107fef56b12d51f68ec53295bbfedd139179
        • Instruction ID: 0717cb5031704b8139eb7b6c4a639871458ef1a5da40cfa0a4711c54ecd70a10
        • Opcode Fuzzy Hash: 08fc8a4b25bf0f49e3a60fb0e16e107fef56b12d51f68ec53295bbfedd139179
        • Instruction Fuzzy Hash: 045136716083029FD798DF29C980A6BBBE5FBC8204F44497DF999C7261E730D946CB52
        Function 01AD45B1 Relevance: .2, Instructions: 156COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
        • Instruction ID: f50bb2a4b920a751153a068aa3d4e5b05a99b4a6734d9c195f551125c098c4e0
        • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
        • Instruction Fuzzy Hash: EC51AF71E0061AABDF15DF98C540BEEBBB5EF49750F054069EA06EB640E734DE44CBA0
        Function 01B2D800 Relevance: .2, Instructions: 155COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 947d0e2062c25a06afcfba03a0a84d9d82a6c6763c0f9ba38c5e305ac8d95572
        • Instruction ID: 167aacaf81985934e8ca31b90788d7757b351fcda5482f2a40d4bb5f965feb67
        • Opcode Fuzzy Hash: 947d0e2062c25a06afcfba03a0a84d9d82a6c6763c0f9ba38c5e305ac8d95572
        • Instruction Fuzzy Hash: 4951F370600226DBDB18DF98C480ABDBBF5FF45700B0542A9E949DB680E775D854CB90
        Function 01B3E9E0 Relevance: .2, Instructions: 154COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
        • Instruction ID: b023c32aca32e355945f9daa4ad2834ccc908c4e7be664a8e7cc1af530cb649f
        • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
        • Instruction Fuzzy Hash: AB51B971D0020AEFDF2A9B94C9C0BAEBB75EB80314F154696E611A7190E730DD558BA0
        Function 01B77571 Relevance: .2, Instructions: 153COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 14b5d2cccdb8f8420e71279e253bcaabe1b73925490eebee535ac5179fe24752
        • Instruction ID: 8e598055bed79e88014a85b6b00cac0b3493261fcff63d51bd3471904114ddb6
        • Opcode Fuzzy Hash: 14b5d2cccdb8f8420e71279e253bcaabe1b73925490eebee535ac5179fe24752
        • Instruction Fuzzy Hash: 3E51C431A0011AABDF199B68D888A7EFBF5FF48354F5441A9E921E7254DB70ED11CBC0
        Function 01B78B28 Relevance: .2, Instructions: 152COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 401b7f0dd59e7d002a046d4bd017b76aee0ca21e6e72098847195ed9999484b4
        • Instruction ID: a7f6b6fee4a04b99b29dadc8cfaaec1142a8f751672bcdb9faa7ac019007815e
        • Opcode Fuzzy Hash: 401b7f0dd59e7d002a046d4bd017b76aee0ca21e6e72098847195ed9999484b4
        • Instruction Fuzzy Hash: FB41F7707016019BEB2DDB2DC898F7BBB9AEF94220F088299E975C7390DB31D841C691
        Function 01B3CBF0 Relevance: .1, Instructions: 148COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 42bad84aeea878d6c3958ffce80735be552f1f3f699e33055037484d18138a73
        • Instruction ID: a9f68e2417738242ba34785bb1b9c76cd36a12d2928980c69184794236c11fe2
        • Opcode Fuzzy Hash: 42bad84aeea878d6c3958ffce80735be552f1f3f699e33055037484d18138a73
        • Instruction Fuzzy Hash: 21519CB190021ADFCB24DFA9C98499EBBB9FF88314B95455AE505B3301DB34AD11CFD0
        Function 01B35BF0 Relevance: .1, Instructions: 145COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c8f65733137bd98281cff674769e8bf9c04537ea9addb09e40b8e0a895def418
        • Instruction ID: ba8ca9b67e5c42b7034d73b222d4480d76dcb226ac47fcbce83586f095cd7925
        • Opcode Fuzzy Hash: c8f65733137bd98281cff674769e8bf9c04537ea9addb09e40b8e0a895def418
        • Instruction Fuzzy Hash: 1C413D71B547065BCF3DFFB9C942A9E77E09FA4B11B8401AEE802E7240EF3489114B95
        Function 01AEA430 Relevance: .1, Instructions: 139COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 70c7f97cf10db960cd38e7084ddabd06c6b65cc4f9a83f640463c1ccfbb4310f
        • Instruction ID: d76caf7bf24d24e467622fe15bf91dccf6cc0eaa00bb25d1da544e806176d7ed
        • Opcode Fuzzy Hash: 70c7f97cf10db960cd38e7084ddabd06c6b65cc4f9a83f640463c1ccfbb4310f
        • Instruction Fuzzy Hash: 984137717403129BDB3EEF68D986FAA77B4EB94708F44006DFE069B246D7719804D7A0
        Function 01B7A9D3 Relevance: .1, Instructions: 139COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
        • Instruction ID: fc375f1d05ebdaa4cae4874aa8656483ee7eddeb173458f571fa92fca24d6368
        • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
        • Instruction Fuzzy Hash: 0541E9716007169FDB6DDF78C980A6EB7A9FF90210B0946AEE96287340EB30ED14C790
        Function 01AE01F8 Relevance: .1, Instructions: 138COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8e8b97293308fb3f90b97b2cab68ae4958d3154dc0a4023fe4a6d956da28939a
        • Instruction ID: bf41cce94981cc8d921ac655018adba91b9194349f3ebcefa4d4032a01e743aa
        • Opcode Fuzzy Hash: 8e8b97293308fb3f90b97b2cab68ae4958d3154dc0a4023fe4a6d956da28939a
        • Instruction Fuzzy Hash: 5D41DD32A0121A9BDB15DF98C644AEEBBF4FF48700F18816AF915F7240D7B49C42CBA4
        Function 01ADEBFC Relevance: .1, Instructions: 138COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ff59d1138320aadd76e236b3d06e23770e05082d03889921d88af86c885c3bc9
        • Instruction ID: 115faa958165001c2ee7c675e40fa43f20015064d1bbc4d374a94ac933cf21ba
        • Opcode Fuzzy Hash: ff59d1138320aadd76e236b3d06e23770e05082d03889921d88af86c885c3bc9
        • Instruction Fuzzy Hash: 1541AF712047029FDB24DF28C984A6BB7F9FF88214F45486EE557CB215EB35E849CB90
        Function 01AF2750 Relevance: .1, Instructions: 137COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
        • Instruction ID: 9f998bd27bb9f99d702bae34b7a622dbe9801f3f4a37a0735d16271c84350220
        • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
        • Instruction Fuzzy Hash: E3516C75A00625CFCB19CFA9C480AADF7B2FF88710F2481A9D929A7751D730EE45CB90
        Function 01AB6154 Relevance: .1, Instructions: 133COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c2e5c2f8704afd03d68a600eeae80c2a0b3b351ec483225dd78e65bcb521377b
        • Instruction ID: befe837f54c8ee11db17d66950209993a8be16e54e1ad70e3fce978fdb18bdc5
        • Opcode Fuzzy Hash: c2e5c2f8704afd03d68a600eeae80c2a0b3b351ec483225dd78e65bcb521377b
        • Instruction Fuzzy Hash: 4851E6B0D00246DBEB299B68CD40BE8BBB5FF15314F5882EAE519972C2E73499C1CF40
        Function 01AB0BCD Relevance: .1, Instructions: 130COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1504a9a5e4ccf0a54f1467bc3082cf54ae393c115c3baf4fd4deee86383fa869
        • Instruction ID: 67e9a9ca4bde115c35f3b7304483f1ae316e076e22d1311c7afa8f01f2d7b072
        • Opcode Fuzzy Hash: 1504a9a5e4ccf0a54f1467bc3082cf54ae393c115c3baf4fd4deee86383fa869
        • Instruction Fuzzy Hash: A7418571A00268DBDB21DF68CA80BEE7BB8EF45750F0505A9E908AB242D774DE84CF51
        Function 01B7866E Relevance: .1, Instructions: 129COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
        • Instruction ID: fcce3889ff3aa68e4da09e66478dda83c30348049da07c1e36a6847f33601e34
        • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
        • Instruction Fuzzy Hash: 4B418575B00105ABDF19DF99CC98AAFBBBAEF88610F1440A9E915E7351DB70DD0187A0
        Function 01B7F0E0 Relevance: .1, Instructions: 129COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7292631e221e0e6710159ebbbeb5f1a3bd7d28cda1a8f6ad9b57f508136330e2
        • Instruction ID: 20fc9903f4f4204050b9012c695e14d652aebbe03cfae86d398a91d30eb4afb0
        • Opcode Fuzzy Hash: 7292631e221e0e6710159ebbbeb5f1a3bd7d28cda1a8f6ad9b57f508136330e2
        • Instruction Fuzzy Hash: 0F41B3712043418BD708CF29D8A597ABBE1FF85615F08459EF8E68B392CB30D819CB65
        Function 01AB0887 Relevance: .1, Instructions: 128COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 86355254d38bc14d0b77a24923cf3113e661420b6900dd0dfd2b9303880ec3be
        • Instruction ID: c456defe6b70f50b71a4ca9ea86ef69e7a370d4bcbf7eb9c62e783666a7a1a7c
        • Opcode Fuzzy Hash: 86355254d38bc14d0b77a24923cf3113e661420b6900dd0dfd2b9303880ec3be
        • Instruction Fuzzy Hash: 5841E2B06007819FE325CF68C680A63BBF9FF48314B148A6EE557C7A52E730E845CB90
        Function 01B5D5B0 Relevance: .1, Instructions: 128COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8b0122e86976129f0cb7e24d398e3352646e4f885167fa17ed288640ef97ed98
        • Instruction ID: 1f0a17e6ed9a722c168da6f9ede9649c303979bb421638c67a8647450b9ba5f7
        • Opcode Fuzzy Hash: 8b0122e86976129f0cb7e24d398e3352646e4f885167fa17ed288640ef97ed98
        • Instruction Fuzzy Hash: CA410230A082959FDB19CFA8C4917BAFBF1EF59300F0586C9E9C58B246C735A456DBB0
        Function 01ADA470 Relevance: .1, Instructions: 127COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b45ae9783807f4d444f3c971b28b59a6706a0a5cb4ad3a5a3c267e07f62a3ee7
        • Instruction ID: 3c14a9b021a4a1167acea97a770635a893df3e34d039e16f0b402888a331eec6
        • Opcode Fuzzy Hash: b45ae9783807f4d444f3c971b28b59a6706a0a5cb4ad3a5a3c267e07f62a3ee7
        • Instruction Fuzzy Hash: 76411132900604CFDF25EF68C5847ED7BB4FF08310F980599D412AB295DB75D900CBA0
        Function 01AB8BF0 Relevance: .1, Instructions: 124COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: aa496a1ea84045c237fb142b2e5e6aae721d47f3beb6e206e09a10b5c71701ca
        • Instruction ID: 7366283f3f8e0ad7c4060531bfbcdefa76fef64f3c9a46a7a4ae679e3f225191
        • Opcode Fuzzy Hash: aa496a1ea84045c237fb142b2e5e6aae721d47f3beb6e206e09a10b5c71701ca
        • Instruction Fuzzy Hash: A1412671900242CFD724AF4CC9C1AEABBBDFF95704F69802ED5049B25AD77AD801CB90
        Function 01AA8918 Relevance: .1, Instructions: 123COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d9ca2ba8d8a7e35ef6dcc8faef49c3e65ccea0248acf912a071b034ca0bb7e6e
        • Instruction ID: 607923711911ec82a996612ebbc05a0bfe93501ac5791db9631c9ad4732c841e
        • Opcode Fuzzy Hash: d9ca2ba8d8a7e35ef6dcc8faef49c3e65ccea0248acf912a071b034ca0bb7e6e
        • Instruction Fuzzy Hash: 0B416A315087069ED312DF69C940A6BFBE8EF88B54F44092EF984D7250E734DE058B93
        Function 01AAA020 Relevance: .1, Instructions: 122COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
        • Instruction ID: 704f041475c190599373baccd1ccec3eb3a8f6ef3c600d64a4621f2e0288d8fe
        • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
        • Instruction Fuzzy Hash: 03412C35A00211DBDB2BEF598550BBABFB1EB50764F9580AEE9459B280D7339D40CB90
        Function 01AB09AD Relevance: .1, Instructions: 122COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 810dc22f9d949e338a081096cf8a8fc5dff156f3d1a861fae636367e26844e35
        • Instruction ID: 11935c09eccb62293366265d39fc90383383903a90a036425137c5d9a67fb64a
        • Opcode Fuzzy Hash: 810dc22f9d949e338a081096cf8a8fc5dff156f3d1a861fae636367e26844e35
        • Instruction Fuzzy Hash: C4415B71640641EFD725CF18C980BA6BBF8FF54714F248A6EE449CB292E771E941CB90
        Function 01AE0710 Relevance: .1, Instructions: 121COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
        • Instruction ID: 216be7656d4844405ff17f2b051853f5939c603ac5b05e44d7294996a1b329b0
        • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
        • Instruction Fuzzy Hash: D5413A71A00705EFDB25CFA8CA94AAABBF4FF18700B10496DE596D7650D370EA44CF50
        Function 01AB262C Relevance: .1, Instructions: 119COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 298f58c2bbae3e71fdede44227513fbaee8c569ac827ad1c7da0b48132af55db
        • Instruction ID: 16e1adf9f770c4e908be057ddb3885a2502f3d3cf24e06ed2c25ea920aa5fd61
        • Opcode Fuzzy Hash: 298f58c2bbae3e71fdede44227513fbaee8c569ac827ad1c7da0b48132af55db
        • Instruction Fuzzy Hash: 4F41C5B1901745CFC726EF28CA907A9B7B9FF54310F1482AFC4169B2A2DB30A981CF51
        Function 01AEC8F9 Relevance: .1, Instructions: 116COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7d2cccfb10308fbc4200845de72cf6fb5c9ab91aa6760a70addb566fc0937987
        • Instruction ID: 89c1aee0af6f832cf0b3353375be86a9c5900ee77b148408e703be7d21fff3bb
        • Opcode Fuzzy Hash: 7d2cccfb10308fbc4200845de72cf6fb5c9ab91aa6760a70addb566fc0937987
        • Instruction Fuzzy Hash: 513189B1A01345DFDB16DFA8D540799BBF0FB09B24F2081AED119EB291D7369902CF90
        Function 01B307C3 Relevance: .1, Instructions: 114COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 90f500db5e9ea54e1db7eb73d810deac70ebec60b9ff8529601da745cb958e1c
        • Instruction ID: 8a65f884cd0508fe88766cd9955ec4b6f3b3b4a7e0444620888f58df401b3be4
        • Opcode Fuzzy Hash: 90f500db5e9ea54e1db7eb73d810deac70ebec60b9ff8529601da745cb958e1c
        • Instruction Fuzzy Hash: FF418CB2504305AFD720EF29C845B9BBBE8FF88764F004A2EF998D7250D7709915CB92
        Function 01B7EEDB Relevance: .1, Instructions: 113COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 66defd5dbbece99f4485ae82a861a20b83d0ee0a630b04d9c82f99867fc159db
        • Instruction ID: e43411b77fdac7f63a58de5cda168335676b4862d357d149cafa1788d44cc981
        • Opcode Fuzzy Hash: 66defd5dbbece99f4485ae82a861a20b83d0ee0a630b04d9c82f99867fc159db
        • Instruction Fuzzy Hash: AA41B333A0402A8BCB18DF68C491579B7F1FF48304B5A42FDE915AB295EB74AD05CB90
        Function 01AA80A0 Relevance: .1, Instructions: 111COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6b61faafb059b22a65f1406ef71abe1ec48b072113f312e3bbf2da2f6ed0201e
        • Instruction ID: 92c2ea1b85008f683bb8e2df6a4c691a41317a86f0a25bc25bc1a09d45bdbee1
        • Opcode Fuzzy Hash: 6b61faafb059b22a65f1406ef71abe1ec48b072113f312e3bbf2da2f6ed0201e
        • Instruction Fuzzy Hash: 1A410371E05716AFCB01DF18CA80AA8BBB5FF44761F54826AD816A7280DB39FD41CBD0
        Function 01B305A7 Relevance: .1, Instructions: 111COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f2c578f3f0d67e8eb11e0c03a9bd5d9928fe880c1ef716c526d270f20ca9a767
        • Instruction ID: ba5c73de05bd021bf095422b8c4c3983c1dd43a55926518dbc4403d2e5702d1f
        • Opcode Fuzzy Hash: f2c578f3f0d67e8eb11e0c03a9bd5d9928fe880c1ef716c526d270f20ca9a767
        • Instruction Fuzzy Hash: 3341C2726086469FC324EF6CC880A7AB7E9FFC8700F14465DF95497680E730E914D7A6
        Function 01AB4859 Relevance: .1, Instructions: 111COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 824c120597ebb1877538e39ebfb75caf71ccf82a6d1a364382c1b1a8c58a8d39
        • Instruction ID: 6307f5bc0597b41b821b29e8c4fe163c40eeb80330d6159538a23536102952f7
        • Opcode Fuzzy Hash: 824c120597ebb1877538e39ebfb75caf71ccf82a6d1a364382c1b1a8c58a8d39
        • Instruction Fuzzy Hash: 0D41D2706043429BDB25DF2CD9C4BAABBE9EF88750F14442DE642CB293DB30D841CB91
        Function 01AA8B50 Relevance: .1, Instructions: 111COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3b70069ce20c59b1e3c2b77f6c99d013aafabc417a585bf3473c8313b51d5294
        • Instruction ID: e75d6ed2ee85a690ccdd40b172d9c8172cbb9d1e83e3f3f5f237ff8f0c4a85ca
        • Opcode Fuzzy Hash: 3b70069ce20c59b1e3c2b77f6c99d013aafabc417a585bf3473c8313b51d5294
        • Instruction Fuzzy Hash: D641A171E01605DFCB15CF69CA809ADBBF1FF88321B54866ED466A72A0DB38A941CF40
        Function 00F1E173 Relevance: .1, Instructions: 108COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
        • Instruction ID: c9c2213c69b233e52cc653c6393be6362e865d63329f61ce013e6e98816104a5
        • Opcode Fuzzy Hash: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
        • Instruction Fuzzy Hash: B7319311A587F10DD31E836D08BD675AEC18E9720174EC2FEDADA6F2F3C0888408D3A5
        Function 01AC02E1 Relevance: .1, Instructions: 106COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
        • Instruction ID: 57af61b1d191fc76e6fe3a12cbea764df48ed9373136e6266d8d54d1e5e0f4be
        • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
        • Instruction Fuzzy Hash: D0310235A04244EBDB128BA8CD84BDABFE8AF14750F0841AAF815D7352C7749884CBA0
        Function 01B5E3DB Relevance: .1, Instructions: 105COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: da8c5adfbfc4e07e6d9970cffbe70b44d89e6000dd59c41dfcfe3cbb6761e5e3
        • Instruction ID: 5b2c599e518f172a301707c4aca09ff9c5989357a63d1516390c894a7a5037e3
        • Opcode Fuzzy Hash: da8c5adfbfc4e07e6d9970cffbe70b44d89e6000dd59c41dfcfe3cbb6761e5e3
        • Instruction Fuzzy Hash: 4D31B975740706ABDB269F559D41FAFBAB8EF58B50F000068FA00AB291DBA4DD01C7A0
        Function 01B64B4B Relevance: .1, Instructions: 104COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5117cd48beebf7c7d533175a9fa9d053b49fa182150e08248400247f2961cee6
        • Instruction ID: f9fc6e26324f68dd98860424d1ee71133c2f5c3a077aa95fa97be11d7478c0e0
        • Opcode Fuzzy Hash: 5117cd48beebf7c7d533175a9fa9d053b49fa182150e08248400247f2961cee6
        • Instruction Fuzzy Hash: 583104722056019FC329DF2DD880E26BBE9FB90360F0944AEE9958B355DB35EC40CB81
        Function 01AB4260 Relevance: .1, Instructions: 102COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ba0abafeeebc895ca43e064ff40a4915255fc830214cb8936e7c9ea7e7d478cb
        • Instruction ID: d3fbcc592f3b80977e97a00ecc356fb1e73addb4932fdcf868c9f22ca7abf18a
        • Opcode Fuzzy Hash: ba0abafeeebc895ca43e064ff40a4915255fc830214cb8936e7c9ea7e7d478cb
        • Instruction Fuzzy Hash: D641BA71200B459FD726EF28C981BD67BE8AF48710F19846DF69A8B252C730E840CB90
        Function 01B64BB0 Relevance: .1, Instructions: 101COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 98e192756eca3fc161b8bbbe4a62e9e317a0b95f34b4f638c9ebe8bae658dec7
        • Instruction ID: 5de10049b25b5dc9e50800f0e8dc7ef65c8eb54aedc2308a4e95415781724df0
        • Opcode Fuzzy Hash: 98e192756eca3fc161b8bbbe4a62e9e317a0b95f34b4f638c9ebe8bae658dec7
        • Instruction Fuzzy Hash: 5F31AD716046019FD328DF28C881A2ABBE9FB94720F0945ADF9959B398E734EC04CB91
        Function 01B2EB1D Relevance: .1, Instructions: 100COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 87e8f64d060ce657acae8f117e459f34bbcedaf9ede165fa7995e6b3467e09cf
        • Instruction ID: 9b447427e9cc29a2056023cde4025a81e340aac004985ab11bb572dcd02c56eb
        • Opcode Fuzzy Hash: 87e8f64d060ce657acae8f117e459f34bbcedaf9ede165fa7995e6b3467e09cf
        • Instruction Fuzzy Hash: 1331D4316016A29BF72A579ECA8CB557BD8FF44B40F1D44E4EA49DB6D1DB28D848C230
        Function 01B761C3 Relevance: .1, Instructions: 97COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e5f26ce685c4a52275ee2635dec711a4f9e1d13d1dcdef08395a25f46d04c679
        • Instruction ID: 09cb233eaf5d235dd84ec00d7115ca053a9ce21e1052804b426b4cf61bafb758
        • Opcode Fuzzy Hash: e5f26ce685c4a52275ee2635dec711a4f9e1d13d1dcdef08395a25f46d04c679
        • Instruction Fuzzy Hash: DD31C175A0061AEBEB19DF98CD40BAEB7B5FB48B40F4541A8E910EB244D770ED41CBA4
        Function 01B5483A Relevance: .1, Instructions: 96COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 21f9e117b351fc3732b754dd0d2fec934ecf3103aee4b41730d998277aae7513
        • Instruction ID: eda013c3a14085aba0c361ca33d7b7ba74e7f93ec80f21d3b75a3146c2cb4b53
        • Opcode Fuzzy Hash: 21f9e117b351fc3732b754dd0d2fec934ecf3103aee4b41730d998277aae7513
        • Instruction Fuzzy Hash: 4A315076A4012DABCF61DF58DD85BDEBBB9EB98350F1000E5A908A7250DB30DE918F90
        Function 01B76BD7 Relevance: .1, Instructions: 96COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7cc5c7909e87d597ef5fed12cc311028f716564714a657b8c596bf9e4473d63d
        • Instruction ID: 47adcc084f1b38efd7a03f8e02b1acfb5f11254e8c2a2ebf932349a813b61d9a
        • Opcode Fuzzy Hash: 7cc5c7909e87d597ef5fed12cc311028f716564714a657b8c596bf9e4473d63d
        • Instruction Fuzzy Hash: E3318E316002049BDB28CF39D9C5A4B7BE8FF58350B8584A9F918DF249E370E945CBA4
        Function 01ADEB20 Relevance: .1, Instructions: 96COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2be5df44d1f56264a3da2576b89598dc478849ae9794be881559f8457c721145
        • Instruction ID: f045fdd10523f231bcd8156174a126c646ef5150d259be13771c82fecd5e5fdb
        • Opcode Fuzzy Hash: 2be5df44d1f56264a3da2576b89598dc478849ae9794be881559f8457c721145
        • Instruction Fuzzy Hash: D031A972E00615EFDB21DFA9CD40AAEBBF9EF44750F118569E516EB250D770AE00CBA0
        Function 01B760B8 Relevance: .1, Instructions: 95COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: df45109af52007c141f01f18fc27a6437b7afd2fbb60f567ee03995ca4c724a6
        • Instruction ID: 7ad9c1232f84f36f48b3e2131f6fa4bc7a97d27ea696b584c12b246bd482721e
        • Opcode Fuzzy Hash: df45109af52007c141f01f18fc27a6437b7afd2fbb60f567ee03995ca4c724a6
        • Instruction Fuzzy Hash: FD31F471B00A06EFEB1A9FAAD840B6AB7F9EF44750F0040ADE515DB752DB70DC008B90
        Function 01AB07AF Relevance: .1, Instructions: 95COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a5e305af1649759a18dc508c54ca5ef4d25bc15b3ddb2552a1b9122cb782add9
        • Instruction ID: 515b189de913bd4bb230e380c5f1b68042076e18f9dc6350f606521ba02bf3ac
        • Opcode Fuzzy Hash: a5e305af1649759a18dc508c54ca5ef4d25bc15b3ddb2552a1b9122cb782add9
        • Instruction Fuzzy Hash: 8F31F672A04782DBC723DE68CAC0AABBBB9AF94650F05452DFD55A7212DB30DD0187E1
        Function 01AB8550 Relevance: .1, Instructions: 94COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9fbf0de82dff354d25451fc2e2c3719f03be7c4ab1f0f233d921c7536793c968
        • Instruction ID: 2539827834354a7fad991c9a6f03b5143a72c0ec6ffb0d7157a841dd5f98f41f
        • Opcode Fuzzy Hash: 9fbf0de82dff354d25451fc2e2c3719f03be7c4ab1f0f233d921c7536793c968
        • Instruction Fuzzy Hash: 5531CC716083418FE324CF1DC884B6ABBE9FB98700F554AADF9889B355D374E904CB91
        Function 00F3D803 Relevance: .1, Instructions: 93COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f0b05cd3774703a81f2afb994fdf7e1d3db068800c51121b54ae9efd7ed78c5d
        • Instruction ID: 67693bd7506b7a63155479329fedca7e44da96192c8619e913d820792429e71f
        • Opcode Fuzzy Hash: f0b05cd3774703a81f2afb994fdf7e1d3db068800c51121b54ae9efd7ed78c5d
        • Instruction Fuzzy Hash: 9731BD76B10A265BD354CE3AD880656B7E6FB88320B648639D919C3B40E774F962CBD0
        Function 00F13030 Relevance: .1, Instructions: 92COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: cc01a60ef4b65bb40cb34eb4be9837551c5e5528f5fedfebf477409b9447f231
        • Instruction ID: 92c595eeb2a4e2b5b12d2af53198cc5beb0eb20ac8e0c4061090122c9156f3a9
        • Opcode Fuzzy Hash: cc01a60ef4b65bb40cb34eb4be9837551c5e5528f5fedfebf477409b9447f231
        • Instruction Fuzzy Hash: C431D473E10E104FD364CA7DD945653B3E1AB9C310B41466DD95AC7B50CB78F952CB80
        Function 01AEA6C7 Relevance: .1, Instructions: 92COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
        • Instruction ID: 130886a4c84bf780efd90bd13ab243a22f31c8065d7e4acd4bbef4826023a8eb
        • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
        • Instruction Fuzzy Hash: EF312CB2B00B11AFD765CF69CE44B57BBF8BB08B50F04052DE59AC3650E630E9008B60
        Function 01B5EBD0 Relevance: .1, Instructions: 91COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 535454ebfef395395e783bc86a66152be061f6735a97b695147fbc864cc03c61
        • Instruction ID: fe294fd5e172f20629eb88ff8ead28d5b288c7b429a0f6e548fc9215e161a28b
        • Opcode Fuzzy Hash: 535454ebfef395395e783bc86a66152be061f6735a97b695147fbc864cc03c61
        • Instruction Fuzzy Hash: 8D31BAB15093018FCB19DF19C640A6AFBF1FF89614F4449EEE8989B211D730DA44CB92
        Function 01AD438F Relevance: .1, Instructions: 89COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c2b624de2791c1d32c0609810d3e96b2c2cb653baef808151d6466520528ea5f
        • Instruction ID: a7fe1e19348b0bd60cfebb3896656cbf4c8c7efd9992f158534c2d2c075e253b
        • Opcode Fuzzy Hash: c2b624de2791c1d32c0609810d3e96b2c2cb653baef808151d6466520528ea5f
        • Instruction Fuzzy Hash: A13138B1B006058FDB24DFB8CA81AAEB7F9FF98304F04842AE116D3A55D730D981CB90
        Function 01AACB7E Relevance: .1, Instructions: 89COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
        • Instruction ID: 3e2c5d8372d0560da987ce11361527cb8d3d5cc27d235d43efe2e048df302fc1
        • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
        • Instruction Fuzzy Hash: 87210432E4025AAAEB119FB9C840BFFBBB5EF14790F0584759E55E7380E370C90087A0
        Function 01AAC156 Relevance: .1, Instructions: 88COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a12bcc987e6bdf3e418c7f7c63e933e22718c65bde15af29cb905e2570249d14
        • Instruction ID: 004f74905d75b4738ee38ce096dccf772497dc540524db565b2240244498b398
        • Opcode Fuzzy Hash: a12bcc987e6bdf3e418c7f7c63e933e22718c65bde15af29cb905e2570249d14
        • Instruction Fuzzy Hash: 293149B15003018BDB26AFA8CC41BB97B74EF50714F9881E9E9459B3C2DB34D985CB90
        Function 01B6C3CD Relevance: .1, Instructions: 88COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
        • Instruction ID: 18b8ca7b6f16d66823cbbcd201e449c370c0a0a800e6703d5efdab91fdac1dd4
        • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
        • Instruction Fuzzy Hash: 30212B36600652A6CF19EB958840ABABFB8EFA0750F40805EFAE587691E73CD950C760
        Function 01AAE420 Relevance: .1, Instructions: 88COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2bc87050c95744b88edbc769fba83095849cac1ead7bc44d8f59a09918452841
        • Instruction ID: 3b4077d2ee7287a3f5ba2cc857a327bdba7264ed9f37acc0044bd54c2c5fcf41
        • Opcode Fuzzy Hash: 2bc87050c95744b88edbc769fba83095849cac1ead7bc44d8f59a09918452841
        • Instruction Fuzzy Hash: 4F31F431A0052D9BDB31DB28CD41FEEB7BDAB15740F4100A5E645A7291D771AE808FA0
        Function 01AE4588 Relevance: .1, Instructions: 87COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
        • Instruction ID: eea9a19d8f712d309b161befb859d74c12fffa8f28943e35125259a89a7862b4
        • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
        • Instruction Fuzzy Hash: 86219131A00609EBCB15DF58C984A8EBBF9FF4C714F108469EE25DB241D674EE058F90
        Function 01AE44B0 Relevance: .1, Instructions: 87COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 87b481c096ddb9ff77d08d86643afa317f3f2ed425512d1a179b69377ad95e88
        • Instruction ID: bfcf6fdc9ee084641fb078a2897375a7586fff68d609257b97f8db181c558397
        • Opcode Fuzzy Hash: 87b481c096ddb9ff77d08d86643afa317f3f2ed425512d1a179b69377ad95e88
        • Instruction Fuzzy Hash: 9721E1326047059BCB22DF68CA84B6B77E8FF8C720F054529FD589B641C734ED018BA2
        Function 01AAE388 Relevance: .1, Instructions: 86COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
        • Instruction ID: 45b16e7e04d1b7ec7a044c88737f85c2065ee8fe493c587dc6f22c2d1466d7da
        • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
        • Instruction Fuzzy Hash: B0319A31600604EFDB25CFA8C984F6AB7B9EF45354F1445A9E5128B281E734EE01CB50
        Function 01B803E6 Relevance: .1, Instructions: 86COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8b2d011676b2a95cfcfa8d531f96c643abac1d24a0e64aabc4aeaf652633e499
        • Instruction ID: bd83af0bb6ff0b3c324b56d83cb73c1b3ed3fb948ac030648eeb887570b3881e
        • Opcode Fuzzy Hash: 8b2d011676b2a95cfcfa8d531f96c643abac1d24a0e64aabc4aeaf652633e499
        • Instruction Fuzzy Hash: CB312571B00119BFCF18EBA9D894AAFBBB9FF88254F454169F905E7240D7706D04CBA0
        Function 01B2E609 Relevance: .1, Instructions: 86COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 683beb77d1fa32f3ecfc55a6698fdc27d3eb0811ac554827d00c93a35f769f5a
        • Instruction ID: 21868b0697dfd429cdef92f19ce56d1183951a7ea888220f28a54608345262a3
        • Opcode Fuzzy Hash: 683beb77d1fa32f3ecfc55a6698fdc27d3eb0811ac554827d00c93a35f769f5a
        • Instruction Fuzzy Hash: EC317C75600215DFCB2ACF1DC8849AEB7F6EF84304B194599F809AB391E771EA45CB90
        Function 01B80591 Relevance: .1, Instructions: 84COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 400b47ba19418fd4902ccc7a2a52e67072c03a04eaaeaacdd2892a965f893fe0
        • Instruction ID: 6db36263c0690ca030249517fbd449f8e5d93da32acdfb25d87e3551518229b8
        • Opcode Fuzzy Hash: 400b47ba19418fd4902ccc7a2a52e67072c03a04eaaeaacdd2892a965f893fe0
        • Instruction Fuzzy Hash: 7A21D0326002058FE72CEE29C8806A6B7A2EF94754F6545B8F914DB285D770F849C760
        Function 01B306F1 Relevance: .1, Instructions: 79COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 25b44963c1df974fc8ecdccfa5b23e53d2d57672604525af31c83013932845be
        • Instruction ID: dea33e1943897f87e5e14c424749d3b4b49520fd3c001deda44696d8a55ed136
        • Opcode Fuzzy Hash: 25b44963c1df974fc8ecdccfa5b23e53d2d57672604525af31c83013932845be
        • Instruction Fuzzy Hash: 16218071A0012AEBCF25DF59C981ABEB7F4FF48740B5100A9F541A7240D738AD52CBA0
        Function 01B3019F Relevance: .1, Instructions: 78COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 00276090c4f8b9158539659ce9ad16d30b4e901ef95b23b823050235768d1ed0
        • Instruction ID: ac652f5a72d52b0ca964c3ad6583cbca0cfed64135593e75b66139f5b5d7902c
        • Opcode Fuzzy Hash: 00276090c4f8b9158539659ce9ad16d30b4e901ef95b23b823050235768d1ed0
        • Instruction Fuzzy Hash: 23219C71600645AFDB15EBADC940F6AB7A8FF88740F1440A9F904D7691D734ED50CBA8
        Function 01B30283 Relevance: .1, Instructions: 74COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6e6d3b332a3784361eff845da7ff386f588516e4af42339ade4416b77b91cfca
        • Instruction ID: 5125f775416d10f29f0e17d88463181fe8893efe9bba6efbb8428e4fda8e33ae
        • Opcode Fuzzy Hash: 6e6d3b332a3784361eff845da7ff386f588516e4af42339ade4416b77b91cfca
        • Instruction Fuzzy Hash: A621D0729047469BD715EF69C984BABBBECEFD5640F08449ABD80C7251D730C918C7A2
        Function 01AD2835 Relevance: .1, Instructions: 73COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f07b26f59506a87b9f538cc5705b0fbcf69ef76bda2f76f9f666c58161788b49
        • Instruction ID: 232174eb6566855f3aa08429be70bce02c5495b2751ae0298ad590256faf618b
        • Opcode Fuzzy Hash: f07b26f59506a87b9f538cc5705b0fbcf69ef76bda2f76f9f666c58161788b49
        • Instruction Fuzzy Hash: 04212331606AC19BE727673C8D44B283B94EF41B70F6A03E5FA219B6E2DB68D801C210
        Function 01B801AA Relevance: .1, Instructions: 71COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: af29f7f4ce59b1a0ba839b7c140550e0ce81fbf631a86ed40b36a25028d853c0
        • Instruction ID: 4392434bad04b82812fdff6b67cefb637259cc4bff008f6d3bb0283ca096236e
        • Opcode Fuzzy Hash: af29f7f4ce59b1a0ba839b7c140550e0ce81fbf631a86ed40b36a25028d853c0
        • Instruction Fuzzy Hash: A821E4612042504FE745CF1E88B54B6BFE5EFC612570D81E6E8C4CB757C524980AC7B0
        Function 01AEA30B Relevance: .1, Instructions: 70COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f62f7f315a99f451b4b2c7d90c394c27a1df9b4fb2c59c297b01889b685edc77
        • Instruction ID: 4c806f36d79557eb808d9f3e375df4ebc25c9fa39327b1b50270b99e36d5f769
        • Opcode Fuzzy Hash: f62f7f315a99f451b4b2c7d90c394c27a1df9b4fb2c59c297b01889b685edc77
        • Instruction Fuzzy Hash: D221AC792006119FCB29DF29C901B56B7F5FF08B04F1884ADE509CB761E371E846CB94
        Function 01B6A49A Relevance: .1, Instructions: 70COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e318cefe0176b8af1d17b7be5d86163d464beec9fccdb3a6100fe8052e4d4a39
        • Instruction ID: dd6cd53201ac8f3d9b343b4ef0077d4542f28e15762552c9581e1d8c0f9deb36
        • Opcode Fuzzy Hash: e318cefe0176b8af1d17b7be5d86163d464beec9fccdb3a6100fe8052e4d4a39
        • Instruction Fuzzy Hash: 3E113A72380A11BFDB26A5749C41F2B769DDBE4B60F1000A8B708EB190EF78DC0187D5
        Function 01B30946 Relevance: .1, Instructions: 70COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a2bccae3f8a25e310e867258cbd0d36f2a250a0254056117d4899bcf40927569
        • Instruction ID: 96af5e3d1af4b668081bf206a02379b199c6a6fd212ce8ff2548edfda2fa9b54
        • Opcode Fuzzy Hash: a2bccae3f8a25e310e867258cbd0d36f2a250a0254056117d4899bcf40927569
        • Instruction Fuzzy Hash: B921C6B1E00249ABDB24DFAED9819AEFBF8FF98710F10016EE505A7250D7709945CB54
        Function 01B480A8 Relevance: .1, Instructions: 69COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
        • Instruction ID: 81e39039b98199623e746b54212991d334971bfce6e568fcf45ed262a749dce3
        • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
        • Instruction Fuzzy Hash: 0B218E72A00209EFDF129F99CC40BAEBBB9EF48710F20845AF905A7251D734D950EB50
        Function 01B7EE26 Relevance: .1, Instructions: 69COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 644678d29aed5766950368498d082e3e59947d091d93fabf8cf9f93cd5d4d4e3
        • Instruction ID: e9545cdfbc898b0adb43dfc891fba1eaf9d69afa0a90234f7c7a28fdca24b0aa
        • Opcode Fuzzy Hash: 644678d29aed5766950368498d082e3e59947d091d93fabf8cf9f93cd5d4d4e3
        • Instruction Fuzzy Hash: 2121B133A108119B9B18CF3CC84546AF7E6EFDC31436E467AD916DB2A4E770F9118784
        Function 01AE0124 Relevance: .1, Instructions: 68COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
        • Instruction ID: e5a4c745ba1e1f696842ecce58c58220394e280672790d70ad3688f7fc7952f9
        • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
        • Instruction Fuzzy Hash: 1411E272600705AFD7269B58CE88F9ABBB8EB80754F110029F6008F180D6B1ED44CB60
        Function 01AB8770 Relevance: .1, Instructions: 68COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 091806fa2197089188d1258ae6114d078558a4e9cefba8b1551944636322aba6
        • Instruction ID: 799bc36383aa4821989cb8e09adbdfd203112549baf5185e71f6797314a61dbf
        • Opcode Fuzzy Hash: 091806fa2197089188d1258ae6114d078558a4e9cefba8b1551944636322aba6
        • Instruction Fuzzy Hash: C61104317016919BDB12CF4DC5C0A9ABBEDAF4A755B1840BDEE088F206D6B6D942C790
        Function 01AEAAEE Relevance: .1, Instructions: 68COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
        • Instruction ID: 640b6244a75b80d1da134ad345758b582ced7807ba0e1a2c98dbe5e5a41e8904
        • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
        • Instruction Fuzzy Hash: 16218872600A41DFDB359F49C648A66FBF6EB94B50F14897DE94A9BA10C730EC01CB80
        Function 01AB80E9 Relevance: .1, Instructions: 66COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e4c272f1176408a3d2c029c9f681917ac27beccbb995671cfe1a02f418e95f36
        • Instruction ID: 78571980afb00c831b75ab50f616ca7930c717e3f7b0700b61456a61dce5c688
        • Opcode Fuzzy Hash: e4c272f1176408a3d2c029c9f681917ac27beccbb995671cfe1a02f418e95f36
        • Instruction Fuzzy Hash: 2D219D71A01246DFCB14CF9CC581AAEBBB9FB88718F24416DD105AB311CB75AD06CBD0
        Function 01AE674D Relevance: .1, Instructions: 65COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: fc6b4a451f2fb35769333cac8490a28dc0634ce16ce229248939ccd262a9b5e8
        • Instruction ID: b76a03c1400c98271ec55ccf6a73fc16c76be5223dee0fe90c6808b55009f2b6
        • Opcode Fuzzy Hash: fc6b4a451f2fb35769333cac8490a28dc0634ce16ce229248939ccd262a9b5e8
        • Instruction Fuzzy Hash: C2218C71600A01EFD7218F69C881B66B7F8FF54650F44882DE5AEC7250DB70A840CBA0
        Function 01ADE8C0 Relevance: .1, Instructions: 63COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 56be0c2c7b2ceee0d1a74e844208fb758e40a6af5058fef832f7506d73fd0339
        • Instruction ID: 4c73fa7f6f698c05a6fc1a5de67d174eac53da777c68877bcbefb868b1559f29
        • Opcode Fuzzy Hash: 56be0c2c7b2ceee0d1a74e844208fb758e40a6af5058fef832f7506d73fd0339
        • Instruction Fuzzy Hash: 3A1125732051109BCB19CB28CD80A7BB766EBD5370B69456DD923CB280EA308C02C690
        Function 01B46870 Relevance: .1, Instructions: 63COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: cc27b79de6a0c9bc46236119c79d860c1420d4db7cb60c53b0ed1f3bc357e777
        • Instruction ID: 85a2d8456ff188910c6602cf94dc2e771cac1a2e5bdc153ca9af01b76bd7b8c0
        • Opcode Fuzzy Hash: cc27b79de6a0c9bc46236119c79d860c1420d4db7cb60c53b0ed1f3bc357e777
        • Instruction Fuzzy Hash: BA11E336640604FFD726DB5DCD40F9A77A8EF5AB50F018069F205DB251DBB0E901D7A0
        Function 01AE66B0 Relevance: .1, Instructions: 61COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0b909ad910cfba8c2183bf9b298d93950570e81a1bbf56161e5d5c73d3c9d261
        • Instruction ID: a4fb0bea7c8b70488150f8a55688505224cea3168d86e7541129d7bd7c0940e8
        • Opcode Fuzzy Hash: 0b909ad910cfba8c2183bf9b298d93950570e81a1bbf56161e5d5c73d3c9d261
        • Instruction Fuzzy Hash: E2119EB6A51205DFCB25CF59C584A5ABBF8AFA4750F09847ED909AB311FB34DD00CB90
        Function 01B7A8E4 Relevance: .1, Instructions: 61COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
        • Instruction ID: ad6e2d6ef71e3c9e6013b6521538912f1a0a3a5d33611536127f60b91405f3b7
        • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
        • Instruction Fuzzy Hash: 6D11C436A00915AFDF1DCB68CC05B9DBBB5EF84210F0982A9E85697380E775BD51CB80
        Function 01AB0AD0 Relevance: .1, Instructions: 61COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
        • Instruction ID: 249209a897d2b86c2b01551c281a43fb3c040da0edd3a407a7a7d650acd052cc
        • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
        • Instruction Fuzzy Hash: FD21C3B5A40B459FD3A0CF29D581B56BBF4FB48B20F10492EE98AC7B50E371E854CB94
        Function 01B3E7E1 Relevance: .1, Instructions: 59COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
        • Instruction ID: bb6901b86dffddf332513cfbebab675a0e96bb052e10d52def05e0d8210833af
        • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
        • Instruction Fuzzy Hash: 2A11C631E00605EFEB299F48C940B567BE5EFC5754F0584AEFA099B190E731EC50DB90
        Function 01AD27ED Relevance: .1, Instructions: 58COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9772fbbcf61707b5a0244e1bcef3e4375694f35e168e2b2d5ef4dfe87a5f6943
        • Instruction ID: 980dc1292c5cd5d2eedcfea26851494b6180b3a9215f78c7579da650ec07c4a0
        • Opcode Fuzzy Hash: 9772fbbcf61707b5a0244e1bcef3e4375694f35e168e2b2d5ef4dfe87a5f6943
        • Instruction Fuzzy Hash: 56012631206A85AFE31BA27DDC84F6B7B9CFF90750F4A40B6F9018B251DA14EC00C2A1
        Function 01AB4690 Relevance: .1, Instructions: 57COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d9679faa85ff975ea143c1e7aee4103d4f09f37e306dcbb5a4bffaec16e80096
        • Instruction ID: 9a0e31ba0aae65b34c20d3115b012783181155bbd3087f4b5975e52dbc4840c7
        • Opcode Fuzzy Hash: d9679faa85ff975ea143c1e7aee4103d4f09f37e306dcbb5a4bffaec16e80096
        • Instruction Fuzzy Hash: 3C11CE76200685AFDB25CF59D984F967BACEB8AB64F04411AF9068B653C370E880DF60
        Function 01B84B00 Relevance: .1, Instructions: 57COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 02c4bfb6f9167725db88c9a0c48c27fe1307c993636ea6f704a959ee6adf0000
        • Instruction ID: 79e030b552183b24d8a0852d5f568d981f49400aa1fad39fb4a1b05f8f54e6e5
        • Opcode Fuzzy Hash: 02c4bfb6f9167725db88c9a0c48c27fe1307c993636ea6f704a959ee6adf0000
        • Instruction Fuzzy Hash: CC11E9362006129FD726EA69D840F67B7A5FFC4B11F154569E646C7690DB30E802C790
        Function 01AE6620 Relevance: .1, Instructions: 56COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9454cbddc00b3922ce11fc5357e4cc63a6e8546f02441d134b6c81e565c569d5
        • Instruction ID: 40dbf89c4e7728cfae748aecddca45ee59082f91dc0e51ae7ff2dda14c5ff61b
        • Opcode Fuzzy Hash: 9454cbddc00b3922ce11fc5357e4cc63a6e8546f02441d134b6c81e565c569d5
        • Instruction Fuzzy Hash: 3611C272A10615ABDB26DF59C9C4B9EFBF8EF54740F500858DA08A7201D734AD018F50
        Function 01ADEA2E Relevance: .1, Instructions: 56COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d6d05033af75dbbde00e4d0a0b71653144a3ee0dd62ac0c5ebb12f1d28465abb
        • Instruction ID: e9b3a2411274a14527520fb13ec84f7852e3d2e7580cb23bfdb00f5e01b812b0
        • Opcode Fuzzy Hash: d6d05033af75dbbde00e4d0a0b71653144a3ee0dd62ac0c5ebb12f1d28465abb
        • Instruction Fuzzy Hash: 9E01F17160014AAFC325DF18D584F66BBFAFB81314F6081AAE1068B266D770ED42CBA0
        Function 01ADE53E Relevance: .1, Instructions: 55COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
        • Instruction ID: 0047c5097f4f8fc95c995b959f9f716154bbed355009a33d0cc29c39bb386b76
        • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
        • Instruction Fuzzy Hash: 0E11E572201AC29BEB27976CC944B753BA4EF00BC4F5E04E8DE428B642F329C846C250
        Function 01B3E75D Relevance: .1, Instructions: 54COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
        • Instruction ID: 8eb3284dbb91a8c57c9a1188cb8c89f9e417826d6a34587ff5830e94dd8ead08
        • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
        • Instruction Fuzzy Hash: 1B01F536600105EFEB2A9F58CD40F5B7BA9EFC1B50F0581A6FA059B260E771DD50CB90
        Function 01AAA250 Relevance: .1, Instructions: 52COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
        • Instruction ID: cda93277b4f64e8c011a311fcb6f86cb684ebba839e02f1f086a3c7b8ff4cba0
        • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
        • Instruction Fuzzy Hash: 85014572504B229BCB328F19D840A327BF4FF55B607408A2DFD958B2A1C331D828CBA0
        Function 01B84940 Relevance: .1, Instructions: 52COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 720df5a2b3de4837979c03f04d7529e2d1a260d4608036d9ee577a3dbe99575a
        • Instruction ID: 3db42f82d6718bea24764c98fb49730670d81518c693c1844629af8c4a2f2a68
        • Opcode Fuzzy Hash: 720df5a2b3de4837979c03f04d7529e2d1a260d4608036d9ee577a3dbe99575a
        • Instruction Fuzzy Hash: 470145724416029FC336EF1CC904F52F7A8EB91B70B2643A9E9A89B1A2D730DC01CBC0
        Function 01B2E1D0 Relevance: .1, Instructions: 51COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 145b9a528fd2638dea792352c141f96957bc8d56bc3a839915e449c17b317ab3
        • Instruction ID: 85f0b740ef3b101b93954d0f7adc273ededae3870b79b4dc54de1a0f943608ee
        • Opcode Fuzzy Hash: 145b9a528fd2638dea792352c141f96957bc8d56bc3a839915e449c17b317ab3
        • Instruction Fuzzy Hash: 8C11C431241641EFDB15EF59CD80F567BB8FF58B54F1400A9F9069B661C335ED01CAA0
        Function 01AB6259 Relevance: .1, Instructions: 51COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4cb1f6b75cb652b489920cee824f4e6615928c4953e5bac942f013a87d506f67
        • Instruction ID: 02cf8abdf0e5db594246f75c736d5701028e5ec7b0abd7ce78d88b573e327428
        • Opcode Fuzzy Hash: 4cb1f6b75cb652b489920cee824f4e6615928c4953e5bac942f013a87d506f67
        • Instruction Fuzzy Hash: 04114870941229ABEB25AF64CE42FE9B2B8BF04710F5041D9B718A60E1DB709E81CF84
        Function 01AB208A Relevance: .0, Instructions: 50COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
        • Instruction ID: 76e48faaadf0d9d51892daa5dbf58b1f1aa0f50046278d244bc904aa4605bb6f
        • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
        • Instruction Fuzzy Hash: 9001F5322001418BDF269A2DD8C0BA27B6AFFC4610F1944ABED058F287DA71AC81C790
        Function 01B36050 Relevance: .0, Instructions: 50COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b26d8e188c6ba7cd1e001f23348763c9d6057af971d3180ee0484a95b966890b
        • Instruction ID: cbd68a3722267c083144b4c3054a623f3b18c10ff5f09f407c24a5da1b33c0ed
        • Opcode Fuzzy Hash: b26d8e188c6ba7cd1e001f23348763c9d6057af971d3180ee0484a95b966890b
        • Instruction Fuzzy Hash: A5111772900019BBCB15DB94CD85DEFBBBCEF58354F044166E916E7211EA34EA15CBE0
        Function 01B46500 Relevance: .0, Instructions: 50COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e712c8360d745233cc0805a80c999413d84b1287192fb48854b4fe3ccaea9988
        • Instruction ID: dd5d5c6f2c9a5d320d20d89f44daacdbf39f9f0b952babbe5338692e65793444
        • Opcode Fuzzy Hash: e712c8360d745233cc0805a80c999413d84b1287192fb48854b4fe3ccaea9988
        • Instruction Fuzzy Hash: E111C47264414A9FD715CF58D810BA6BBB9FB5A314F08C199E888CB315D732EC81DBE0
        Function 01B3C810 Relevance: .0, Instructions: 50COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 01cf5f2fedac5d111ac2d059d12b513f56215bc1fce994f8091988c3fd9e3f8c
        • Instruction ID: 33bba78c4e71d64bd11c354df9616af82828ec90f7f456ae4ee3ccdf0dcf1bf6
        • Opcode Fuzzy Hash: 01cf5f2fedac5d111ac2d059d12b513f56215bc1fce994f8091988c3fd9e3f8c
        • Instruction Fuzzy Hash: 3111E8B5A002099BCB04DFA9D581AAEBBF8FF58250F10806AF905E7351D674EE01CBA4
        Function 01AF20F0 Relevance: .0, Instructions: 49COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ec29ff20a420604ec4e84a05387630c491e077829d3783be6f4b1af4b0dd4502
        • Instruction ID: 6576a8499254044ee59ac96814da37d4754a397787b4df1795bb28910af092de
        • Opcode Fuzzy Hash: ec29ff20a420604ec4e84a05387630c491e077829d3783be6f4b1af4b0dd4502
        • Instruction Fuzzy Hash: EF116935A0020DABCF15EFA4C951BAE7BB5EB49690F108099FA059B290DB35EE11CB94
        Function 01AAC020 Relevance: .0, Instructions: 49COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
        • Instruction ID: e1066d2da7e12301032437bf06a2ec36c97544314fd9cf2b8159185d80423d50
        • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
        • Instruction Fuzzy Hash: 3201D8321407059FEB27A6A9C900FA77BF9FFC5660F44885DE9468B580EB71E401CB50
        Function 01AEE5CF Relevance: .0, Instructions: 49COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: bab9807c4e33fdc0a416ff34fd3cb56827a9e8efc8d6c6101565f97d5bc5cce2
        • Instruction ID: 33858f613b76142f1649b7d69a4e38377a03a7652a2971cc6b31d9c25cfa3386
        • Opcode Fuzzy Hash: bab9807c4e33fdc0a416ff34fd3cb56827a9e8efc8d6c6101565f97d5bc5cce2
        • Instruction Fuzzy Hash: FF01F7B2200915BFC315AB39CE40F57B7ACFF55A54B04062AF10983561DB24EC01C6E0
        Function 01B469C0 Relevance: .0, Instructions: 49COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2cb4329d9ed9ed9d49e2957f61574c87b3a42c830d2354c7ba65a5ea32b0778c
        • Instruction ID: c1c1c341161d70f045ef4e52cdc3fc290c6bdaa6f7499fda70bb6d6d08d34f05
        • Opcode Fuzzy Hash: 2cb4329d9ed9ed9d49e2957f61574c87b3a42c830d2354c7ba65a5ea32b0778c
        • Instruction Fuzzy Hash: AC014C322147069BC324DF69D888AB7BBA8FF49720F118269F95887280E7309901C7D1
        Function 01B3C460 Relevance: .0, Instructions: 48COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d34ef8c34894e8fcea4411a8812bafd1f1ce75d2699e6290289bd432ab3c4ff3
        • Instruction ID: 9ab870762a26b1b9bed6a0015779d704c8c1ca93c2e2fa82f8779758f161e5fc
        • Opcode Fuzzy Hash: d34ef8c34894e8fcea4411a8812bafd1f1ce75d2699e6290289bd432ab3c4ff3
        • Instruction Fuzzy Hash: 9E115B71A00209ABDF19EFA8C944EAE7BB5EB88340F00409AF901A7340DB35E921CB90
        Function 01B3C97C Relevance: .0, Instructions: 48COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1854351d653de76c0d86e9b162a03880bf07c60cf211ed600335e483f924fa97
        • Instruction ID: 8b7f8cc84623179d2382d77a53bd6ac88dbf9c2b3ea75ecf6926b3efad7c34e8
        • Opcode Fuzzy Hash: 1854351d653de76c0d86e9b162a03880bf07c60cf211ed600335e483f924fa97
        • Instruction Fuzzy Hash: 1D115A716043049FC700DF69C54195BBBE4EF98610F00855EBA98D7350D730E900CB92
        Function 01B84A80 Relevance: .0, Instructions: 48COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
        • Instruction ID: e054c0a4c7f0f68ea82bc2330bf85612fae34e8f6808b29ed749df15fd4be41d
        • Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
        • Instruction Fuzzy Hash: 1001D8362006029FDB29AB69D844F96FBE6FFC5B10F044859E6428F650DB70F840C754
        Function 01B3CA11 Relevance: .0, Instructions: 48COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f14ee4b397cc38ab48517656318bba099f1c718c817c1cf4260cc55d883d8840
        • Instruction ID: 8052e4026bc7e94a22fbd231d045861597a1116ad83f6647eec4635eb25531b9
        • Opcode Fuzzy Hash: f14ee4b397cc38ab48517656318bba099f1c718c817c1cf4260cc55d883d8840
        • Instruction Fuzzy Hash: 2E1157B16083089FC700DFA9C541A5BBBE4EF99750F00895EBA58D73A4E630E901CB92
        Function 01ACE016 Relevance: .0, Instructions: 46COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
        • Instruction ID: ae2064a5e461c082fbb5e5000f47ad5058c47ae2aecfd23a1536ade11c0063bb
        • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
        • Instruction Fuzzy Hash: 72017C322406809FE32B971DC988F267FE8EF44B64F0D44A5F909CB6E2DB68DC40C661
        Function 01AA826B Relevance: .0, Instructions: 46COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 787fb9c87e9253e534c27823701390d17086aaaa45d3c71c1a20ea3f78cae4e4
        • Instruction ID: 5d87698b5b7d43e3e5a54bda64add9d0c5289abcef7703ac860def5b8b214ef4
        • Opcode Fuzzy Hash: 787fb9c87e9253e534c27823701390d17086aaaa45d3c71c1a20ea3f78cae4e4
        • Instruction Fuzzy Hash: 6D01F771B00505EBCB18EBA9DD44ABFBBF8FF84210B854069D901A7280DF30DC05C290
        Function 01B5EB50 Relevance: .0, Instructions: 46COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: InitializeThunk
        • String ID:
        • API String ID: 2994545307-0
        • Opcode ID: 34a76d15b4743d01b6beb87943271fe592ba15adf6562efa52555ee73de77377
        • Instruction ID: 435565ec1ce870b010a73187ede361f8ccac714bdcfc5ed784b80467598e6492
        • Opcode Fuzzy Hash: 34a76d15b4743d01b6beb87943271fe592ba15adf6562efa52555ee73de77377
        • Instruction Fuzzy Hash: B601DFB1684602AFD3395B19D941F12FAA8EF54B90F00046EF60A8B3A0C7B0D8408B94
        Function 01AB2582 Relevance: .0, Instructions: 45COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 042972800a9fbf6d1c56ce73feadd6e85e56160f12cea17a2e6836232dd096d8
        • Instruction ID: 29d4b93ffa6b2eadd187ead78b661d397bdfca92e7d88b47b420fdfe2ab15b70
        • Opcode Fuzzy Hash: 042972800a9fbf6d1c56ce73feadd6e85e56160f12cea17a2e6836232dd096d8
        • Instruction Fuzzy Hash: 4EF0F932741650B7C7319B568D80F577EAEEF84E90F04456AB60597641C634ED01CAA0
        Function 01ADC073 Relevance: .0, Instructions: 43COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
        • Instruction ID: 4425d0a935547de773268d0a3f31089e16e2e3d7e80cf31dcbff4c6d93f4feab
        • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
        • Instruction Fuzzy Hash: 19F0C2B2A00A11ABD324CF4DDD40E57FBEADBD1AA0F04812CF605C7220EA31ED04CB90
        Function 01AAC310 Relevance: .0, Instructions: 43COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
        • Instruction ID: b5e55eddf89b10c4abe2530462d18b56c0c04d34ab6e6e0eb859fec4f71a895c
        • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
        • Instruction Fuzzy Hash: 5DF0FC732046239FF732576D8940B6BE9A58FD5A74F590039E2059B248CB608D0157E0
        Function 01B8634F Relevance: .0, Instructions: 43COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2d394b407daaf7477c74ab18ae182cda50667491b813a6acdc81e033999aa0f9
        • Instruction ID: 6cc5609b8f7a3d7f4813944d86b19fd086532dca9a1592d00a95e2a715883223
        • Opcode Fuzzy Hash: 2d394b407daaf7477c74ab18ae182cda50667491b813a6acdc81e033999aa0f9
        • Instruction Fuzzy Hash: F6014F71A10609EFDB04DFA9D591AAEB7F8FF58704F10406AFA14E7350D7749A01CBA4
        Function 01B862D6 Relevance: .0, Instructions: 43COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a560cb13660615b29e490ed3df2b17babdfeecbe2f5aeb27e62b1cd0d5bd317a
        • Instruction ID: e57df565b5422ab541c559a5a779cd33485e2580cb4d119176b770ee680c80ff
        • Opcode Fuzzy Hash: a560cb13660615b29e490ed3df2b17babdfeecbe2f5aeb27e62b1cd0d5bd317a
        • Instruction Fuzzy Hash: 1D012171A0020AABDB04DFA9D541AAEB7F8EF58704F50805AFA14E7350D7749D01CBA4
        Function 01B8625D Relevance: .0, Instructions: 43COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 43e13fa391c82d0abbabdcac75efcd528c53780963c68e4d71890ebbc571abb3
        • Instruction ID: e1b8ea296d64ad2ba0be206c2633b38807dbdf8afd350bcb6eb48e6a9f1d2671
        • Opcode Fuzzy Hash: 43e13fa391c82d0abbabdcac75efcd528c53780963c68e4d71890ebbc571abb3
        • Instruction Fuzzy Hash: 7F017171A00209EBCB04DFA9D541AAEB7F8EF58700F10805AF900E7350D7749901CBA0
        Function 01AECA6F Relevance: .0, Instructions: 42COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
        • Instruction ID: ff7ce0ae48d295434f5a2f39e46b1acc943d0b663022ba408bfd9e72da1c86fb
        • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
        • Instruction Fuzzy Hash: 2901F4322006959BD727A71DD809F99BBD9EF51764F0D84A5FA188B6A2D779C800C250
        Function 01B861E5 Relevance: .0, Instructions: 41COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f46125d70e6b33ee873711a29abfb0867dd6b34b4d872141c385d5d07878d5b5
        • Instruction ID: b75ed1a9a4fcdbe7a2cdd3beb165407f961701c94c2990cd7ec2a3285b5f80f0
        • Opcode Fuzzy Hash: f46125d70e6b33ee873711a29abfb0867dd6b34b4d872141c385d5d07878d5b5
        • Instruction Fuzzy Hash: D0014F71A002499BDB04DFA9D545AEEBBF8FF58710F14409AF501E7290D774EA01CB94
        Function 01B363C0 Relevance: .0, Instructions: 41COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
        • Instruction ID: fc8ec70ed4527978fb2e24cd167baebbf654681f834adc52c56b6ccd024ac06a
        • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
        • Instruction Fuzzy Hash: F1F0F97220001DBFEF019F94DE81DAF7B7EEB99698B104165BA11A2160D631DE21ABA0
        Function 01B3A4B0 Relevance: .0, Instructions: 40COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3a13363256076030066465af8af16d23fdf67041c17946fe184f41ab319376fc
        • Instruction ID: 38fd4a71abe97810230fcb42041f515fd608754ae1e61bb439c2795cc7daa661
        • Opcode Fuzzy Hash: 3a13363256076030066465af8af16d23fdf67041c17946fe184f41ab319376fc
        • Instruction Fuzzy Hash: D6019A36100209ABCF129F94DC40EDE3F66FB4C754F068141FE19A6260C332E970EB81
        Function 01AAC0F0 Relevance: .0, Instructions: 39COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9f2a64351149b2ab7a9959bee64be59dee701b31a9fd45df8654a09491b4328c
        • Instruction ID: 2a4a6d097bcd15642b428ad58ac429ece5cd26b4dc4bc17f2846d45058895d15
        • Opcode Fuzzy Hash: 9f2a64351149b2ab7a9959bee64be59dee701b31a9fd45df8654a09491b4328c
        • Instruction Fuzzy Hash: B8F024713043415BF758A7699C01B2236AAE7C0760FA9806AEB098F6C5FB70EC0183A4
        Function 01AE656A Relevance: .0, Instructions: 39COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4c9987afd5b4ee7033785cebeec2142955ffb7f1a7c8c68b1f6b751b68169759
        • Instruction ID: b1b4d82442dc111e697f802f1f72549cd0661442d0fb8c4e89c67e933b8532f4
        • Opcode Fuzzy Hash: 4c9987afd5b4ee7033785cebeec2142955ffb7f1a7c8c68b1f6b751b68169759
        • Instruction Fuzzy Hash: EB01A4703006819BE737977CCD4CF653BE4FF50B00F4949A4FA498BAD6D728D8018620
        Function 01B5437C Relevance: .0, Instructions: 37COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
        • Instruction ID: ca13e1490ca86c7d828e4094b0b41e5341e8f350906be47d008058b38f53a640
        • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
        • Instruction Fuzzy Hash: 9AF02E31741D1347EBBDAB2E8554B2FA696DF90D40B0505BC9D01CB661FF20DC80C790
        Function 01B3C89D Relevance: .0, Instructions: 36COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8936586de897729c6913216b9acbad25a454c64977e90ad0e555a2abd61edffc
        • Instruction ID: d786fdaef61af0ee487ced8df243d343aa3c9a9cbd6d27174873029ef63571a1
        • Opcode Fuzzy Hash: 8936586de897729c6913216b9acbad25a454c64977e90ad0e555a2abd61edffc
        • Instruction Fuzzy Hash: CBF0AF716053049FC714EF68C542A2BBBE4FF98710F408A5EB998DB390E734EA01C796
        Function 01B3E872 Relevance: .0, Instructions: 36COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
        • Instruction ID: 2a17cac4db121086e1114bce96f12295545dbd35495dfeb550768074bd640ae8
        • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
        • Instruction Fuzzy Hash: C3F08933F155129BD7359A4DCC80F56B768EFD5A60F1901AAAA04AB260C760FC11C7D0
        Function 01AE0854 Relevance: .0, Instructions: 35COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
        • Instruction ID: 74ee4ee5d8c36a1d169f5c13fc737b5611a0b0cc6cfb9daeb7a3a518b0e4f834
        • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
        • Instruction Fuzzy Hash: F0F0BE72710205AFE725DB25CE05F96B6F9EFA8740F148478E949D72A0FAB0EE01C694
        Function 01B3C912 Relevance: .0, Instructions: 34COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9f067f6cbbd03b2f1e859e5a7262725088c41922f76633e1366cb8f7871bb229
        • Instruction ID: 097cb3df08b7ba51ed733466678be37f31ba9c99fa3dbcd9911826b156b830ce
        • Opcode Fuzzy Hash: 9f067f6cbbd03b2f1e859e5a7262725088c41922f76633e1366cb8f7871bb229
        • Instruction Fuzzy Hash: BBF06270A01249DFCB04EFA9C655AAEBBF4FF58300F00815AB955EB385DA34EE01CB54
        Function 01AB47FB Relevance: .0, Instructions: 33COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 82e77a36450c5a10569d07c6686f59d2d1c576e370768cb9c9d8b49a418a9078
        • Instruction ID: 90352160b5b5464e19f750485883f82f929fea790cdb03ba893afdea01f5285c
        • Opcode Fuzzy Hash: 82e77a36450c5a10569d07c6686f59d2d1c576e370768cb9c9d8b49a418a9078
        • Instruction Fuzzy Hash: 76F0B4319166E19FE733DBECC5C4BA17BECEB08A30F08496AE58B87543C724D880C691
        Function 01B70115 Relevance: .0, Instructions: 32COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ec3f921088fe0663ba2b56003d0276aa2ec916b3642012a417cc8975196f6873
        • Instruction ID: 880463b52ff77a02bf1fe0c70d480aa3d37b0d5583caefc075886aa728b65b3d
        • Opcode Fuzzy Hash: ec3f921088fe0663ba2b56003d0276aa2ec916b3642012a417cc8975196f6873
        • Instruction Fuzzy Hash: CAF05CAB4196C00ACF3A7B3C74613D16F58E767210F4D20CAF5B157605C7788483C320
        Function 01AEC5ED Relevance: .0, Instructions: 31COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4610be2f12dab9c5fd3fea4047cc1ba81d560ce57da4c21b530f2949171d116b
        • Instruction ID: 31c2ed3ed1f41a0762788d3554dadf1cba1ae5027cfd39471724e31053b488e1
        • Opcode Fuzzy Hash: 4610be2f12dab9c5fd3fea4047cc1ba81d560ce57da4c21b530f2949171d116b
        • Instruction Fuzzy Hash: 51F0E2715156919FE722971CC14CB23BBE49B81BB1F08B465D40A87556C364E880CE50
        Function 01AF2619 Relevance: .0, Instructions: 31COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
        • Instruction ID: 0d8bdd64d85ae9d0966481ae6bc62ee28c29eaef477f442586840ae2cc8b666c
        • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
        • Instruction Fuzzy Hash: FFE0D8723006016BE7119F998DC0F477B6EDFD6B10F04007EB6045F251CAE2DC0986A4
        Function 01B46030 Relevance: .0, Instructions: 29COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
        • Instruction ID: 158e084d13c291ce42b7bf75b128ab06cfe09dce7679fc5d4c825a9dc4422610
        • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
        • Instruction Fuzzy Hash: 5DF06572204204DFE3298F09D984F52B7F8EB1A765F45C069E6099B661D379EC40DFA4
        Function 01AB0710 Relevance: .0, Instructions: 28COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
        • Instruction ID: 42e9d39f0dda097c1fb76e5aae1722c34383243fdfd79a9ae2f2bf6a27d1e755
        • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
        • Instruction Fuzzy Hash: 9CF0E539204B819BDB1ACF19C190AD6BBF8FB51350F0444D4F8468B352D731E9C2CB50
        Function 01AE49D0 Relevance: .0, Instructions: 28COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
        • Instruction ID: d476f3aa9ce4420087ec6d112fdcc9c9d87e4470872beac6c5fd305746011f09
        • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
        • Instruction Fuzzy Hash: 35E0D832744145AFD3211A598818B667FEEDBD87F0F150429E200CB150DB70DC40C7D8
        Function 01B84164 Relevance: .0, Instructions: 27COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: bcdcf97cec59490a61132c4629eddaf826f513c51a9da08f7b61ffd036057089
        • Instruction ID: c2371d8c0c0b3db3ba612af5e251bb35667c0eda1603c21a2478307c1ef289ab
        • Opcode Fuzzy Hash: bcdcf97cec59490a61132c4629eddaf826f513c51a9da08f7b61ffd036057089
        • Instruction Fuzzy Hash: 29F06D31A2AA938FE77AF72DE684B567FE4EF10E30F9A05E4D44587952C724EC80C650
        Function 01B5678E Relevance: .0, Instructions: 27COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
        • Instruction ID: 0a495ff303b1fc8c0540f298fa19f6639044a7d07ccc4d012e4bc8a8e28072ac
        • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
        • Instruction Fuzzy Hash: D0E0DF72A00110FBEB219799CE05F9ABFACDB94FA0F050194FA00E7090E630EE00C690
        Function 01B808C0 Relevance: .0, Instructions: 25COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
        • Instruction ID: 0a078d4340c0ca874b7809725ff4e13b67a405ac449abc29eca4afcfb4681f2e
        • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
        • Instruction Fuzzy Hash: D6E09B316513508BCB29BA1DC540A53B7E8DF95AA1F1580E9E90547612C331F887C6D0
        Function 01AB25E0 Relevance: .0, Instructions: 23COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a1c2839884b0141afdcdac42122c4855e4fe10eed0a52cbdafd78d649744c46c
        • Instruction ID: eae1dbd99fd5c8a5505bc5c932aa2e541ac1bbb068460eb6cb4dfee25c425f41
        • Opcode Fuzzy Hash: a1c2839884b0141afdcdac42122c4855e4fe10eed0a52cbdafd78d649744c46c
        • Instruction Fuzzy Hash: 4EE092721005949BC721BF29DE41FDA7B9AEF64760F01451AF11657191CB30B810C784
        Function 01B6A456 Relevance: .0, Instructions: 23COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
        • Instruction ID: 78876262e0ffc645c82eeb305209d41723505c4554ccb75046ba27258aa376dc
        • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
        • Instruction Fuzzy Hash: 4DE01231010A52DFEB366F3ADE48B56BAE5FF60B11F148C6DE196264B0C779D8C1CA40
        Function 01B34000 Relevance: .0, Instructions: 22COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
        • Instruction ID: 6df7d93a54769f6f74a6394dc340b70d286e239823c61c287276bfb97cc27ab4
        • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
        • Instruction Fuzzy Hash: 6DE052793003459FE719CF19C054B66BBB6FFD9A50F28C0A9A9488F205EB36E852CB51
        Function 01AECA38 Relevance: .0, Instructions: 22COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 171a582530e72054139fe4b2bfaf921c5fb72bb456a363575702be35a3bd55a7
        • Instruction ID: 3a8c14fa54b6f3ba469d251eab54d46767e688ea2e74d3dd59efac7671bfa948
        • Opcode Fuzzy Hash: 171a582530e72054139fe4b2bfaf921c5fb72bb456a363575702be35a3bd55a7
        • Instruction Fuzzy Hash: 45D02B725811206ACB35F2197D08F933ADB9B50670F054861F10893014D524CC8197C4
        Function 01AA823B Relevance: .0, Instructions: 21COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
        • Instruction ID: e57f1ecbae618b00f3c2963ceef024db7f68c5e324380c7770d206f5bbcd2f19
        • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
        • Instruction Fuzzy Hash: 34E08C31044A14EEDB322F15DE00B61BAA1FF64F11F14886EF181170A48779A889CA44
        Function 01AB2050 Relevance: .0, Instructions: 20COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c97267b3f575f3aae907c93bbf8a8c756b4e34258c7351dcc60e90fcd917cb8d
        • Instruction ID: 72a3267f3191dcf1b2322957329223565516c18bfe1b406580fc7d181e2c4a11
        • Opcode Fuzzy Hash: c97267b3f575f3aae907c93bbf8a8c756b4e34258c7351dcc60e90fcd917cb8d
        • Instruction Fuzzy Hash: 75E08C321004906BC711FA5DDE51F9A739EEFA4660F044226F15197291CA20BC00C794
        Function 01AE8A90 Relevance: .0, Instructions: 20COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
        • Instruction ID: 59acb9d7fa318bb49b63985ebc073bb9bbee1cc39dacc8fd1d312b96324bafa0
        • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
        • Instruction Fuzzy Hash: 16E08633111A1487C728DE18D515B7277E4EF45720F09463EE61347790C534E544C794
        Function 01B06AA4 Relevance: .0, Instructions: 17COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
        • Instruction ID: a073ddb89d79841198a3163261d318ccb815524bea6e05c5d17f5ac56abc4e2a
        • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
        • Instruction Fuzzy Hash: 0FD05E36511A50AFC7329F1BEA00C53BBF9FFC4F60705066EA54583920C770A846CBA0
        Function 01AEE59C Relevance: .0, Instructions: 16COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
        • Instruction ID: b467d5e157198fc838ead3153ccedd05926df797bc0e859d69952399d4cb9cfa
        • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
        • Instruction Fuzzy Hash: CFD0A932208620ABDB32AA1CFC00FD333E8BB88B20F060499F00CC7050C360AC81CA84
        Function 01B2E908 Relevance: .0, Instructions: 16COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
        • Instruction ID: 06edfa74ff26eb421f215a4e3ae4c318020e29d7cd43d77ff29a4607d216b827
        • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
        • Instruction Fuzzy Hash: 5EE0EC35A506849FDF16DF9AC640F9EBBB9FB94B40F150058E5086B661C734E904CB40
        Function 01AAA0E3 Relevance: .0, Instructions: 15COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
        • Instruction ID: aa4f88f4174a9b8903d4a277b7d102d2d4a1bc82470249b3e9dda93264e9950b
        • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
        • Instruction Fuzzy Hash: 07D02232316030A3CF2897556900FAB6955AF80AA0F0A002D340AA3800C2048C42C2E0
        Function 01AEA830 Relevance: .0, Instructions: 14COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
        • Instruction ID: 55c576427c72930a577e2b0e1f2ce40851695db2ee49cb755cbbe8f0fb096c69
        • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
        • Instruction Fuzzy Hash: 55D012371D054DBBCB119F66DD01FA57BA9EB64BA0F448020B504875A0C63AE950D584
        Function 01AECA24 Relevance: .0, Instructions: 14COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 51addb58dcc16d3a7c4423ff79d437b4ef5a32486159eba029ec606f1c319021
        • Instruction ID: e6799e4895ae886e9f79eb7579f968ea6105983458fa16af9d7d4a35c4066fe9
        • Opcode Fuzzy Hash: 51addb58dcc16d3a7c4423ff79d437b4ef5a32486159eba029ec606f1c319021
        • Instruction Fuzzy Hash: 95D052306050128BDF2BEF0CCA1AAAE3AF1EB10A40F8400ACE601A2820E328D8018A00
        Function 01AC02A0 Relevance: .0, Instructions: 13COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
        • Instruction ID: e4f522411066833b7f6027ddb9a7c5cc510c628aade6bbfbfdd512b92452b97d
        • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
        • Instruction Fuzzy Hash: 59D09239216A80CFD61A8B0CC6A4B1533A4BB44F44F810494E542CBB22E738D940CA00
        Function 01AEC700 Relevance: .0, Instructions: 12COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
        • Instruction ID: 39c6356e3b218ec3ec5d3e0875b087b78aaaacf5de10ef8f48bdeb252cc69b92
        • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
        • Instruction Fuzzy Hash: 72C01232294648AFCB12AA99CE01F567BA9EBA8B40F004021F2048B670C631E820EA84
        Function 01AD0310 Relevance: .0, Instructions: 11COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
        • Instruction ID: 945f9f359f3150a890a83dd0a908ced02616fd7974c9df93719e511b2101eb68
        • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
        • Instruction Fuzzy Hash: 0CD01236100648EFCB01DF41C990D9A772AFBD8710F109019FD1A076108A31ED62DA50
        Function 01AB0750 Relevance: .0, Instructions: 9COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
        • Instruction ID: ba5618fea5925754fff37e5b6a882f0acd3271be4eb2f86f45c59d4af3fcafe9
        • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
        • Instruction Fuzzy Hash: C0C00179601A428BCF2ADA2AD294A897BE4FB44B40F158894E8058BA22E625E805CA10
        Function 00F11961 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
        • Associated: 00000000.00000002.1998246284.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_f10000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: bc1e3f0e8667546700c35475b2b0ef0ea5fe673f3fbf1235c0851c7bf620c47b
        • Instruction ID: 96ed669a42fecec8326fe686c6c56c41b42ddbcd62f2c15234df3b7d95f6330e
        • Opcode Fuzzy Hash: bc1e3f0e8667546700c35475b2b0ef0ea5fe673f3fbf1235c0851c7bf620c47b
        • Instruction Fuzzy Hash:
        Function 01AF4340 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b43cbe1bdcb8e10c698f962277132892c8a30dd586c7d7df7e37fdea6b56ab73
        • Instruction ID: a12443446d09224e728f8999279bf5d5caf9e78f602ed6201a16c79eeafef76f
        • Opcode Fuzzy Hash: b43cbe1bdcb8e10c698f962277132892c8a30dd586c7d7df7e37fdea6b56ab73
        • Instruction Fuzzy Hash: 70900232A05C00529145715848845464405A7E0341B55C051E0424599CCB148B965361
        Function 01AF4650 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ef48d3dee61833e0455841e0436e7a38f1afb0a3d8a717206c54312fdfcb5e58
        • Instruction ID: e703d5ef34a8f9766725669a971cddb0da5a9b506aa7fe589aa9ccb8eb0ce052
        • Opcode Fuzzy Hash: ef48d3dee61833e0455841e0436e7a38f1afb0a3d8a717206c54312fdfcb5e58
        • Instruction Fuzzy Hash: 21900262A01900824145715848044066405A7E1341395C155A05545A5CC7188A959369
        Function 01AF2BA0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: cb24a0fb3495b775a1e35f9d45a0fceac8b225d336e59759c6826cd7439d4c04
        • Instruction ID: ced731cc928cfa143a19720919211be567d4689f0956f32bd92dd1747561110f
        • Opcode Fuzzy Hash: cb24a0fb3495b775a1e35f9d45a0fceac8b225d336e59759c6826cd7439d4c04
        • Instruction Fuzzy Hash: AA900232A0580842D15571584414746040597D0341F55C051A0024699DC7558B9577A1
        Function 01AF2B80 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 846802bf6f6255640368420433303c5fd5f09099e0ee80c26d2f32e8dc4aca3b
        • Instruction ID: ad1a6fa0815f026d9ad99fc5011f1abf5ea8d1ea3c8438e3ac660859a09a8d8c
        • Opcode Fuzzy Hash: 846802bf6f6255640368420433303c5fd5f09099e0ee80c26d2f32e8dc4aca3b
        • Instruction Fuzzy Hash: 2590023260180842D10971584804686040597D0341F55C051A602469AED7658AD17231
        Function 01AF2BE0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8435e5a7056b0c8689feb77a97e9dccdeec74bcfeca016f11c71697055ce34a3
        • Instruction ID: 15516548470ec48ef1d3419e9a71eba73f05c6a52ce0b5bcd8d36894af013707
        • Opcode Fuzzy Hash: 8435e5a7056b0c8689feb77a97e9dccdeec74bcfeca016f11c71697055ce34a3
        • Instruction Fuzzy Hash: FD90023260584882D14571584404A46041597D0345F55C051A00646D9DD7258F95B761
        Function 01AF2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: da4093725da007f47b0569a1f7968c934daaf0d3c61ff0b3e3ce01047b4b39e8
        • Instruction ID: a787c8704dc1b662fff80193c6c8a817af6f8f963a911a7f5f2e4f3ff8b5c5a1
        • Opcode Fuzzy Hash: da4093725da007f47b0569a1f7968c934daaf0d3c61ff0b3e3ce01047b4b39e8
        • Instruction Fuzzy Hash: 9090023260180842D1857158440464A040597D1341F95C055A0025699DCB158B9977A1
        Function 01AF2B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e0b2088d070ae7e6ba56f437aab096d46d2282297eaedcc1dc6655e75a02b7f4
        • Instruction ID: 5c96aef408457ed280fd3883dcbc858769536541f53640441b60911387e76d72
        • Opcode Fuzzy Hash: e0b2088d070ae7e6ba56f437aab096d46d2282297eaedcc1dc6655e75a02b7f4
        • Instruction Fuzzy Hash: 0890026260280043410A71584414616440A97E0241B55C061E10145D5DC6258AD16225
        Function 01AF2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4c60a789e449657a5dd6de8bac6be97ed77ae8785bf166f0a837bdc70a1f3de5
        • Instruction ID: bac177237088708c79e3e084b29b6a71a866b31d5ca82231a11d8d1ae8f23b85
        • Opcode Fuzzy Hash: 4c60a789e449657a5dd6de8bac6be97ed77ae8785bf166f0a837bdc70a1f3de5
        • Instruction Fuzzy Hash: 1A9002A2601940D24505B2588404B0A490597E0241B55C056E10545A5CC6258A919235
        Function 01AF2AF0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a5d330f372cad1043599477ea9bc9d1dca98cb34d053b26776f2f69c2bf645c2
        • Instruction ID: 71fe7fcd46c21bd3f7af364d6472a49690d192cc20b30bc9eceac01b21c4195f
        • Opcode Fuzzy Hash: a5d330f372cad1043599477ea9bc9d1dca98cb34d053b26776f2f69c2bf645c2
        • Instruction Fuzzy Hash: C690022662180042014AB558060450B0845A7D6391395C055F14165D5CC7218AA55321
        Function 01AF2AD0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2cf001f3bf81c96ccf95a41d9d6a8b0b4f6d8823517c08ba0d2a6f39fdd24825
        • Instruction ID: a3c272fc3d6753fe34b9cc7c6855d88a1e06743edefd4e4e3b63caa25826aef2
        • Opcode Fuzzy Hash: 2cf001f3bf81c96ccf95a41d9d6a8b0b4f6d8823517c08ba0d2a6f39fdd24825
        • Instruction Fuzzy Hash: 9790022661180043010AB5580704507044697D5391355C061F1015595CD7218AA15221
        Function 01AF2DB0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 93094178b70dd2280a70af3699a192e9de943d4890cbe309ab889102ff35e239
        • Instruction ID: 6c6e80d6a6a8c04cdc40e59521c1cc6cc2b0b11f820066e2089137e7868e111b
        • Opcode Fuzzy Hash: 93094178b70dd2280a70af3699a192e9de943d4890cbe309ab889102ff35e239
        • Instruction Fuzzy Hash: 7B90023264180442D146715844046060409A7D0281F95C052A0424599EC7558B96AB61
        Function 01AF2DD0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4bdeafcfaff5bd443f8cd98f5972ae45d3ad3602931c77fb7cba3fc346bce335
        • Instruction ID: e5d1d78cb13ca353faa0c69b5a9c1c7250b73d7208235d7124401e21932a6232
        • Opcode Fuzzy Hash: 4bdeafcfaff5bd443f8cd98f5972ae45d3ad3602931c77fb7cba3fc346bce335
        • Instruction Fuzzy Hash: 9D90022264284192554AB15844045074406A7E0281795C052A1414995CC6269A96D721
        Function 01AF2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5cf671421cf7985266ba78a0a25ad85213c5620e0ad04b460ae26b652b15bb91
        • Instruction ID: aa3f59700df4ea21a01dafbe71f5485e58c6fab93c16e0c4866a49b8f115c78e
        • Opcode Fuzzy Hash: 5cf671421cf7985266ba78a0a25ad85213c5620e0ad04b460ae26b652b15bb91
        • Instruction Fuzzy Hash: ED90022270180043D145715854186064405E7E1341F55D051E0414599CDA158A965322
        Function 01AF2D00 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 92d9b0c81aeb8280888ab7d409652f8948c75d4cde9cf1f4c6275d11658ac48e
        • Instruction ID: 78eedb609621eddc6d8bd675da3f2f1c955e7953674934a60348ff937699882e
        • Opcode Fuzzy Hash: 92d9b0c81aeb8280888ab7d409652f8948c75d4cde9cf1f4c6275d11658ac48e
        • Instruction Fuzzy Hash: 9390022260584482D10575585408A06040597D0245F55D051A10645DADC7358A91A231
        Function 01AF2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7a8d68a826b632640ce244288d28c60dcbb5078a5f2813083568e56899e98a0c
        • Instruction ID: 48fa016c9bf58239440e6d3bd13181afdc0d132546e264381c36be62bb87256a
        • Opcode Fuzzy Hash: 7a8d68a826b632640ce244288d28c60dcbb5078a5f2813083568e56899e98a0c
        • Instruction Fuzzy Hash: 9990022A61380042D1857158540860A040597D1242F95D455A001559DCCA158AA95321
        Function 01AF2CA0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 159f5254c83419512b5514a1806c67b4c11f14a36bfe8d693edac6c92facc208
        • Instruction ID: d83596a00b7945e667c191641d7a3ad0f3ebe2c5bb572e97272288d31da4b23f
        • Opcode Fuzzy Hash: 159f5254c83419512b5514a1806c67b4c11f14a36bfe8d693edac6c92facc208
        • Instruction Fuzzy Hash: 5590023260180442D10575985408646040597E0341F55D051A502459AEC7658AD16231
        Function 01AF2CF0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6b880c149d6a1ad6b752bc68d309ff2d5de499c9d65d728ac342f7752afa7742
        • Instruction ID: 7d93026be31d2861d627a812e2804fc54f9aa4c8db82d4a3307d4d429d870c0c
        • Opcode Fuzzy Hash: 6b880c149d6a1ad6b752bc68d309ff2d5de499c9d65d728ac342f7752afa7742
        • Instruction Fuzzy Hash: CE90023260180443D10571585508707040597D0241F55D451A042459DDD7568A916221
        Function 01AF2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 56b8cc1bede362571fc3d4b79d8c77ec43889ff5c68f65cfecad7713ffd71926
        • Instruction ID: 090fa2b0a5639f90bfd4b1f43fbfc1c633091e0660211191b9d64b38dfae0e55
        • Opcode Fuzzy Hash: 56b8cc1bede362571fc3d4b79d8c77ec43889ff5c68f65cfecad7713ffd71926
        • Instruction Fuzzy Hash: 08900222A0580442D14571585418706041597D0241F55D051A0024599DC7598B9567A1
        Function 01AF2C60 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a37f7e4c6d084b94c649bed0da3c3de3148cfa6959070f3c43cdfc18b8662b28
        • Instruction ID: 20be5e3b3166570e713eecb5a4981eef92eae745aa13dae647b8b9becddc8d36
        • Opcode Fuzzy Hash: a37f7e4c6d084b94c649bed0da3c3de3148cfa6959070f3c43cdfc18b8662b28
        • Instruction Fuzzy Hash: 5590023260180882D10571584404B46040597E0341F55C056A0124699DC715CA917621
        Function 01AF2C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d37cc8d9fca5d477c40688d7715fed5259d32aea2e4469be626d2ce555fa3794
        • Instruction ID: e6f1855a17781af26dec0b15052c4fa04d9ddb72a5f43a98e355ae6150167d38
        • Opcode Fuzzy Hash: d37cc8d9fca5d477c40688d7715fed5259d32aea2e4469be626d2ce555fa3794
        • Instruction Fuzzy Hash: D790023260188842D1157158840474A040597D0341F59C451A442469DDC7958AD17221
        Function 01AF2FA0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 72fb8a58c6047b7c74132ae7caa7289b32c4d3b1b87aba9a3780f2892b6f7ece
        • Instruction ID: 26059bc958de6bfdc2ce077244d39d6ff4592bc0cf9541c24c2e0db5b0d09e91
        • Opcode Fuzzy Hash: 72fb8a58c6047b7c74132ae7caa7289b32c4d3b1b87aba9a3780f2892b6f7ece
        • Instruction Fuzzy Hash: A2900232601C0442D10571584808747040597D0342F55C051A516459AEC765CAD16631
        Function 01AF2FB0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 163c28eaed26d21f741ee6b2064e37363cd6a670ae6254c2151c5b420156ae44
        • Instruction ID: 1336aab368ed1ba5b40453f04e8f27da38a4843bdc25962be64c934d0a189a7c
        • Opcode Fuzzy Hash: 163c28eaed26d21f741ee6b2064e37363cd6a670ae6254c2151c5b420156ae44
        • Instruction Fuzzy Hash: 6E900222A01800824145716888449064405BBE1251755C161A0998595DC6598AA55765
        Function 01AF2F90 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a65e50270daa2bb95435b3c58ee2dd5f4ef9af8c6dea53c00085e213f38ca63b
        • Instruction ID: e3d722858902d8bb0b2818b5d445f1c80ac136f3e5b8bed2622549d44c60200e
        • Opcode Fuzzy Hash: a65e50270daa2bb95435b3c58ee2dd5f4ef9af8c6dea53c00085e213f38ca63b
        • Instruction Fuzzy Hash: F9900232601C0442D1057158481470B040597D0342F55C051A116459ADC7258A916671
        Function 01AF2FE0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1ac0af7c958f8f0bdba1e2704fb4a5c01c964cfc1d59640d9d8470c9e53dcb91
        • Instruction ID: 833ddf8ed4b81c7a396ddd0d2e2a803ca5e8e2b66eb9027f8d7c1340a86cc52f
        • Opcode Fuzzy Hash: 1ac0af7c958f8f0bdba1e2704fb4a5c01c964cfc1d59640d9d8470c9e53dcb91
        • Instruction Fuzzy Hash: 57900222611C0082D20575684C14B07040597D0343F55C155A0154599CCA158AA15621
        Function 01AF2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8b9cb88b942b682415916452ed00147050de33a9a4a7b6ebc32d11a252a15629
        • Instruction ID: 14060e5e22a0f02ff0ed41e3075afa9906c756b2e3af70eeabba2b96cda46948
        • Opcode Fuzzy Hash: 8b9cb88b942b682415916452ed00147050de33a9a4a7b6ebc32d11a252a15629
        • Instruction Fuzzy Hash: E190026274180482D10571584414B060405D7E1341F55C055E1064599DC719CE926226
        Function 01AF2F60 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8aa3615c7fd2bb64a69ab3fa57336baf0d972abb99d35b2a5005a36baa873813
        • Instruction ID: 3091b2df3532f631e640ff903c121f2cbd62d1d87f0cb57d4afcebbac3ab1dad
        • Opcode Fuzzy Hash: 8aa3615c7fd2bb64a69ab3fa57336baf0d972abb99d35b2a5005a36baa873813
        • Instruction Fuzzy Hash: 7690026261180082D10971584404706044597E1241F55C052A2154599CC6298EA15225
        Function 01AF2EA0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: fcff8806188d88e013620f011c8621efccd10cbafd6440531641b1ebe061c072
        • Instruction ID: f98de20f1c0d4d2f4f9fcb468e5053ba30529a6935d88780b0236d6d76bee596
        • Opcode Fuzzy Hash: fcff8806188d88e013620f011c8621efccd10cbafd6440531641b1ebe061c072
        • Instruction Fuzzy Hash: 1E90027260180442D14571584404746040597D0341F55C051A5064599EC7598FD56765
        Function 01AF2E80 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2bc9327e1e374a4245cadade8c0f0d1b42b9be55cb28bee0617ffdb3a3a24926
        • Instruction ID: 1caedc964de7fb8b4424711dd73c0e91aaaa538642a18c914ead6c804e2b9d9f
        • Opcode Fuzzy Hash: 2bc9327e1e374a4245cadade8c0f0d1b42b9be55cb28bee0617ffdb3a3a24926
        • Instruction Fuzzy Hash: 51900222A0180542D10671584404616040A97D0281F95C062A102459AECB258BD2A231
        Function 01AF2EE0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1c2c8571896961ed634c8704205e6cad7ba91f83d07eaf06db9f0ba49104ce3c
        • Instruction ID: b2fdbcf6edff2816614b1c2ec5b9cfea2ef5c514686f7765c50a3708f16b110c
        • Opcode Fuzzy Hash: 1c2c8571896961ed634c8704205e6cad7ba91f83d07eaf06db9f0ba49104ce3c
        • Instruction Fuzzy Hash: 40900262601C0443D14575584804607040597D0342F55C051A206459AECB298E916235
        Function 01AF2E30 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b400f949e3b304fe1441fb17d2424bf7e247a72e1f6604f804b42b644789540e
        • Instruction ID: 677173c7911cb85eb0c48e3bc8f13e194e831d74a16dadf0353e09945efdf384
        • Opcode Fuzzy Hash: b400f949e3b304fe1441fb17d2424bf7e247a72e1f6604f804b42b644789540e
        • Instruction Fuzzy Hash: 1290022270180442D107715844146060409D7D1385F95C052E142459ADC7258B93A232
        Function 01AF3090 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 926a8404f26061c7d4193bfb2870f7a8a5c11a1f3d4db2fbb75afe99f5b06510
        • Instruction ID: 09b4c82992bea4b54482c0dbb153a67acb4b3d67ba5ef94e183d6670791400e1
        • Opcode Fuzzy Hash: 926a8404f26061c7d4193bfb2870f7a8a5c11a1f3d4db2fbb75afe99f5b06510
        • Instruction Fuzzy Hash: 1D90022264180842D145715884147070406D7D0641F55C051A0024599DC7168BA567B1
        Function 01AF3010 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d804b278630f0c976af6f5a491cde110a171a51eee00b274feb0e14729aef094
        • Instruction ID: 9ffb4703245dddef05847e4aeca554ec6ea0227343ae9fe593b9756f9197effc
        • Opcode Fuzzy Hash: d804b278630f0c976af6f5a491cde110a171a51eee00b274feb0e14729aef094
        • Instruction Fuzzy Hash: 94900222601C4482D14572584804B0F450597E1242F95C059A4156599CCA158A955721
        Function 01AF35C0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 14aa96d6fe81f173833dd3f96c73bbad369f6539ac263bb21a4b5f5004c56873
        • Instruction ID: b04df8a08ad3cdf8b76ac190a7bf45585467035e4dd658d6c6a6510aebb4f1f9
        • Opcode Fuzzy Hash: 14aa96d6fe81f173833dd3f96c73bbad369f6539ac263bb21a4b5f5004c56873
        • Instruction Fuzzy Hash: 03900232A0590442D10571584514706140597D0241F65C451A04245ADDC7958B9166A2
        Function 01AF39B0 Relevance: .0, Instructions: 4COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 49a45d8f1cd9ed5c5ee5d5686c020d9c8fa8ee882b7e2f973cfb69bebb7779d4
        • Instruction ID: a9b9b8ee810fcd59b1b683d8fac2c926dc429860e876f0596450b941695c9dd9
        • Opcode Fuzzy Hash: 49a45d8f1cd9ed5c5ee5d5686c020d9c8fa8ee882b7e2f973cfb69bebb7779d4
        • Instruction Fuzzy Hash: DD90022264585142D155715C44046164405B7E0241F55C061A08145D9DC6558A956321
        Function 01AF2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
        • Instruction ID: d1c13ae296f594338205f387ca54148b2c9fe58baae30b2c71f14179e29606f6
        • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
        • Instruction Fuzzy Hash:
        Function 01AF2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
        Download Yara Rule
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: ___swprintf_l
        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
        • API String ID: 48624451-2108815105
        • Opcode ID: e07fc9a811566a6e58a2f69728ce2791a9dd5d4d103ee38c453f81e1b238d67b
        • Instruction ID: 831c91cb8b726f709f8a9bbbe02347a6cebabce3a4642ab2f43219ac7c85ee98
        • Opcode Fuzzy Hash: e07fc9a811566a6e58a2f69728ce2791a9dd5d4d103ee38c453f81e1b238d67b
        • Instruction Fuzzy Hash: 3C51B6B5A00156BFDB15DBEC8890A7FFBB8BB08240B54826EF569D7641D334DE4487E0
        Function 01B62410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
        Download Yara Rule
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: ___swprintf_l
        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
        • API String ID: 48624451-2108815105
        • Opcode ID: ba5834905847b45f841531f3b4c568d0e62d1ab6112b8a0dfb8a237a2e7d38dc
        • Instruction ID: b9d4ef648b656e219604a9d1ee896c5f8f8c665482c46c0587f6518a53dc7beb
        • Opcode Fuzzy Hash: ba5834905847b45f841531f3b4c568d0e62d1ab6112b8a0dfb8a237a2e7d38dc
        • Instruction Fuzzy Hash: 4D51F575A00646AEEF39DE5CC89097EBBFCEF54200B4484EAE5D6C7681E778DA408760
        Function 01AE7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
        Download Yara Rule
        Strings
        • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01B24742
        • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 01B246FC
        • Execute=1, xrefs: 01B24713
        • ExecuteOptions, xrefs: 01B246A0
        • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01B24725
        • CLIENT(ntdll): Processing section info %ws..., xrefs: 01B24787
        • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01B24655
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
        • API String ID: 0-484625025
        • Opcode ID: c81777d40abaf58ae61cdd273aa50baf65e480a6b18a600f95af52ed8826fbdc
        • Instruction ID: 6fac249583febfa7464bcd1102710df9592e355e9c3f0221059b9db127670a21
        • Opcode Fuzzy Hash: c81777d40abaf58ae61cdd273aa50baf65e480a6b18a600f95af52ed8826fbdc
        • Instruction Fuzzy Hash: 95512B3160021ABAEF25ABE8DC99FBE77F8EF14314F0400D9E605AB191D7709A458F91
        Function 01B86940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
        • Instruction ID: 58adcf44bbb8df271d0aac8b8795565953e6a340f0454bf5623df691cefa6873
        • Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
        • Instruction Fuzzy Hash: 5F022971508342AFD709DF18C590E6BBBE5EFC8B04F148A6DFA8987254DB31E905CB52
        Function 01AFB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
        Download Yara Rule
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: __aulldvrm
        • String ID: +$-$0$0
        • API String ID: 1302938615-699404926
        • Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
        • Instruction ID: 5e535ebcff1d741b9cd3143b13896f31b7315d5bfd3a2424cff256eecbaaf511
        • Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
        • Instruction Fuzzy Hash: 39817F70E062499EEF258FECC8517EEBBB2AF85360F1C415DFA51A7291C73498408BB1
        Function 01B620E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
        Download Yara Rule
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: ___swprintf_l
        • String ID: %%%u$[$]:%u
        • API String ID: 48624451-2819853543
        • Opcode ID: e082d4a0e3f9d4419f2759edc3a9150fcde8382b047d457a7acbdf7f5a8b28ee
        • Instruction ID: 9fc288ecf60332809f5209b09c6701d09980324c0ff99f52bfbba8d777a86018
        • Opcode Fuzzy Hash: e082d4a0e3f9d4419f2759edc3a9150fcde8382b047d457a7acbdf7f5a8b28ee
        • Instruction Fuzzy Hash: 2B213676E00119ABEB15DF69D841AFE7BFCEF64654F44019AEA05D3240E734DA018791
        Function 01ADF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
        Download Yara Rule
        Strings
        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 01B202BD
        • RTL: Re-Waiting, xrefs: 01B2031E
        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 01B202E7
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
        • API String ID: 0-2474120054
        • Opcode ID: ef1bf85b57f2f4e02b4d29c58aaaa0d225b32f351932718a1cd0c3c5de0a76a7
        • Instruction ID: 66832531882546d511c605f4379ba2bba6e76b9085007612cccaec6754d4ba57
        • Opcode Fuzzy Hash: ef1bf85b57f2f4e02b4d29c58aaaa0d225b32f351932718a1cd0c3c5de0a76a7
        • Instruction Fuzzy Hash: AFE19E30604B419FD729DF28C884B6BBBE0FB89314F140A5DF5A68B2E1D774D949CB42
        Function 01AEB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
        Download Yara Rule
        APIs
        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01B2728C
        Strings
        • RTL: Re-Waiting, xrefs: 01B272C1
        • RTL: Resource at %p, xrefs: 01B272A3
        • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01B27294
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
        • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
        • API String ID: 885266447-605551621
        • Opcode ID: 6e320724c53cbb3c83d82a8fc6c9b6262194c901de357e5740c2af16ace6e6ae
        • Instruction ID: 4b517cc34b4d0c157b0a8e9118c9d441ae567172410567587aa1eb17dc0033bd
        • Opcode Fuzzy Hash: 6e320724c53cbb3c83d82a8fc6c9b6262194c901de357e5740c2af16ace6e6ae
        • Instruction Fuzzy Hash: 19412031700217ABCB29DE29CC45B66B7E1FBA6710F100658F959EB280DB30E85687E5
        Function 01B62300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
        Download Yara Rule
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID: ___swprintf_l
        • String ID: %%%u$]:%u
        • API String ID: 48624451-3050659472
        • Opcode ID: d3b25d66010c6bcd4ec38b171c34574ff6ab182561d2cb00abaa3b1204761af0
        • Instruction ID: f1e3c38cd9d662e13e5094cc781fbde499de33343363a02214a47ad82dca3ef2
        • Opcode Fuzzy Hash: d3b25d66010c6bcd4ec38b171c34574ff6ab182561d2cb00abaa3b1204761af0
        • Instruction Fuzzy Hash: 2F318872A002199FDB25DE2DCC80BEE77FCFF54650F4405DAE949E3140EB349A448B60
        Function 01AB9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
        Download Yara Rule
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, Offset: 01A80000, based on PE: true
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_1a80000_17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef7.jbxd
        Similarity
        • API ID:
        • String ID: $$@
        • API String ID: 0-1194432280
        • Opcode ID: ea342207214798dd2c186a71e2190632107a91178ad59943f3aab0a5f1089aec
        • Instruction ID: 617c126d1eddb679879334fdc38cea4ce390121ed3ae0ae086de1557373ee174
        • Opcode Fuzzy Hash: ea342207214798dd2c186a71e2190632107a91178ad59943f3aab0a5f1089aec
        • Instruction Fuzzy Hash: 07811CB1D002699BDB35CB54CD45BEEB7B8AF08754F1541DAEA19B7280D7305E84CFA0